macleans.ca Open in urlscan Pro
104.18.27.168 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://macleans.ca/
Effective URL:
https://macleans.ca/
Submission: On October 17 via api (October 17th 2023, 1:23:12 am UTC) from US — Scanned from CA

Summary HTTP 223 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 62 IPs in 4 countries across 72 domains to perform 223 HTTP transactions. The main IP is 104.18.27.168, located in and belongs to CLOUDFLARENET, US. The main domain is macleans.ca. The Cisco Umbrella rank of the primary domain is 535748.
TLS certificate: Issued by GTS CA 1P5 on September 6th 2023. Valid for: 3 months.

This is the only time macleans.ca was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
38	104.18.27.168 104.18.27.168	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.17.178.181 104.17.178.181	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.253.63.97 172.253.63.97	15169 (GOOGLE) (GOOGLE)
2	104.18.11.207 104.18.11.207	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	31.13.80.12 31.13.80.12	32934 (FACEBOOK) (FACEBOOK)
1	104.16.56.101 104.16.56.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.253.115.95 172.253.115.95	15169 (GOOGLE) (GOOGLE)
6	172.253.63.154 172.253.63.154	15169 (GOOGLE) (GOOGLE)
1	146.75.28.157 146.75.28.157	54113 (FASTLY) (FASTLY)
2	18.239.168.105 18.239.168.105	16509 (AMAZON-02) (AMAZON-02)
1	18.239.164.134 18.239.164.134	16509 (AMAZON-02) (AMAZON-02)
1	18.239.168.6 18.239.168.6	16509 (AMAZON-02) (AMAZON-02)
1	18.161.31.77 18.161.31.77	16509 (AMAZON-02) (AMAZON-02)
2	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	142.251.163.94 142.251.163.94	15169 (GOOGLE) (GOOGLE)
1	18.239.163.131 18.239.163.131	16509 (AMAZON-02) (AMAZON-02)
1	151.101.2.137 151.101.2.137	54113 (FASTLY) (FASTLY)
8	20.49.104.19 20.49.104.19	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	18.239.183.85 18.239.183.85	16509 (AMAZON-02) (AMAZON-02)
4	142.251.111.102 142.251.111.102	15169 (GOOGLE) (GOOGLE)
1	52.6.76.142 52.6.76.142	14618 (AMAZON-AES) (AMAZON-AES)
1	151.101.130.132 151.101.130.132	54113 (FASTLY) (FASTLY)
4 5	172.253.115.156 172.253.115.156	15169 (GOOGLE) (GOOGLE)
1	54.85.101.118 54.85.101.118	14618 (AMAZON-AES) (AMAZON-AES)
3	142.251.163.105 142.251.163.105	15169 (GOOGLE) (GOOGLE)
2	142.251.111.94 142.251.111.94	15169 (GOOGLE) (GOOGLE)
14	172.253.115.113 172.253.115.113	15169 (GOOGLE) (GOOGLE)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
5	52.37.69.61 52.37.69.61	16509 (AMAZON-02) (AMAZON-02)
2	172.253.62.132 172.253.62.132	15169 (GOOGLE) (GOOGLE)
1	31.13.80.36 31.13.80.36	32934 (FACEBOOK) (FACEBOOK)
1	142.93.204.154 142.93.204.154	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1 19	52.46.128.147 52.46.128.147	16509 (AMAZON-02) (AMAZON-02)
1 1	35.214.230.141 35.214.230.141	15169 (GOOGLE) (GOOGLE)
8 8	199.127.204.171 199.127.204.171	26120 (RHYTHMONE) (RHYTHMONE)
2 2	50.116.194.21 50.116.194.21	6336 (TURN-US-ASN) (TURN-US-ASN)
1 1	23.215.40.23 23.215.40.23	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	52.2.174.221 52.2.174.221	14618 (AMAZON-AES) (AMAZON-AES)
1 1	18.239.168.109 18.239.168.109	16509 (AMAZON-02) (AMAZON-02)
2 2	35.194.66.159 35.194.66.159	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4 4	70.42.32.95 70.42.32.95	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
2 2	70.42.32.159 70.42.32.159	13789 (INTERNAP-...) (INTERNAP-BLK3)
2 4	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1 2	69.173.151.100 69.173.151.100	26667 (RUBICONPR...) (RUBICONPROJECT)
3 11	104.18.27.193 104.18.27.193	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	23.105.12.143 23.105.12.143	30633 (LEASEWEB-...) (LEASEWEB-USA-WDC)
4	54.236.119.39 54.236.119.39	14618 (AMAZON-AES) (AMAZON-AES)
2	23.215.40.199 23.215.40.199	16625 (AKAMAI-AS) (AKAMAI-AS)
7 8	68.67.160.137 68.67.160.137	29990 (ASN-APPNEX) (ASN-APPNEX)
3 3	63.251.86.49 63.251.86.49	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
1 6	23.92.190.69 23.92.190.69	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
2 3	52.223.22.214 52.223.22.214	16509 (AMAZON-02) (AMAZON-02)
6 6	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
1 1	54.172.244.151 54.172.244.151	14618 (AMAZON-AES) (AMAZON-AES)
15	172.253.122.155 172.253.122.155	15169 (GOOGLE) (GOOGLE)
4	142.251.163.132 142.251.163.132	15169 (GOOGLE) (GOOGLE)
1	142.251.16.157 142.251.16.157	15169 (GOOGLE) (GOOGLE)
6 14	172.253.115.155 172.253.115.155	15169 (GOOGLE) (GOOGLE)
7	172.253.115.148 172.253.115.148	15169 (GOOGLE) (GOOGLE)
4 4	216.34.207.73 216.34.207.73	3561 (CENTURYLI...) (CENTURYLINK-LEGACY-SAVVIS)
1 1	38.98.69.175 38.98.69.175	174 (COGENT-174) (COGENT-174)
1 1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	35.190.0.66 35.190.0.66	15169 (GOOGLE) (GOOGLE)
1 2	23.60.1.46 23.60.1.46	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	69.90.254.78 69.90.254.78	13768 (COGECO-PEER1) (COGECO-PEER1)
1	34.96.105.8 34.96.105.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	74.119.119.150 74.119.119.150	19750 (AS-CRITEO) (AS-CRITEO)
3 3	35.211.178.172 35.211.178.172	15169 (GOOGLE) (GOOGLE)
2 2	35.211.233.246 35.211.233.246	19527 (GOOGLE-2) (GOOGLE-2)
2	8.28.7.81 8.28.7.81	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2 3	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	40.76.134.238 40.76.134.238	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
7	104.36.113.107 104.36.113.107	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	34.203.51.33 34.203.51.33	14618 (AMAZON-AES) (AMAZON-AES)
1	13.35.84.214 13.35.84.214	16509 (AMAZON-02) (AMAZON-02)
2	104.36.113.111 104.36.113.111	() ()
1	169.197.150.7 169.197.150.7	() ()
1 2	3.223.197.111 3.223.197.111	() ()
1	44.199.102.125 44.199.102.125	() ()
1	44.205.178.7 44.205.178.7	() ()
1 1	34.200.65.202 34.200.65.202	() ()
1 1	52.22.163.254 52.22.163.254	() ()
223	62

38 104.18.27.168 (None, )

ASN13335 (CLOUDFLARENET, US)

macleans.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.178.181 (None, )

ASN13335 (CLOUDFLARENET, US)

output-to-go.mblycdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.63.97 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f97.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.11.207 (None, )

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 31.13.80.12 (Toronto, Canada)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-yyz1.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.56.101 (None, )

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.115.95 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f95.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.253.63.154 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f154.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.28.157 (Ashburn, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.239.168.105 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-239-168-105.bos50.r.cloudfront.net

rumcdn.geoedge.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.239.164.134 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-239-164-134.bos50.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.239.168.6 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-239-168-6.bos50.r.cloudfront.net

config.aps.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.161.31.77 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-161-31-77.bos50.r.cloudfront.net

aax.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.251.163.94 (United States)

ASN15169 (GOOGLE, US)
PTR: wv-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.239.163.131 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-239-163-131.bos50.r.cloudfront.net

static.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.2.137 (United States)

ASN54113 (FASTLY, US)

stream.playbuzz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 20.49.104.19 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

sr.studiostack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.239.183.85 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-239-183-85.bos50.r.cloudfront.net

js.createsend1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.111.102 (United States)

ASN15169 (GOOGLE, US)
PTR: bk-in-f102.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.6.76.142 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-6-76-142.compute-1.amazonaws.com

ping.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.130.132 (United States)

ASN54113 (FASTLY, US)

player.ex.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.253.115.156 (United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: bg-in-f156.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.85.101.118 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-85-101-118.compute-1.amazonaws.com

collector.ex.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.251.163.105 (United States)

ASN15169 (GOOGLE, US)
PTR: wv-in-f105.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.111.94 (United States)

ASN15169 (GOOGLE, US)
PTR: bk-in-f94.1e100.net

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 172.253.115.113 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f113.1e100.net

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 52.37.69.61 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-37-69-61.us-west-2.compute.amazonaws.com

vault.gostatera.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.62.132 (United States)

ASN15169 (GOOGLE, US)
PTR: bc-in-f132.1e100.net

4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 31.13.80.36 (Toronto, Canada)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-yyz1.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.93.204.154 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

sync.cootlogix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 52.46.128.147 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.214.230.141 (Groningen, Netherlands) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 141.230.214.35.bc.googleusercontent.com

csync.loopme.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 199.127.204.171 (United States) 8 redirects

ASN26120 (RHYTHMONE, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 50.116.194.21 (United States) 2 redirects

ASN6336 (TURN-US-ASN, US)
PTR: presentation-atl1.turn.com

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.215.40.23 (McAllen, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-215-40-23.deploy.static.akamaitechnologies.com

cs.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.2.174.221 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-2-174-221.compute-1.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.239.168.109 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-18-239-168-109.bos50.r.cloudfront.net

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.194.66.159 (Washington, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 159.66.194.35.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 70.42.32.95 (United States) 4 redirects

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 70.42.32.159 (United States) 2 redirects

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com

sync.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.244.159.8 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.151.100 (United States) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel-us-east.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 104.18.27.193 (None, ) 3 redirects

ASN13335 (CLOUDFLARENET, US)

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.105.12.143 (Manassas, United States) 1 redirects

ASN30633 (LEASEWEB-USA-WDC, US)

ssbsync-us.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.236.119.39 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-236-119-39.compute-1.amazonaws.com

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.215.40.199 (McAllen, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-215-40-199.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 68.67.160.137 (Fairfield, United States) 7 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 63.251.86.49 (United States) 3 redirects

ASN32475 (SINGLEHOP-LLC, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 23.92.190.69 (Houston, United States) 1 redirects

ASN32475 (SINGLEHOP-LLC, US)

ce.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.223.22.214 (Seattle, United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 3.33.220.150 (Seattle, United States) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.172.244.151 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-172-244-151.compute-1.amazonaws.com

um4.eqads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 172.253.122.155 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f155.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.163.132 (United States)

ASN15169 (GOOGLE, US)
PTR: wv-in-f132.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.16.157 (United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f157.1e100.net

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 172.253.115.155 (United States) 6 redirects

ASN15169 (GOOGLE, US)
PTR: bg-in-f155.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 172.253.115.148 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f148.1e100.net

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 216.34.207.73 (United States) 4 redirects

ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US)
PTR: ric03-nessy-float1.dotomi.com

dclk-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pubmatic-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 38.98.69.175 (New York, United States) 1 redirects

ASN174 (COGENT-174, US)

aep.mxptint.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.0.66 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 66.0.190.35.bc.googleusercontent.com

ads.travelaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.60.1.46 (Piscataway, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-60-1-46.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.90.254.78 (Herndon, United States) 1 redirects

ASN13768 (COGECO-PEER1, CA)

ums.acuityplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.105.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.105.96.34.bc.googleusercontent.com

tr.blismedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.119.119.150 (United States)

ASN19750 (AS-CRITEO, US)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.211.178.172 (North Charleston, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: 172.178.211.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.211.233.246 (North Charleston, United States) 2 redirects

ASN19527 (GOOGLE-2, US)
PTR: 246.233.211.35.bc.googleusercontent.com

a.sportradarserving.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 8.28.7.81 (United States)

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.111.113.62 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 40.76.134.238 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

us01.z.antigena.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.36.113.107 (United States)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.203.51.33 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-203-51-33.compute-1.amazonaws.com

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.84.214 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-84-214.bos50.r.cloudfront.net

gw.geoedge.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.36.113.111 (None, )

ASN- ()

simage4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
image4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 169.197.150.7 (None, )

ASN- ()

match.deepintent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.223.197.111 (None, ) 1 redirects

ASN- ()

thrtle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.199.102.125 (None, )

ASN- ()

crb.kargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.205.178.7 (None, )

ASN- ()

sync.bfmio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.200.65.202 (None, ) 1 redirects

ASN- ()

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.22.163.254 (None, ) 1 redirects

ASN- ()

sync.ipredictive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
38	macleans.ca macleans.ca — Cisco Umbrella Rank: 535748	916 KB
27	doubleclick.net 10 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 45 securepubads.g.doubleclick.net — Cisco Umbrella Rank: 214 stats.g.doubleclick.net — Cisco Umbrella Rank: 98 cm.g.doubleclick.net — Cisco Umbrella Rank: 255 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 443	187 KB
22	amazon-adsystem.com 1 redirects c.amazon-adsystem.com — Cisco Umbrella Rank: 334 config.aps.amazon-adsystem.com — Cisco Umbrella Rank: 657 aax.amazon-adsystem.com — Cisco Umbrella Rank: 426 s.amazon-adsystem.com — Cisco Umbrella Rank: 328	19 KB
19	googlesyndication.com 4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 108 tpc.googlesyndication.com — Cisco Umbrella Rank: 157	129 KB
17	google.com www.google.com — Cisco Umbrella Rank: 2 fundingchoicesmessages.google.com — Cisco Umbrella Rank: 1474	65 KB
13	pubmatic.com ads.pubmatic.com — Cisco Umbrella Rank: 588 image6.pubmatic.com — Cisco Umbrella Rank: 967 image2.pubmatic.com — Cisco Umbrella Rank: 1116 simage2.pubmatic.com simage4.pubmatic.com image4.pubmatic.com	28 KB
11	casalemedia.com 3 redirects ssum-sec.casalemedia.com — Cisco Umbrella Rank: 513 dsum-sec.casalemedia.com — Cisco Umbrella Rank: 716	8 KB
9	lijit.com 4 redirects ap.lijit.com — Cisco Umbrella Rank: 754 ce.lijit.com — Cisco Umbrella Rank: 1199	8 KB
8	adnxs.com 7 redirects ib.adnxs.com — Cisco Umbrella Rank: 261 secure.adnxs.com — Cisco Umbrella Rank: 542	6 KB
8	studiostack.com sr.studiostack.com — Cisco Umbrella Rank: 55058	28 KB
7	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 344	445 KB
6	adsrvr.org 6 redirects match.adsrvr.org — Cisco Umbrella Rank: 402	2 KB
6	1rx.io 6 redirects sync.1rx.io — Cisco Umbrella Rank: 649	4 KB
5	gostatera.com vault.gostatera.com — Cisco Umbrella Rank: 123874	676 B
4	dotomi.com 4 redirects dclk-match.dotomi.com — Cisco Umbrella Rank: 3431 pubmatic-match.dotomi.com	2 KB
4	sharethrough.com match.sharethrough.com — Cisco Umbrella Rank: 621	2 KB
4	openx.net 2 redirects u.openx.net — Cisco Umbrella Rank: 739 us-u.openx.net	985 B
4	zemanta.com 4 redirects b1sync.zemanta.com — Cisco Umbrella Rank: 637	2 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 42	21 KB
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 187	177 KB
3	tapad.com 2 redirects pixel.tapad.com — Cisco Umbrella Rank: 521	1 KB
3	bidswitch.net 3 redirects x.bidswitch.net — Cisco Umbrella Rank: 387	2 KB
3	3lift.com 2 redirects eb2.3lift.com — Cisco Umbrella Rank: 434	1 KB
3	gstatic.com fonts.gstatic.com	56 KB
3	geoedge.be rumcdn.geoedge.be — Cisco Umbrella Rank: 2304 gw.geoedge.be — Cisco Umbrella Rank: 2732	118 KB
2	thrtle.com 1 redirects thrtle.com	682 B
2	sportradarserving.com 2 redirects a.sportradarserving.com — Cisco Umbrella Rank: 2841	972 B
2	teads.tv 1 redirects sync.teads.tv — Cisco Umbrella Rank: 1584	602 B
2	rubiconproject.com 1 redirects pixel-us-east.rubiconproject.com — Cisco Umbrella Rank: 1256 eus.rubiconproject.com Failed	2 KB
2	outbrain.com 2 redirects sync.outbrain.com — Cisco Umbrella Rank: 900	2 KB
2	simpli.fi 2 redirects um.simpli.fi — Cisco Umbrella Rank: 952	1 KB
2	bidr.io 2 redirects match.prod.bidr.io — Cisco Umbrella Rank: 624	1 KB
2	unrulymedia.com 2 redirects sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1343	1 KB
2	turn.com 2 redirects ad.turn.com — Cisco Umbrella Rank: 1024	868 B
2	google.ca www.google.ca — Cisco Umbrella Rank: 9740	562 B
2	ex.co player.ex.co — Cisco Umbrella Rank: 11519 collector.ex.co — Cisco Umbrella Rank: 11449	1 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 250	23 KB
2	yahoo.com c2shb.pubgw.yahoo.com Failed pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 491 ups.analytics.yahoo.com	1 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 49	2 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1183	83 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 56	189 KB
1	ipredictive.com 1 redirects sync.ipredictive.com	554 B
1	bfmio.com sync.bfmio.com	425 B
1	kargo.com crb.kargo.com	358 B
1	deepintent.com match.deepintent.com	338 B
1	antigena.com us01.z.antigena.com — Cisco Umbrella Rank: 4797
1	criteo.com dis.criteo.com — Cisco Umbrella Rank: 648	363 B
1	blismedia.com tr.blismedia.com — Cisco Umbrella Rank: 2268	173 B
1	acuityplatform.com 1 redirects ums.acuityplatform.com — Cisco Umbrella Rank: 1393	609 B
1	travelaudience.com 1 redirects ads.travelaudience.com — Cisco Umbrella Rank: 8325	552 B
1	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 416	640 B
1	mxptint.net 1 redirects aep.mxptint.net — Cisco Umbrella Rank: 7081	729 B
1	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 223	59 KB
1	eqads.com 1 redirects um4.eqads.com — Cisco Umbrella Rank: 2916	271 B
1	smartadserver.com 1 redirects ssbsync-us.smartadserver.com — Cisco Umbrella Rank: 7563	279 B
1	smaato.net 1 redirects s.ad.smaato.net — Cisco Umbrella Rank: 893	440 B
1	media.net 1 redirects cs.media.net — Cisco Umbrella Rank: 1684	665 B
1	loopme.me 1 redirects csync.loopme.me — Cisco Umbrella Rank: 1165	231 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 116	185 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 869	394 B
1	t.co t.co — Cisco Umbrella Rank: 614	376 B
1	chartbeat.net ping.chartbeat.net — Cisco Umbrella Rank: 1445	201 B
1	createsend1.com js.createsend1.com — Cisco Umbrella Rank: 32808	5 KB
1	playbuzz.com stream.playbuzz.com — Cisco Umbrella Rank: 109972	181 KB
1	chartbeat.com static.chartbeat.com — Cisco Umbrella Rank: 1738	15 KB
1	cootlogix.com exchange.cootlogix.com Failed sync.cootlogix.com — Cisco Umbrella Rank: 2537	422 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 792	15 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1113	7 KB
1	mblycdn.com output-to-go.mblycdn.com — Cisco Umbrella Rank: 610652	194 KB
0	contextweb.com Failed bh.contextweb.com Failed
0	demdex.net Failed dpm.demdex.net Failed
0	ctnsnet.com Failed cm.ctnsnet.com Failed
223	72

	Domain	Requested by
38	macleans.ca	macleans.ca
19	s.amazon-adsystem.com	1 redirects output-to-go.mblycdn.com s.amazon-adsystem.com ssum-sec.casalemedia.com ce.lijit.com match.sharethrough.com ads.pubmatic.com
18	cm.g.doubleclick.net	10 redirects googleads.g.doubleclick.net 4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com
14	fundingchoicesmessages.google.com	output-to-go.mblycdn.com macleans.ca
13	pagead2.googlesyndication.com	rumcdn.geoedge.be pagead2.googlesyndication.com 4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com tpc.googlesyndication.com output-to-go.mblycdn.com
8	dsum-sec.casalemedia.com	2 redirects ssum-sec.casalemedia.com googleads.g.doubleclick.net
8	sr.studiostack.com	macleans.ca sr.studiostack.com
7	s0.2mdn.net	rumcdn.geoedge.be s0.2mdn.net
6	match.adsrvr.org	6 redirects
6	ce.lijit.com	1 redirects s.amazon-adsystem.com ce.lijit.com
6	ib.adnxs.com	5 redirects googleads.g.doubleclick.net
6	sync.1rx.io	6 redirects
5	vault.gostatera.com	output-to-go.mblycdn.com
4	simage2.pubmatic.com	s.amazon-adsystem.com ads.pubmatic.com
4	tpc.googlesyndication.com	rumcdn.geoedge.be
4	match.sharethrough.com	s.amazon-adsystem.com match.sharethrough.com
4	b1sync.zemanta.com	4 redirects
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
4	connect.facebook.net	macleans.ca www.googletagmanager.com connect.facebook.net
3	image2.pubmatic.com	s.amazon-adsystem.com
3	pixel.tapad.com	2 redirects s.amazon-adsystem.com
3	x.bidswitch.net	3 redirects
3	eb2.3lift.com	2 redirects s.amazon-adsystem.com
3	ap.lijit.com	3 redirects
3	ssum-sec.casalemedia.com	1 redirects s.amazon-adsystem.com ssum-sec.casalemedia.com
3	u.openx.net	2 redirects s.amazon-adsystem.com
3	www.google.com	macleans.ca rumcdn.geoedge.be
3	fonts.gstatic.com	fonts.googleapis.com
3	securepubads.g.doubleclick.net	output-to-go.mblycdn.com securepubads.g.doubleclick.net
3	googleads.g.doubleclick.net	www.googletagmanager.com rumcdn.geoedge.be
2	pubmatic-match.dotomi.com	2 redirects
2	thrtle.com	1 redirects s.amazon-adsystem.com
2	image6.pubmatic.com	ads.pubmatic.com
2	a.sportradarserving.com	2 redirects
2	googleads4.g.doubleclick.net	rumcdn.geoedge.be
2	sync.teads.tv	1 redirects 4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com
2	dclk-match.dotomi.com	2 redirects
2	secure.adnxs.com	2 redirects
2	ads.pubmatic.com	s.amazon-adsystem.com
2	pixel-us-east.rubiconproject.com	1 redirects s.amazon-adsystem.com
2	sync.outbrain.com	2 redirects
2	um.simpli.fi	2 redirects
2	match.prod.bidr.io	2 redirects
2	sync.targeting.unrulymedia.com	2 redirects
2	ad.turn.com	2 redirects
2	4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com	securepubads.g.doubleclick.net output-to-go.mblycdn.com
2	www.google.ca	macleans.ca
2	cdnjs.cloudflare.com	output-to-go.mblycdn.com s0.2mdn.net
2	rumcdn.geoedge.be	output-to-go.mblycdn.com macleans.ca
2	fonts.googleapis.com	macleans.ca
2	maxcdn.bootstrapcdn.com	macleans.ca maxcdn.bootstrapcdn.com
2	www.googletagmanager.com	macleans.ca www.googletagmanager.com
1	sync.ipredictive.com	1 redirects
1	image4.pubmatic.com	s.amazon-adsystem.com
1	ups.analytics.yahoo.com	1 redirects
1	sync.bfmio.com	s.amazon-adsystem.com
1	crb.kargo.com	s.amazon-adsystem.com
1	us-u.openx.net	s.amazon-adsystem.com
1	match.deepintent.com	ads.pubmatic.com
1	simage4.pubmatic.com	ads.pubmatic.com
1	gw.geoedge.be	rumcdn.geoedge.be
1	pr-bh.ybp.yahoo.com	s.amazon-adsystem.com
1	us01.z.antigena.com	s.amazon-adsystem.com
1	dis.criteo.com	match.sharethrough.com
1	tr.blismedia.com	ce.lijit.com
1	ums.acuityplatform.com	1 redirects
1	ads.travelaudience.com	1 redirects
1	px.ads.linkedin.com	1 redirects
1	aep.mxptint.net	1 redirects
1	www.googletagservices.com	rumcdn.geoedge.be
1	um4.eqads.com	1 redirects
1	ssbsync-us.smartadserver.com	1 redirects
1	s.ad.smaato.net	1 redirects
1	cs.media.net	1 redirects
1	csync.loopme.me	1 redirects
1	sync.cootlogix.com	output-to-go.mblycdn.com
1	www.facebook.com	macleans.ca
1	analytics.twitter.com	macleans.ca
1	t.co	macleans.ca
1	collector.ex.co	stream.playbuzz.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	player.ex.co	stream.playbuzz.com
1	ping.chartbeat.net	macleans.ca
1	js.createsend1.com	www.googletagmanager.com
1	stream.playbuzz.com	macleans.ca
1	static.chartbeat.com	macleans.ca
1	aax.amazon-adsystem.com	output-to-go.mblycdn.com
1	config.aps.amazon-adsystem.com	output-to-go.mblycdn.com
1	c.amazon-adsystem.com	output-to-go.mblycdn.com
1	static.ads-twitter.com	www.googletagmanager.com
1	static.cloudflareinsights.com	macleans.ca
1	output-to-go.mblycdn.com	macleans.ca
0	bh.contextweb.com Failed	ads.pubmatic.com
0	dpm.demdex.net Failed	ssum-sec.casalemedia.com
0	cm.ctnsnet.com Failed	ssum-sec.casalemedia.com
0	eus.rubiconproject.com Failed	s.amazon-adsystem.com
0	c2shb.pubgw.yahoo.com Failed	output-to-go.mblycdn.com
0	exchange.cootlogix.com Failed	output-to-go.mblycdn.com
223	98

This site contains links to these domains. Also see Links.

Domain
education.macleans.ca
stjoseph.com
secure.macleans.ca
www.facebook.com
twitter.com
www.instagram.com
www.youtube.com
www.linkedin.com
www.macleans.ca
adsregistry.rogersmedia.com

Subject Issuer	Validity	Valid
*.macleans.ca GTS CA 1P5	`2023-09-06` - `2023-12-05`	3 months	crt.sh
output-to-go.mblycdn.com E1	`2023-08-29` - `2023-11-27`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-12-30` - `2023-12-30`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-07-26` - `2023-10-24`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
gw.geoedge.be Amazon RSA 2048 M01	`2023-08-12` - `2024-09-09`	a year	crt.sh
c.amazon-adsystem.com Amazon RSA 2048 M01	`2023-02-28` - `2024-02-17`	a year	crt.sh
config.aps.amazon-adsystem.com Amazon RSA 2048 M02	`2023-02-20` - `2024-03-20`	a year	crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com Amazon RSA 2048 M01	`2023-03-16` - `2024-03-08`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.chartbeat.com Thawte TLS RSA CA G1	`2023-05-16` - `2024-06-06`	a year	crt.sh
*.playbuzz.com Go Daddy Secure Certificate Authority - G2	`2023-06-08` - `2024-07-09`	a year	crt.sh
*.studiostack.com Go Daddy Secure Certificate Authority - G2	`2022-11-16` - `2023-12-18`	a year	crt.sh
*.createsend1.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-07` - `2024-08-10`	a year	crt.sh
*.chartbeat.net Thawte RSA CA 2018	`2022-12-19` - `2023-12-30`	a year	crt.sh
*.ex.co Go Daddy Secure Certificate Authority - G2	`2023-06-08` - `2024-07-09`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.google.ca GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2023-02-01` - `2024-02-01`	a year	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-31` - `2024-01-30`	a year	crt.sh
gostatera.com Amazon RSA 2048 M02	`2023-02-08` - `2024-02-02`	a year	crt.sh
*.cootlogix.com Sectigo RSA Domain Validation Secure Server CA	`2022-11-14` - `2023-11-14`	a year	crt.sh
s.amazon-adsystem.com Amazon RSA 2048 M01	`2023-03-03` - `2024-02-19`	a year	crt.sh
casalemedia.com Cloudflare Inc ECC CA-3	`2023-05-21` - `2024-05-20`	a year	crt.sh
*.openx.net RapidSSL TLS RSA CA G1	`2023-08-18` - `2024-08-18`	a year	crt.sh
*.sharethrough.com Amazon RSA 2048 M01	`2023-06-14` - `2024-07-12`	a year	crt.sh
*.pubmatic.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-25` - `2024-01-24`	a year	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2023-05-06` - `2024-05-04`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
tr.blismedia.com GTS CA 1D4	`2023-10-04` - `2024-01-02`	3 months	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2023-12-23`	3 months	crt.sh
*.z.antigena.com Sectigo ECC Domain Validation Secure Server CA	`2023-04-03` - `2024-04-02`	a year	crt.sh
*.3lift.com Amazon RSA 2048 M02	`2023-04-13` - `2024-05-11`	a year	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-08-29` - `2024-02-21`	6 months	crt.sh
*.deepintent.com Go Daddy Secure Certificate Authority - G2	`2022-11-30` - `2024-01-01`	a year	crt.sh
*.prod.use1.green.ops.kargo.com Amazon RSA 2048 M01	`2022-11-10` - `2023-12-09`	a year	crt.sh
*.bfmio.com Amazon RSA 2048 M02	`2023-03-17` - `2024-04-14`	a year	crt.sh

This page contains 26 frames:

Primary Page: https://macleans.ca/
Frame ID: DE1646992B37B8C591BAC0FE647AF73C
Requests: 109 HTTP requests in this frame

Frame: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: CB156681939A3530BA878A3F151A952E
Requests: 1 HTTP requests in this frame

Frame: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=
Frame ID: 16EA04114ACD170EA249CC4605C05C25
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&dcc=t
Frame ID: C0FBEA3517C4FAB7477451AD2B4E56D2
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Frame ID: 1677E26E756821A21721C1E5955A0C78
Requests: 8 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Frame ID: F98585CC6222A2864F0E72F006806018
Requests: 9 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Frame ID: D78AB618F4EFFFF87577E535CEA147CD
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=8721594384017978332&gdpr=0&gdpr_consent=
Frame ID: DE55B7034DA2F737E604C9D23B176F89
Requests: 1 HTTP requests in this frame

Frame: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Frame ID: C41F01245B021997F61B17FEF897D8CD
Requests: 6 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Frame ID: 41447E098D7B1A2456C168B7290AAE87
Requests: 20 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Frame ID: FC512806DA55BBEC8317DB46D9E7249F
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?id=7332518813481760111&ex=appnexus.com
Frame ID: 26BCE5B171C55E52265298863D42C0B5
Requests: 1 HTTP requests in this frame

Frame: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Frame ID: 30A7EEB904C7B991DE7E8015AD21AEAA
Requests: 7 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=2805667729428079344355
Frame ID: 89D8869FC185D9602AB96BC2DF503311
Requests: 1 HTTP requests in this frame

Frame: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 2284058A26BA53402C5B4688AA9B2D42
Requests: 22 HTTP requests in this frame

Frame: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=b3a568d0-c902-4453-96a0-73d083e1d174&expiration=1705454586
Frame ID: 9C4687AADE5BCA69D402E114970B2B1F
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeqSBC14Z0BGJu52_gBMAE&v=APEucNW984lm5m3IG2lhBjeFfmbf_xTOGMIo6FKAcIWSCOhVmZKXfQVZ-f7O21LUDh9t-ZQFmy1IbXb9kM64dlWkfDGjtiSgmsBg3R648HQI129WxMfRn1Q
Frame ID: EC9586FE29EA027B1CA4E92703DDB083
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: E53F50FFAA83A69A6B50A25B8CA8CD6C
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 677B9B13C1C018ABD0766B3BE7D221BA
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/index.html?ev=01_250
Frame ID: 482F435780A5EB36A9262F57F1E02286
Requests: 7 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&redir=true&gdpr=0&gdpr_consent=
Frame ID: ED0EDC840F6C88AD1FFD7C7E9327937C
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UID27BB6CF6-5140-48B1-B11E-5A8F2CB00133
Frame ID: EC3EF3FF9FECB086F55FF3C6B6BD9140
Requests: 1 HTTP requests in this frame

Frame: https://bh.contextweb.com/bh/rtset?ev=AACU-k7KW8QAABqkr6rUzQ&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D8721594384017978332%26gdpr%3D0%26gdpr_consent%3D%26bee_sync_partners%3Dsyn%252Cpm%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3&gdpr=0
Frame ID: 76D6FEEC7E6A189B191EE7869D3B39F6
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6242155078849264757&gdpr=0&gdpr_consent=
Frame ID: E784BE014FFB3CEBAE79241ABF59C9DF
Requests: 1 HTTP requests in this frame

Frame: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Frame ID: 8DD85AF9126AC93B19BC255391AC2DC0
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UID27BB6CF6-5140-48B1-B11E-5A8F2CB00133
Frame ID: AFCF558FC73EE2D51138702FBD7C24F6
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Macleans.ca - Canada’s magazine

Page URL History Show full URLs

http://macleans.ca/ HTTP 307
https://macleans.ca/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Chartbeat (Analytics) Expand

Overall confidence: 100%
Detected patterns

chartbeat\.js

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Slick (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

<link [^>]+(?:/([\d.]+)/)?slick-theme\.css
(?:/([\d.]+))?/slick(?:\.min)?\.js

Twitter Emoji (Twemoji) (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

twemoji(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

223
Requests

79 %
HTTPS

0 %
IPv6

72
Domains

98
Subdomains

62
IPs

4
Countries

2985 kB
Transfer

6739 kB
Size

88
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://education.macleans.ca/
Title: University Rankings

Search URL Search Domain Scan URL

URL: https://stjoseph.com/terms-of-use/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://secure.macleans.ca/W2NASHPM
Title: THE MAGAZINE

Search URL Search Domain Scan URL

URL: https://www.facebook.com/macleans

Search URL Search Domain Scan URL

URL: https://twitter.com/macleans

Search URL Search Domain Scan URL

URL: https://www.instagram.com/macleansmag/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/MacleansMagazine

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/showcase/maclean's

Search URL Search Domain Scan URL

URL: https://www.macleans.ca/society/
Title: SEE MORE

Search URL Search Domain Scan URL

URL: https://adsregistry.rogersmedia.com/index_en.html
Title: Political Ads Registry

Search URL Search Domain Scan URL

URL: https://stjoseph.com/privacy-policy/

Search URL Search Domain Scan URL

URL: https://stjoseph.com/privacy-policy/'

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://macleans.ca/ HTTP 307
https://macleans.ca/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 95

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain HTTP 302
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&dcc=t

Request Chain 97

https://csync.loopme.me/?pubid=11405&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dloopme.com%26id%3D%7Bviewer_token%7D HTTP 307
https://s.amazon-adsystem.com/ecm3?ex=loopme.com&id=3c64bd8b-fccb-411a-9433-5641948ad7f5

Request Chain 98

https://sync.1rx.io/usersync2/rmpssp?sub=amazon&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D HTTP 302
https://sync.1rx.io/usersync2/rmpssp?sub=amazon&zcc=1&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D&cb=1697505787318 HTTP 302
https://ad.turn.com/r/cs?pid=45&rndcb=35169248 HTTP 302
https://sync.1rx.io/usersync/turn/7059221617362624609?dspret=1&gdpr=&gdpr_consent=&us_privacy= HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-007b6c37-ae98-4f10-adc8-cbebe3dcf623-005?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3DRX-007b6c37-ae98-4f10-adc8-cbebe3dcf623-005 HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-007b6c37-ae98-4f10-adc8-cbebe3dcf623-005

Request Chain 99

https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3405073889017883000V10

Request Chain 100

https://match.prod.bidr.io/cookie-sync/amzn?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dbeeswax.com%26id%3D%24UID HTTP 303
https://match.prod.bidr.io/cookie-sync/amzn?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dbeeswax.com%26id%3D%24UID&_bee_ppp=1 HTTP 303
https://s.amazon-adsystem.com/ecm3?id=AACU-k7KW8QAABqkr6rUzQ&ex=beeswax.com

Request Chain 101

https://s.ad.smaato.net/c/?adExInit=aps&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsmaato.com%26id%3D%24UID HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=e9b35e5b13

Request Chain 102

https://um.simpli.fi/amazon/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsimpli.fi%26id%3D HTTP 302
https://s.amazon-adsystem.com/ecm3?id=3297F192560D4730894264FA0DD2E476&ex=simpli.fi&status=ok

Request Chain 103

https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__ HTTP 302
https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__&s=2 HTTP 302
https://sync.outbrain.com/sync-external?uid=T0azmDArakekTh0kVQx7&redirect=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Famazon_tam%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZUWIPKUGBQXU3KEIFZGC23FNNKGQMDLKZIXQNY HTTP 302
https://u.openx.net/w/1.0/cm?id=00df9f64-6f67-4cae-aeb2-d951da52047c&r=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fobhb%3Dhttps%253A%252F%252Fb1sync.zemanta.com%252Fusersync%252Famazon_tam%252Fcallback%252F%253Fd%253DNB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZUWIPKUGBQXU3KEIFZGC23FNNKGQMDLKZIXQNY%26p%3Dopenx%26gdpr%3D%24GDPR_APPLIES%26gdpr_consent%3D%24CONSNT_STRING%26us_privacy%3D%24CCPA%26initiator%3Ds2s%26obUid%3DwNfwKaY6DVjqxEhr2_kIvCE-udeTzgadLvsyoGy8QZFqyhct07a63a3JHjS-Byvv%26uid%3D HTTP 302
https://u.openx.net/w/1.0/cm?cc=1&id=00df9f64-6f67-4cae-aeb2-d951da52047c&r=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fobhb%3Dhttps%253A%252F%252Fb1sync.zemanta.com%252Fusersync%252Famazon_tam%252Fcallback%252F%253Fd%253DNB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZUWIPKUGBQXU3KEIFZGC23FNNKGQMDLKZIXQNY%26p%3Dopenx%26gdpr%3D%24GDPR_APPLIES%26gdpr_consent%3D%24CONSNT_STRING%26us_privacy%3D%24CCPA%26initiator%3Ds2s%26obUid%3DwNfwKaY6DVjqxEhr2_kIvCE-udeTzgadLvsyoGy8QZFqyhct07a63a3JHjS-Byvv%26uid%3D HTTP 302
https://sync.outbrain.com/cookie-sync?obhb=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Famazon_tam%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZUWIPKUGBQXU3KEIFZGC23FNNKGQMDLKZIXQNY&p=openx&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA&initiator=s2s&obUid=wNfwKaY6DVjqxEhr2_kIvCE-udeTzgadLvsyoGy8QZFqyhct07a63a3JHjS-Byvv&uid=34f4b193-1cd2-4e6a-8396-65b21f40ccc9 HTTP 302
https://pixel-us-east.rubiconproject.com/exchange/sync.php?obhb=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Famazon_tam%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZUWIPKUGBQXU3KEIFZGC23FNNKGQMDLKZIXQNY&p=15268&obUid=wNfwKaY6DVjqxEhr2_kIvCE-udeTzgadLvsyoGy8QZFqyhct07a63a3JHjS-Byvv&gdpr=%24GDPR_APPLIES&gdpr_consent=%24CONSNT_STRING&us_privacy=%24CCPA&initiator=s2s

Request Chain 104

https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID HTTP 302
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Request Chain 106

https://ssbsync-us.smartadserver.com/api/sync?callerId=2 HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=8721594384017978332&gdpr=0&gdpr_consent=

Request Chain 110

https://ib.adnxs.com/getuid?https://s.amazon-adsystem.com/ecm3?id=$UID&ex=appnexus.com HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID%26ex%3Dappnexus.com HTTP 302
https://s.amazon-adsystem.com/ecm3?id=7332518813481760111&ex=appnexus.com

Request Chain 111

https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com HTTP 301
https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com HTTP 302
https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1

Request Chain 112

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP 302
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=2805667729428079344355

Request Chain 117

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZS3h-b8FpCnTVEQXH-FQ_QAADyQAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid= HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEL8aVPcoMx-wn9WFRR6q4Xs&google_cver=1

Request Chain 118

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZS3h.b8FpCnTVEQXH.FQ-QAA HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEE643kvq9RK3F9_GQbs7esI&google_cver=1&google_hm=2

Request Chain 119

https://match.adsrvr.org/track/cmf/casale HTTP 302
https://match.adsrvr.org/track/cmb/casale HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=515cf6f8-7a1d-44a8-9545-d02c6c07e305&expiration=1700097787&gdpr=0&gdpr_consent=

Request Chain 120

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D46%26external_user_id%3D%24UID HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=6242155078849264757

Request Chain 124

https://um4.eqads.com/um/cs HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=b3a568d0-c902-4453-96a0-73d083e1d174&expiration=1705454586

Request Chain 135

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE643kvq9RK3F9_GQbs7esI&google_cver=1&gdpr=0

Request Chain 136

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZS3h.b8FpCnTVEQXH.FQ-QAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE643kvq9RK3F9_GQbs7esI&google_cver=1&google_hm=2

Request Chain 137

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0 HTTP 302
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEAYUAHMp1yr-oImPgR-zU2I&google_cver=1

Request Chain 138

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjI0MjE1NTA3ODg0OTI2NDc1Nw%3D%3D

Request Chain 149

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEF8tdCYfZtD5mtQ2UqMfxyc&google_cver=1&google_push=AXcoOmQm5cnEnHsO7bHWmlBYnda7flNm9Eyo5xmfl6ZJ1JfqFaUDRl0Hnu880zd5zAh4_4bCDXfT9cOi6fTPfhG0GShFkxyHR5w HTTP 302
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=6556c742310c05a6&is_secure=true&networkId=14000&version=1&google_gid=CAESEF8tdCYfZtD5mtQ2UqMfxyc&google_cver=1&google_push=AXcoOmQm5cnEnHsO7bHWmlBYnda7flNm9Eyo5xmfl6ZJ1JfqFaUDRl0Hnu880zd5zAh4_4bCDXfT9cOi6fTPfhG0GShFkxyHR5w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAACi5fwJX-d9wNelw2nAAAAAAA&expiration=1697592186&google_cver=1&is_secure=true&google_gid=CAESEF8tdCYfZtD5mtQ2UqMfxyc&google_push=AXcoOmQm5cnEnHsO7bHWmlBYnda7flNm9Eyo5xmfl6ZJ1JfqFaUDRl0Hnu880zd5zAh4_4bCDXfT9cOi6fTPfhG0GShFkxyHR5w

Request Chain 150

https://aep.mxptint.net/sn.ashx?google_gid=CAESEPowy1ItGHrVfvue6lDaD50&google_cver=1&google_push=AXcoOmR_zmxqK0ul3lKhwgxobpy_qd6FcR4KbqB6I9DjVgAEMLTn2lf4sQ88VfAr7nXJLW7c9SgTtVy8_UpHSdc94AqbAHgzh-9A HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AXcoOmR_zmxqK0ul3lKhwgxobpy_qd6FcR4KbqB6I9DjVgAEMLTn2lf4sQ88VfAr7nXJLW7c9SgTtVy8_UpHSdc94AqbAHgzh-9A&google_hm=UjMzNjQ1XzEwQUFCMTkyOF9EMjM0OUY2OQ%3D%3D

Request Chain 151

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESEMSIWsCWmwJ3DOOOBtd_4o8&google_cver=1&google_push=AXcoOmSHM07KNQPEyDgxUKeHaN_WtGnDmIvNPeGh25nKrNa0HZ19Yb9l7-VB7nNkEvuo68rFIVJHiJMiG-OIL-sk7mC1oqm8r8oU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmSHM07KNQPEyDgxUKeHaN_WtGnDmIvNPeGh25nKrNa0HZ19Yb9l7-VB7nNkEvuo68rFIVJHiJMiG-OIL-sk7mC1oqm8r8oU

Request Chain 152

https://ads.travelaudience.com/google_pixel?google_gid=CAESEINnzGkfh5ZVCyfy-6L_gaA&google_cver=1&google_push=AXcoOmTGZiBMV9A4iRXEe2m5UUaxHDcOkLv-hbOjj7VZ3EmthaOaU252IsJR2j0UfwXoQbkmu2wB13fI2QQvYoiIaDEu54wRk_k HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=dSYcuUx9SJQJgvZkYqHLDg&google_push=AXcoOmTGZiBMV9A4iRXEe2m5UUaxHDcOkLv-hbOjj7VZ3EmthaOaU252IsJR2j0UfwXoQbkmu2wB13fI2QQvYoiIaDEu54wRk_k

Request Chain 153

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEBhVyF5ha_UdadoXCrRWkAw&google_cver=1&google_push=AXcoOmQVKjsQrzZJLOs1Z9xriGLzmlN0k4YTiPkQTpJ0CrOIQL-nRcJNOX1DhY0JhvXuMOg2o6Ozdl2BtvY_VQwEVAC_iK3e_ATC HTTP 307
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEBhVyF5ha_UdadoXCrRWkAw&google_cver=1&google_push=AXcoOmQVKjsQrzZJLOs1Z9xriGLzmlN0k4YTiPkQTpJ0CrOIQL-nRcJNOX1DhY0JhvXuMOg2o6Ozdl2BtvY_VQwEVAC_iK3e_ATC&sovrn_retry=true HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmQVKjsQrzZJLOs1Z9xriGLzmlN0k4YTiPkQTpJ0CrOIQL-nRcJNOX1DhY0JhvXuMOg2o6Ozdl2BtvY_VQwEVAC_iK3e_ATC&google_hm=Hf5zhGZHiRv4LqNJTgaBpJjM

Request Chain 154

https://b1sync.zemanta.com/usersync/googleopenbidding/?google_gid=CAESEJCe2s-mkcX0tLx9fkzdu-o&google_cver=1&google_push=AXcoOmS20Cr6TYraU-NkSr53i-vUEMhT0yZCT5gAO0eW7uQXxN01Yvt6yXEHUAENWJQ_9ttsFcLtW5HPtRFH1rQ7pz5g5NWv6DwL HTTP 302
https://b1sync.zemanta.com/usersync/googleopenbidding/?google_cver=1&google_gid=CAESEJCe2s-mkcX0tLx9fkzdu-o&google_push=AXcoOmS20Cr6TYraU-NkSr53i-vUEMhT0yZCT5gAO0eW7uQXxN01Yvt6yXEHUAENWJQ_9ttsFcLtW5HPtRFH1rQ7pz5g5NWv6DwL&s=2 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=AXcoOmS20Cr6TYraU-NkSr53i-vUEMhT0yZCT5gAO0eW7uQXxN01Yvt6yXEHUAENWJQ_9ttsFcLtW5HPtRFH1rQ7pz5g5NWv6DwL&google_hm=ZVdTcEJjZjVQVlQyd0JHRFE4UHM=

Request Chain 155

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEP3HD-2yWTqIfVmAAxCuwtk&google_cver=1&google_push=AXcoOmQah0To2tOR3fU2TsoPn000goWIp68aOO_oJmdNzhGaxIDPwwX3ZCov5WeGVuQhcOC6MeXE_rVvZYeHdv13Ash6QrLygfP6dQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=N2YzMDFhM2EtZTJkOS00NDI3LWJlZGQtNDY4YTFlNzE4MGZh&google_push=AXcoOmQah0To2tOR3fU2TsoPn000goWIp68aOO_oJmdNzhGaxIDPwwX3ZCov5WeGVuQhcOC6MeXE_rVvZYeHdv13Ash6QrLygfP6dQ HTTP 302
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

Request Chain 162

https://ums.acuityplatform.com/tum?umid=27&uid=Hf5zbPZHfawiHPRWTgiLYuVO&gdpr=0&gdpr_consent= HTTP 302
https://ce.lijit.com/merge?pid=66&3pid=841381824345

Request Chain 163

https://ib.adnxs.com/getuid?https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D92%263pid%3D%24UID&gdpr=0&gdpr_consent= HTTP 302
https://ce.lijit.com/merge?pid=92&3pid=6242155078849264757&gdpr=0&gdpr_consent=

Request Chain 164

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=sovrn&gdpr=0&gdpr_consent= HTTP 302
https://ce.lijit.com/merge?pid=80&3pid=LNTN47OR-16-1IVP&gdpr=0

Request Chain 166

https://sync.1rx.io/usersync2/rmpssp?sub=sovrn&gdpr=0&gdpr_consent= HTTP 302
https://sync.1rx.io/usersync2/rmpssp?sub=sovrn&zcc=1&cb=1697505787353 HTTP 302
https://ad.turn.com/r/cs?pid=45&rndcb=978373977 HTTP 302
https://sync.1rx.io/usersync/turn/7059221617362624609?dspret=1&gdpr=&gdpr_consent=&us_privacy= HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-8b2ab8de-8bbf-466c-add0-06dafd7cd3b1-005?redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D97%263pid%3DRX-8b2ab8de-8bbf-466c-add0-06dafd7cd3b1-005 HTTP 302
https://ce.lijit.com/merge?pid=97&3pid=RX-8b2ab8de-8bbf-466c-add0-06dafd7cd3b1-005

Request Chain 185

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=515cf6f8-7a1d-44a8-9545-d02c6c07e305&gdpr=0&gdpr_consent=

Request Chain 186

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&gdpr=0&gdpr_consent=&google_hm=YjJlMTc1MzctNjRkZC00NWMzLWJlYjYtMTZlMmQ3ZTE2Mjhm HTTP 302
https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=

Request Chain 188

https://x.bidswitch.net/sync?ssp=sharethrough&user_id=b2e17537-64dd-45c3-beb6-16e2d7e1628f&gdpr=0&gdpr_consent=&gdpr_pd=1&us_privacy=&expires=365 HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=sharethrough&user_id=b2e17537-64dd-45c3-beb6-16e2d7e1628f&gdpr=0&gdpr_consent=&gdpr_pd=1&us_privacy=&expires=365 HTTP 302
https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=sharethrough HTTP 302
https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=sharethrough HTTP 302
https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=77cb5f25-0fd3-4147-81b7-53267282a3b7&ssp=sharethrough HTTP 302
https://match.sharethrough.com/sync/v1?source_id=bf2b131f1f7eff9d8892972c&source_user_id=c72b9298-307f-4008-a9c3-a7e8f18dd304&seat_user_id=&seat_key=&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

Request Chain 196

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=J7ts9lFASLGxHlqPLLABMw%3D%3D&gdpr=0&gdpr_consent= HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

Request Chain 197

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=27BB6CF6-5140-48B1-B11E-5A8F2CB00133 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3371&partner_device_id=27BB6CF6-5140-48B1-B11E-5A8F2CB00133 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=70bae9d2-7c7b-455d-af26-b175e85ff634%252C%252C&gdpr=0&gdpr_consent= HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=515cf6f8-7a1d-44a8-9545-d02c6c07e305&ttd_puid=70bae9d2-7c7b-455d-af26-b175e85ff634%2C%2C

Request Chain 200

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MjdCQjZDRjYtNTE0MC00OEIxLUIxMUUtNUE4RjJDQjAwMTMz&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 201

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEGZln6iKds2q9w1-h9z7Qlk&google_cver=1

Request Chain 202

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:3297F192560D4730894264FA0DD2E476

Request Chain 203

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=515cf6f8-7a1d-44a8-9545-d02c6c07e305&gdpr=0&gdpr_consent=

Request Chain 212

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent= HTTP 303
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFDVS1rN0tXOFFBQUJxa3I2clV6UQ&gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Csyn%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Csyn%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 303
https://rtb-csync.smartadserver.com/redir?partneruserid=AACU-k7KW8QAABqkr6rUzQ&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Csyn%252Cpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2%26userid%3DSMART_USER_ID&gdpr=0 HTTP 302
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Csyn%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=8721594384017978332&gdpr=0&gdpr_consent= HTTP 303
https://bh.contextweb.com/bh/rtset?ev=AACU-k7KW8QAABqkr6rUzQ&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D8721594384017978332%26gdpr%3D0%26gdpr_consent%3D%26bee_sync_partners%3Dsyn%252Cpm%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3&gdpr=0

Request Chain 213

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6242155078849264757&gdpr=0&gdpr_consent=

Request Chain 216

https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&gdpr=0&gdpr_consent= HTTP 302
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&vxii_pid=12&vxii_pid1=10067&vxii_rcid=7da77c62-80c3-49de-a122-a6201fe847ab

Request Chain 220

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&redir=true&gdpr=0&gdpr_consent= HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-9fbMjk9E2uWqluDGgwsAOA1aoWVz7z8-~A&gdpr=0

Request Chain 221

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=61cfba47-db32-4fb2-b599-cd9e542a5edf&gdpr=0&gdpr_consent=

Request Chain 222

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&gdpr=0&gdpr_consent= HTTP 302
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=10ba28c12c5205a6&is_secure=true&networkId=17100&version=1&nuid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAACYPYAbBMyiANnaRa7AAAAAAA&expiration=1697592191&nuid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&is_secure=true&gdpr_consent=&gdpr=0

223 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
macleans.ca/
Redirect Chain

http://macleans.ca/
https://macleans.ca/

186 KB
18 KB

134ms
88ms

Document
text/html

104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/7.3.14

Resource Hash

0ba9db09f2b371fbaef87d359cd312883f2012539e5156074934b14b636e0af8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: public,max-age=300, max-age=300, must-revalidate
cf-cache-status: MISS
cf-ray: 8174bbd95d4e39c6-YYZ
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
content-type: text/html; charset=UTF-8
date: Tue, 17 Oct 2023 01:23:00 GMT
last-modified: Tue, 17 Oct 2023 01:18:19 GMT
link: <https://macleans.ca/wp-json/>; rel="https://api.w.org/"
referrer-policy: no-referrer-when-downgrade
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding, Cookie
x-cache-status: HIT
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: PHP/7.3.14

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://macleans.ca/
Non-Authoritative-Reason: HSTS

GET
H2 200 macleans.js Show response
output-to-go.mblycdn.com/bundles/ 681 KB
194 KB 141ms
95ms Script
application/javascript 104.17.178.181
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://output-to-go.mblycdn.com/bundles/macleans.js

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.178.181 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a9bc024987f9f4f35dd725c025d7d5f96102ab18844920001f81aa560a9f5baf

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1927
cf-polished: origSize=697804
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"a2c858d385d75b6721392376afe6d8d3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Budh%2Bjb2qRVyYUKN1l%2Fn%2FXxe7NZHmthU6lconqgT%2BZ1o%2FBHmy5IDl6k%2FkzaMevLov1pHPunOEXyv7Y6qFLHx4%2BNR00KQLb2DiHYO8jK7%2BVwk3Miq5dp%2FEVlPkvkJjpXBkwguaPve0bQQTag%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=600, must-revalidate
cf-ray: 8174bbda2b3736db-YYZ

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 307 KB
101 KB 140ms
68ms Script
application/javascript 172.253.63.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-58ST9BH

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

b2cf240b501f8685c65d2ee7970229557cb578ef7c91f14f2b3319b4f9a23e95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 102538
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 17 Oct 2023 01:23:00 GMT

GET
H3 200 twemoji.js Show response
macleans.ca/wp-includes/js/ 11 KB
4 KB 49ms
45ms Script
application/javascript 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-includes/js/twemoji.js?ver=4.9.13

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cca73b5e8f7b1a1976c60afc2fe8ef02eb2ebfb951c0675431345f7ff3bfa107

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 2441988
cf-polished: origSize=25798
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 11 May 2020 12:42:40 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5eb94840-64c6"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
cf-ray: 8174bbdbec63a232-YYZ
expires: Thu, 20 Jul 2023 19:02:47 GMT

GET
H3 200 wp-emoji.js Show response
macleans.ca/wp-includes/js/ 4 KB
2 KB 54ms
51ms Script
application/javascript 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-includes/js/wp-emoji.js?ver=4.9.13

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9629adc1782f930399e57b92f49f9a539f0175a5738db5875b7219a0bd51457e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 2441988
cf-polished: origSize=6760
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 11 May 2020 12:42:46 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5eb94846-1a68"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
cf-ray: 8174bbdbec65a232-YYZ
expires: Thu, 20 Jul 2023 19:03:06 GMT

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ 30 KB
7 KB 74ms
34ms Stylesheet
text/css 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css?ver=4.7.0

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 871
age: 16095583
cdn-cachedat: 07/07/2022 17:49:34
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver: 1.02
cdn-requestpullcode: 200
server: cloudflare
etag: W/"269550530cc127b6aa5a35925a7de6ce"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 9d3d8f246a8ae8bb60094ef820f36a5d
timing-allow-origin: *
cdn-requestcountrycode: US
cdn-status: 200
cf-ray: 8174bbda5965548b-YYZ
cdn-requestpullsuccess: True

GET
H2 200 rdm-daac-notice-public.css
macleans.ca/wp-content/plugins/rdm-daac-notice/public/css/ 5 KB
1014 B 53ms
50ms Stylesheet
text/css 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-content/plugins/rdm-daac-notice/public/css/rdm-daac-notice-public.css?ver=1.0.0

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

034e8dbbf1352f0bbb298fde6bb8361880c7618b3ee2751504f9b9edcdd06284

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 2289241
cf-polished: origSize=5872
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 14 Jan 2021 16:02:18 GMT
cf-bgj: minify
server: cloudflare
etag: W/"60006b0a-16f0"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=2592000
cf-ray: 8174bbda2efb39c6-YYZ
expires: Thu, 20 Jul 2023 19:02:47 GMT

GET
H2 200 rdm-pinned-video-public.css
macleans.ca/wp-content/plugins/rdm-pinned-video/public/css/ 1 KB
564 B 71ms
68ms Stylesheet
text/css 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-content/plugins/rdm-pinned-video/public/css/rdm-pinned-video-public.css?ver=1.2.9

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e95d764c2e2b438da629249f5f50d78511a6462bce7b22610da8429eae48d86

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 2289241
cf-polished: origSize=1495
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 09 Jan 2020 19:38:23 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5e17812f-5d7"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=2592000
cf-ray: 8174bbda2f0639c6-YYZ
expires: Thu, 20 Jul 2023 19:02:47 GMT

GET
H2 200 style.css
macleans.ca/wp-content/themes/macleans.ca/assets/ 276 KB
45 KB 89ms
86ms Stylesheet
text/css 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-content/themes/macleans.ca/assets/style.css?ver=1.66.01696260399

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

678c4ccdebf6f75d3fb5475863bd385aad141dbad8dc4d6ec5acc4dfaa0005d1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 02 Oct 2023 15:26:39 GMT
server: cloudflare
etag: W/"651ae12f-45164"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=2592000
cf-ray: 8174bbda2f0f39c6-YYZ
expires: Thu, 16 Nov 2023 01:23:00 GMT

GET
H2 200 dashicons.css
macleans.ca/wp-includes/css/ 45 KB
28 KB 60ms
57ms Stylesheet
text/css 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-includes/css/dashicons.css?ver=4.9.13

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

172cbbcb001b0912af109bec9672c2e9d1d1836fc4c98de982d427145bed8335

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 2289241
cf-polished: origSize=48813
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 11 May 2020 12:41:51 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5eb9480f-bead"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=2592000
cf-ray: 8174bbda2f1239c6-YYZ
expires: Thu, 20 Jul 2023 19:02:47 GMT

GET
H2 200 gallery.css
macleans.ca/wp-content/plugins/rdm-gallery/assets/css/ 22 KB
3 KB 69ms
66ms Stylesheet
text/css 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-content/plugins/rdm-gallery/assets/css/gallery.css?ver=1681996659

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2308397ed0531a82bfbf49cd3c41af4cd7f9a8853cdb773519b6a53eff8b7e35

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 2289241
cf-polished: origSize=25535
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 20 Apr 2023 13:17:39 GMT
cf-bgj: minify
server: cloudflare
etag: W/"64413b73-63bf"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=2592000
cf-ray: 8174bbda2f1739c6-YYZ
expires: Thu, 20 Jul 2023 19:02:47 GMT

GET
H2 200 slick.css
macleans.ca/wp-content/plugins/rdm-gallery/assets/css/ 1 KB
535 B 67ms
65ms Stylesheet
text/css 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-content/plugins/rdm-gallery/assets/css/slick.css?ver=1681996659

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

00a269606af95f52ce213e5096cc3a079d73522bc4e3c398789038666bb1454a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 2289241
cf-polished: origSize=1729
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 20 Apr 2023 13:17:39 GMT
cf-bgj: minify
server: cloudflare
etag: W/"64413b73-6c1"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=2592000
cf-ray: 8174bbda2f1b39c6-YYZ
expires: Thu, 20 Jul 2023 19:02:47 GMT

GET
H2 200 slick-theme.css
macleans.ca/wp-content/plugins/rdm-gallery/assets/css/ 2 KB
698 B 76ms
74ms Stylesheet
text/css 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-content/plugins/rdm-gallery/assets/css/slick-theme.css?ver=1681996659

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3db8d3751d195dbcd576f916726f5142ee91c597ceb9ac198b2a2a4971899c8c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 2289241
cf-polished: origSize=2809
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 20 Apr 2023 13:17:39 GMT
cf-bgj: minify
server: cloudflare
etag: W/"64413b73-af9"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=2592000
cf-ray: 8174bbda2f1f39c6-YYZ
expires: Thu, 20 Jul 2023 19:02:47 GMT

GET
H2 200 parent.head.min.js Show response
macleans.ca/wp-content/themes/rdm-multisite-parent/assets/ 8 KB
5 KB 117ms
115ms Script
application/javascript 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-content/themes/rdm-multisite-parent/assets/parent.head.min.js?ver=1.66.01696260399

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f54f5fd6427044fdfd7e8ac6b11c1f78eca62a95ee354378d5ce1b187eb44a09

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 02 Oct 2023 15:26:39 GMT
server: cloudflare
etag: W/"651ae12f-1f18"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
cf-ray: 8174bbda2f2039c6-YYZ
expires: Thu, 16 Nov 2023 01:23:00 GMT

GET
H2 200 jquery.js Show response
macleans.ca/wp-includes/js/jquery/ 95 KB
36 KB 80ms
79ms Script
application/javascript 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-includes/js/jquery/jquery.js?ver=1.12.4

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c7ee0238fa5cd80a02ef9870a7fff498ef52097181cb73edb9219dc022fd919

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 2289241
cf-polished: origSize=96874
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 11 May 2020 12:43:38 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5eb9487a-17a6a"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
cf-ray: 8174bbda2f2339c6-YYZ
expires: Thu, 20 Jul 2023 19:02:47 GMT

GET
H2 200 jquery-migrate.js Show response
macleans.ca/wp-includes/js/jquery/ 14 KB
5 KB 70ms
68ms Script
application/javascript 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e22fdd35ef8fc1a8ce87251400d1c4399a0adaeeb4154dc4b92fd87e2b462157

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 2289241
cf-polished: origSize=23497
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 11 May 2020 12:43:36 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5eb94878-5bc9"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
cf-ray: 8174bbda3f4839c6-YYZ
expires: Thu, 20 Jul 2023 19:02:47 GMT

GET
H2 200 rdm-daac-notice-public.js Show response
macleans.ca/wp-content/plugins/rdm-daac-notice/public/js/ 1 KB
742 B 78ms
76ms Script
application/javascript 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-content/plugins/rdm-daac-notice/public/js/rdm-daac-notice-public.js?ver=1.0.0

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

101d5796f35e827a17a9c7bf8b944fbe29f62c68fc1cc37c07a4eb927a8fdf4f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 2289241
cf-polished: origSize=1922
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 14 Jan 2021 16:02:18 GMT
cf-bgj: minify
server: cloudflare
etag: W/"60006b0a-782"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
cf-ray: 8174bbda3f4c39c6-YYZ
expires: Thu, 20 Jul 2023 19:02:47 GMT

GET
H2 200 wop.css
macleans.ca/wp-content/plugins/widgets-on-pages/ 74 B
180 B 66ms
65ms Stylesheet
text/css 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-content/plugins/widgets-on-pages/wop.css

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

68267fa0ef5a142e91b544f82abd76b34148ef6e39a948dc72a3f93fe3788737

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 2289241
cf-polished: origSize=80
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 09 Jan 2020 19:38:23 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5e17812f-50"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=2592000
cf-ray: 8174bbda2f2139c6-YYZ
expires: Thu, 20 Jul 2023 19:02:47 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 3362ms
33ms Script
application/x-javascript 31.13.80.12
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.80.12 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-yyz1.fbcdn.net

Software

Resource Hash

a3a2d01ec05246540e99274a0b9c9cf0a2ebd1a840329e04123e6b714828feb8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://macleans.ca/
Origin: https://macleans.ca
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 17 Oct 2023 01:23:04 GMT
content-md5: OmO8MpVs+NUoL9f3RcoY4g==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1683
x-fb-debug: +5yFt4twolwGifLZXlHHqUoMm3C5YcbmKg8XjYsmFzN4oOCU8OX812zkwL2dHYKxNw+W2NSjnNR4Y9UEKP5uDg==
x-fb-content-md5: 733558c51d427af04ef0fd21771e43be
cross-origin-opener-policy: same-origin-allow-popups
etag: "eff13830a75d05ea425e24e32b5c7fc6"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Tue, 17 Oct 2023 01:23:25 GMT

GET
H2 200 logo.svg
macleans.ca/wp-content/themes/macleans.ca/assets/images/ 2 KB
1 KB 68ms
67ms Image
image/svg+xml 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://macleans.ca/wp-content/themes/macleans.ca/assets/images/logo.svg

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a883f245f7eccaa08fe38c8da27481e0f416913becbe9d09e4160f9777e9fb5a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 10065285
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 09 Jun 2023 18:56:52 GMT
server: cloudflare
etag: W/"648375f4-755"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: max-age=315360000
cf-ray: 8174bbda3f4e39c6-YYZ
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 parent.min.js Show response
macleans.ca/wp-content/themes/rdm-multisite-parent/assets/ 198 KB
64 KB 102ms
101ms Script
application/javascript 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-content/themes/rdm-multisite-parent/assets/parent.min.js?ver=1.66.01696260399

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66d90c928a568caccd613e858129faeced51dde2547ab633e1387204d4412d2e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 02 Oct 2023 15:26:39 GMT
server: cloudflare
etag: W/"651ae12f-316f5"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
cf-ray: 8174bbda3f4f39c6-YYZ
expires: Thu, 16 Nov 2023 01:23:00 GMT

GET
H3 200 rdm-pinned-video-public.js Show response
macleans.ca/wp-content/plugins/rdm-pinned-video/public/js/ 10 KB
3 KB 45ms
45ms Script
application/javascript 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-content/plugins/rdm-pinned-video/public/js/rdm-pinned-video-public.js?ver=1.2.9

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7703c22844c5d0f1e1f05d4f4980ef179932c7ab78b8e6c4f370a0ddf0dfb0c4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 2441987
cf-polished: origSize=20540
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 09 Jan 2020 19:38:23 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5e17812f-503c"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
cf-ray: 8174bbda99fea232-YYZ
expires: Thu, 20 Jul 2023 19:02:47 GMT

GET
H3 200 jquery.visible.min.js Show response
macleans.ca/wp-content/plugins/rdm-gallery/assets/js/ 802 B
847 B 47ms
47ms Script
application/javascript 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-content/plugins/rdm-gallery/assets/js/jquery.visible.min.js?ver=1681996660

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

263986f67058ca70f15d853b413ce45ce8fbf5516aa25208c9eeea3c3cbbeb16

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 2441987
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 20 Apr 2023 13:17:40 GMT
server: cloudflare
etag: W/"64413b74-322"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
cf-ray: 8174bbdada85a232-YYZ
expires: Thu, 20 Jul 2023 19:03:06 GMT

GET
H3 200 jquery.scrollspy.js Show response
macleans.ca/wp-content/plugins/rdm-gallery/assets/js/ 1 KB
1 KB 47ms
47ms Script
application/javascript 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-content/plugins/rdm-gallery/assets/js/jquery.scrollspy.js?ver=1681996660

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e047eebaebf644af2f57dc6afa9c9a7d5fa4f33208dd743bf41de63a94f8b8a0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 2441987
cf-polished: origSize=3341
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 20 Apr 2023 13:17:40 GMT
cf-bgj: minify
server: cloudflare
etag: W/"64413b74-d0d"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
cf-ray: 8174bbdaeaa6a232-YYZ
expires: Thu, 20 Jul 2023 19:02:47 GMT

GET
H3 200 jquery.lazy.min.js Show response
macleans.ca/wp-content/plugins/rdm-gallery/assets/js/ 5 KB
3 KB 44ms
43ms Script
application/javascript 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-content/plugins/rdm-gallery/assets/js/jquery.lazy.min.js?ver=1681996660

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1651ead8bfc7b35609f4e3e28aac41690b2326bdccfb4f6f7acd0ade9d973bd8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 2441988
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 20 Apr 2023 13:17:40 GMT
server: cloudflare
etag: W/"64413b74-120e"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
cf-ray: 8174bbdb2b0ba232-YYZ
expires: Thu, 20 Jul 2023 19:03:06 GMT

GET
H3 200 slick.min.js Show response
macleans.ca/wp-content/plugins/rdm-gallery/assets/js/ 41 KB
11 KB 61ms
58ms Script
application/javascript 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-content/plugins/rdm-gallery/assets/js/slick.min.js?ver=1681996660

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e02af7df9a190d88380e2dcec2050ecaa493ae2d23526dbeec67f6907df3a752

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 2441988
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 20 Apr 2023 13:17:40 GMT
server: cloudflare
etag: W/"64413b74-a3e1"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
cf-ray: 8174bbdbbc0aa232-YYZ
expires: Thu, 20 Jul 2023 19:03:06 GMT

GET
H3 200 wp-embed.js Show response
macleans.ca/wp-includes/js/ 2 KB
1 KB 54ms
54ms Script
application/javascript 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://macleans.ca/wp-includes/js/wp-embed.js?ver=4.9.13

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db22b37c49a446a4aa73ef0938ef6bbff3f77224aa8412606eebd73f78816547

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 2441988
cf-polished: origSize=3176
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 11 May 2020 12:42:45 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5eb94845-c68"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
cf-ray: 8174bbdbdc35a232-YYZ
expires: Thu, 20 Jul 2023 19:02:47 GMT

GET
H3 200 info.png
macleans.ca/wp-content/plugins/rdm-daac-notice/public/images/ 170 B
656 B 70ms
68ms Image
image/webp 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://macleans.ca/wp-content/plugins/rdm-daac-notice/public/images/info.png

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a995ccc81e89f240bb6f806ff578ffd6150d35e9a6f6b301bc7ca7c95f5618d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 8346367
cf-polished: origFmt=png, origSize=283
content-disposition: inline; filename="info.webp"
alt-svc: h3=":443"; ma=86400
content-length: 170
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 14 Jan 2021 16:02:17 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "60006b09-11b"
vary: Accept, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/webp
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 8174bbdbec54a232-YYZ
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 close.png
macleans.ca/wp-content/plugins/rdm-daac-notice/public/images/ 114 B
600 B 51ms
48ms Image
image/webp 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://macleans.ca/wp-content/plugins/rdm-daac-notice/public/images/close.png

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d2b154c175678193164f11271f2425a3ffef74bccf437a2662ca884260a9c3e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
age: 10038004
cf-polished: origFmt=png, origSize=203
content-disposition: inline; filename="close.webp"
alt-svc: h3=":443"; ma=86400
content-length: 114
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 14 Jan 2021 16:02:17 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "60006b09-cb"
vary: Accept, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/webp
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 8174bbdbec5ea232-YYZ
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 v8b253dfea2ab4077af8c6f58422dfbfd1689876627854 Show response
static.cloudflareinsights.com/beacon.min.js/ 20 KB
7 KB 3430ms
94ms Script
text/javascript 104.16.56.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v8b253dfea2ab4077af8c6f58422dfbfd1689876627854
Requested by: Host: macleans.ca
URL: https://macleans.ca/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.56.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c235f21017bcc11fcaa31d7dfd9855aaebcbf5f6d7ee9bf9f2e98a910907c391

Request headers

Referer: https://macleans.ca/
Origin: https://macleans.ca
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:04 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 21:38:13 GMT
server: cloudflare
etag: W/"2023.7.1"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 8174bbf0dbdea238-YYZ

GET
H2 200 css
fonts.googleapis.com/ 12 KB
1 KB 119ms
46ms Stylesheet
text/css 172.253.115.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Merriweather:400,400i,700,700i|Roboto+Condensed:400,700&display=swap

Requested by

Host: macleans.ca
URL: https://macleans.ca/wp-content/themes/macleans.ca/assets/style.css?ver=1.66.01696260399

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f95.1e100.net

Software

ESF /

Resource Hash

1cdebb96c667623475254286eaae5294900e7f0e32c8eaf56af5bf1a8d6fdde3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/wp-content/themes/macleans.ca/assets/style.css?ver=1.66.01696260399
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 17 Oct 2023 01:23:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 01:23:01 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 17 Oct 2023 01:23:01 GMT

GET
H2 200 css2
fonts.googleapis.com/ 11 KB
941 B 119ms
47ms Stylesheet
text/css 172.253.115.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Cormorant+Garamond:ital,wght@0,400;0,700;1,400;1,700&family=Darker+Grotesque:wght@400;700;800&display=swap

Requested by

Host: macleans.ca
URL: https://macleans.ca/wp-content/themes/macleans.ca/assets/style.css?ver=1.66.01696260399

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f95.1e100.net

Software

ESF /

Resource Hash

303871abe23595cdb8c911e04c26212e19e4bf4ab0820f9258084b5dabf6c44c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/wp-content/themes/macleans.ca/assets/style.css?ver=1.66.01696260399
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 17 Oct 2023 01:23:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 01:23:01 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 17 Oct 2023 01:23:01 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 198 KB
53 KB 3362ms
34ms Script
application/x-javascript 31.13.80.12
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-58ST9BH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.80.12 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-yyz1.fbcdn.net

Software

Resource Hash

564a53ce84ae022b30816d44aa48589ebfe170c226b098d0245c47fe13341c67

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 17 Oct 2023 01:23:04 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 53498
x-xss-protection: 0
pragma: public
x-fb-debug: PgABVAKHzrYZ+kWgFH1hE9xX2Ey6jyv5KWvxwcarBk5RTxzpdXYfd4qKwQK/US5NUkRZqdeno4t/+bNaH+YVew==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/664672480/ 3 KB
2 KB 3398ms
63ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/664672480/?random=1697505781016&cv=11&fst=1697505781016&bg=ffffff&guid=ON&async=1&gtm=45He3ab0&u_w=1600&u_h=1200&url=https%3A%2F%2Fmacleans.ca%2F&hn=www.googleadservices.com&frm=0&tiba=Macleans.ca%20-%20Canada%E2%80%99s%20magazine&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-58ST9BH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

2a20ad4e44b3670fa88596550896f50accb88cbb683d38c310ee5fb17ae62e33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1303
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 3384ms
48ms Script
application/javascript 146.75.28.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-58ST9BH
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.28.157 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:04 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 15:55:14 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kiad7000104-IAD

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 265 KB
89 KB 46ms
44ms Script
application/javascript 172.253.63.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-PSNJJL83JG&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-58ST9BH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

44a45d0f087386dbb2e88a2df7d508c5aff5065b04fb39504783c8f9081a0e90

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 90612
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 17 Oct 2023 01:23:01 GMT

GET
H2 200 grumi.js Show response
rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/ 177 KB
59 KB 124ms
40ms Script
text/javascript 18.239.168.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js
Requested by: Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.168.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-168-105.bos50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3f46c1859f11e88dd7f05b4e26e6958ed0a852e8660d452ccb938ff741fcb240

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:21:51 GMT
x-amz-version-id: ZoAABqmCABj3kBnfvtuOge4b.tLOBh7S
content-encoding: br
last-modified: Tue, 17 Oct 2023 01:03:52 GMT
server: AmazonS3
via: 1.1 e4aa00d43c392896077df2add1b436f4.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-P3
etag: W/"58d3ae0fedd0f43a548a7d45cfdcf938"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public,max-age=3600,stale-while-revalidate=3600,immutable,must-revalidate
age: 71
x-amz-cf-id: K8eZ6CtCDK5G3oltjJ5Q0-qdVUcKIQZcBp3YllVp14j1tPosk7oDSQ==

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310120101/ 421 KB
132 KB 3147ms
51ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310120101/pubads_impl.js

Requested by

Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

6f9c72ef22efe8a0e095464ab57ea0d5b6c24fa0abcd9439a1ffe1f522cca92a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 10:43:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52795
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 134870
x-xss-protection: 0
server: cafe
etag: 11169537383484699631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Tue, 15 Oct 2024 10:43:09 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 106 B
614 B 121ms
49ms XHR
application/json 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=macleans.ca

Requested by

Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

ae3e3be32a3e070997abc067d796ae0d4e331d17dc1198d40d2bfea11f343e72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72
x-xss-protection: 0
expires: Tue, 17 Oct 2023 01:23:01 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 117ms
35ms XHR
application/javascript 18.239.164.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.164.134 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-164-134.bos50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: 9yABOonr2HqHtwbarUcdbIqN0f4A8Qog
content-encoding: gzip
via: 1.1 5e28369133a72a47acf796b9cc447b6e.cloudfront.net (CloudFront)
date: Tue, 17 Oct 2023 00:02:54 GMT
x-amz-cf-pop: BOS50-P3
age: 4808
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 29 Aug 2023 08:30:37 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: kFwNyEuCP1vI4DynIjuU8GQsZIHgI9wHReVenhZwUHT1SE-Ofv3Hig==

GET
H2 200 e0a2486b-0b5b-4021-8fca-83886d0240c7 Show response
config.aps.amazon-adsystem.com/configs/ 537 B
813 B 122ms
35ms Script
application/javascript 18.239.168.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/e0a2486b-0b5b-4021-8fca-83886d0240c7
Requested by: Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.168.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-168-6.bos50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 76f95019d43447771f1159aee570f2a783269164dfe6919106a2923a3dbf7b08

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:07:57 GMT
via: 1.1 ded3fd623e0f2891d2124b72f39850ba.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: BOS50-P3
age: 904
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
content-length: 537
x-amz-cf-id: rfHAsKpEHdtffoV55T6mH3lilFCZBEfH5X1OZ5FKL7kGaV0ue8WxHQ==

GET config
c.amazon-adsystem.com/cdn/prod/ 0
0

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 701 B
1 KB 3605ms
284ms XHR
text/javascript 18.161.31.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fmacleans.ca%2F&pid=m6u7PsV6THHVX&cb=0&ws=1600x1200&v=23.919.1525&t=600&slots=%5B%7B%22sd%22%3A%22leaderboard%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22MAC_DESKTOP_C1%22%7D%5D&pubid=e0a2486b-0b5b-4021-8fca-83886d0240c7&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.161.31.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-161-31-77.bos50.r.cloudfront.net

Software

Server /

Resource Hash

30fc45fb9b07a5298fc8458b65181f914e6b188bbce309a24bcfc345d619593f

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:04 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 6a44a538dfe322d4ba8f26b7c3a708c0.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: BOS50-P2
x-amz-rid: 9CEA5G4F79CAWH6KQRHR
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://macleans.ca
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 701
x-amz-cf-id: 5Fst6z3ZmI_yfRInXlx6eUNkj-kbmHu-Q0M-jpVO2tq8zJZEBWbEFw==

POST 646c34f46a97d6e2d21efe26
exchange.cootlogix.com/prebid/multi/ 0
0

POST bidRequest
c2shb.pubgw.yahoo.com/ 0
0

OPTIONS bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0

GET
H2 200 lazyload.min.js Show response
cdnjs.cloudflare.com/ajax/libs/vanilla-lazyload/10.5.2/ 4 KB
2 KB 1075ms
32ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/vanilla-lazyload/10.5.2/lazyload.min.js

Requested by

Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

974b373aafebb2098c590c7ec80e9538cdd824d365234f7df5a101e47a98003c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 13724602
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1305
last-modified: Mon, 04 May 2020 16:17:27 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04017-e7d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dYdQ0YKf5VwsYRbFzJOJjtgb9G9Fmt95YuSqqGR0lzNwQN5OYVSdLbXMIkuA8eX9ybAkxvYmY34MbAdDcKpg8%2B60zaE5RnPNNOWT1gLOHj07CTqMA5amidXI2Xgz%2FunXBlNXrlII"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8174bbe2ac3ea1f6-YYZ
expires: Sun, 06 Oct 2024 01:23:02 GMT

GET
H2 200 ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2
fonts.gstatic.com/s/robotocondensed/v26/ 18 KB
19 KB 3328ms
51ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotocondensed/v26/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Merriweather:400,400i,700,700i|Roboto+Condensed:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

sffe /

Resource Hash

f36a4e80fd0a1a2425f4f6a6f189607fef3ac00f0d2489bba3e654631312000e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://macleans.ca
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 20:11:36 GMT
x-content-type-options: nosniff
age: 364288
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18516
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 18:49:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Oct 2024 20:11:36 GMT

GET
H2 200 ieVi2ZhZI2eCN5jzbjEETS9weq8-32meGCQYbw.woff2
fonts.gstatic.com/s/robotocondensed/v26/ 18 KB
18 KB 3352ms
75ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotocondensed/v26/ieVi2ZhZI2eCN5jzbjEETS9weq8-32meGCQYbw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Merriweather:400,400i,700,700i|Roboto+Condensed:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

sffe /

Resource Hash

f390fd55c3ab6ca1943271e33629116b2a93290decca83bc07734fdbef8f4d68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://macleans.ca
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 20:32:35 GMT
x-content-type-options: nosniff
age: 363029
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18412
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 18:48:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Oct 2024 20:32:35 GMT

GET
H3 200 fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/ 75 KB
76 KB 62ms
39ms Font
font/woff2 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css?ver=4.7.0

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css?ver=4.7.0
Origin: https://macleans.ca
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 1029
age: 19661885
cdn-cachedat: 01/02/2023 00:17:33
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 77160
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver: 1.03
cdn-requestpullcode: 200
server: cloudflare
etag: "af7ae505a9eed503f8b8e6982036873e"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 4d8d096771724c91dbfce2a4baa13e76
accept-ranges: bytes
timing-allow-origin: *
cdn-requestcountrycode: US
cdn-status: 200
cf-ray: 8174bbdc6ee0a1f0-YYZ
cdn-requestpullsuccess: True

GET
H2 200 u-4n0qyriQwlOrhSvowK_l52xwNZWMf6.woff2
fonts.gstatic.com/s/merriweather/v30/ 19 KB
19 KB 3342ms
67ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/merriweather/v30/u-4n0qyriQwlOrhSvowK_l52xwNZWMf6.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Merriweather:400,400i,700,700i|Roboto+Condensed:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

sffe /

Resource Hash

273c8613cdd2852dd5318f224d804ae6d2fc717c48d3f1dab587b6d396fb4fc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://macleans.ca
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:15:37 GMT
x-content-type-options: nosniff
age: 371247
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19740
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 15:48:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Oct 2024 18:15:37 GMT

GET
H3 200 TRAVEL_ST_JOHNS_WEB_EN1_FLAT1-750x422.jpg.webp
macleans.ca/wp-content/uploads/2023/09/ 87 KB
88 KB 89ms
88ms Image
image/webp 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://macleans.ca/wp-content/uploads/2023/09/TRAVEL_ST_JOHNS_WEB_EN1_FLAT1-750x422.jpg.webp

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

826cf1b49580fbd87bf009fefa007441301e4f55c804f91d8356d64d5c515fa4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
alt-svc: h3=":443"; ma=86400
content-length: 88992
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 28 Sep 2023 19:52:39 GMT
server: cloudflare
etag: "6515d987-15ba0"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/webp
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 8174bbdcad91a232-YYZ
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 AI_Social_Option2-489x275.jpg
macleans.ca/wp-content/uploads/2023/10/ 20 KB
22 KB 124ms
122ms Image
image/jpeg 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://macleans.ca/wp-content/uploads/2023/10/AI_Social_Option2-489x275.jpg

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f7d04a1b77ae2f716e1c2db2c3dd81a48d85ed50ea0e1f72e50971ff3d4c9c2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
alt-svc: h3=":443"; ma=86400
content-length: 20944
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 12 Oct 2023 12:18:19 GMT
server: cloudflare
etag: "6527e40b-51d0"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 8174bbdcad94a232-YYZ
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 macleans_margaretsville-14-489x275.jpg
macleans.ca/wp-content/uploads/2023/10/ 52 KB
53 KB 135ms
133ms Image
image/jpeg 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://macleans.ca/wp-content/uploads/2023/10/macleans_margaretsville-14-489x275.jpg

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ca4054e107c3cd7d462a7694ae63f334f7e9c4619c760fef2d515ef84b3e0f1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
alt-svc: h3=":443"; ma=86400
content-length: 53082
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 16 Oct 2023 15:21:40 GMT
server: cloudflare
etag: "652d5504-cf5a"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 8174bbdcad9ba232-YYZ
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 Photo-illustration_Macleans-489x275.jpg
macleans.ca/wp-content/uploads/2023/10/ 82 KB
83 KB 141ms
139ms Image
image/jpeg 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://macleans.ca/wp-content/uploads/2023/10/Photo-illustration_Macleans-489x275.jpg

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd64397011b6d957086ac9b09d4b252ca01c75f22f77e924e920c3d1aeef783f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
alt-svc: h3=":443"; ma=86400
content-length: 83743
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 12 Oct 2023 14:11:58 GMT
server: cloudflare
etag: "6527feae-1471f"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 8174bbdcad9fa232-YYZ
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 First_LL_DSC6458-489x275.jpg.webp
macleans.ca/wp-content/uploads/2023/10/ 31 KB
32 KB 159ms
157ms Image
image/webp 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://macleans.ca/wp-content/uploads/2023/10/First_LL_DSC6458-489x275.jpg.webp

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a4ac9a37921e7a6c8e60c839da56a0447075185cedf43dc78926e13240820c5e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
alt-svc: h3=":443"; ma=86400
content-length: 31742
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 10 Oct 2023 20:31:51 GMT
server: cloudflare
etag: "6525b4b7-7bfe"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/webp
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 8174bbdcada1a232-YYZ
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 Hudson_Macleans_Shawn_L_2218-6-489x275.jpg.webp
macleans.ca/wp-content/uploads/2023/09/ 5 KB
6 KB 83ms
81ms Image
image/webp 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://macleans.ca/wp-content/uploads/2023/09/Hudson_Macleans_Shawn_L_2218-6-489x275.jpg.webp

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f6f3776ab0769d072c7c9e5105533803fa8237bb1413db623d0241425c0e4c60

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
alt-svc: h3=":443"; ma=86400
content-length: 4764
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 26 Sep 2023 18:06:15 GMT
server: cloudflare
etag: "65131d97-129c"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/webp
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 8174bbdcada4a232-YYZ
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 230809-3354-edited-CROP-489x275.jpg.webp
macleans.ca/wp-content/uploads/2023/08/ 5 KB
6 KB 160ms
158ms Image
image/webp 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://macleans.ca/wp-content/uploads/2023/08/230809-3354-edited-CROP-489x275.jpg.webp

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bde05bd6dffc615a12629f8b6ca67496ca74a5eaf072362e2d5fea1f0b071d8d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
alt-svc: h3=":443"; ma=86400
content-length: 5438
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 30 Aug 2023 18:03:19 GMT
server: cloudflare
etag: "64ef8467-153e"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/webp
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 8174bbdcada8a232-YYZ
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 FOB_INTERVIEW_SEPT_FINAL_01-6-489x275.jpg.webp
macleans.ca/wp-content/uploads/2023/07/ 5 KB
7 KB 160ms
158ms Image
image/webp 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://macleans.ca/wp-content/uploads/2023/07/FOB_INTERVIEW_SEPT_FINAL_01-6-489x275.jpg.webp

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

22de70828d18a34eed9672ca18cbb242cca446881a1f8d80cf57768cabadbe26

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
alt-svc: h3=":443"; ma=86400
content-length: 5566
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 28 Jul 2023 14:47:54 GMT
server: cloudflare
etag: "64c3d51a-15be"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/webp
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 8174bbdcadada232-YYZ
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 gondek_social_1200x629-489x275.jpg.webp
macleans.ca/wp-content/uploads/2023/06/ 7 KB
8 KB 162ms
160ms Image
image/webp 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://macleans.ca/wp-content/uploads/2023/06/gondek_social_1200x629-489x275.jpg.webp

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb2e7a84b08e9bf85c9f773bdcf35563f9479ece6cc560314ad31d57d69ed6bf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
alt-svc: h3=":443"; ma=86400
content-length: 7328
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 27 Jun 2023 16:01:02 GMT
server: cloudflare
etag: "649b07be-1ca0"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/webp
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 8174bbdcadb3a232-YYZ
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 chartbeat.js Show response
static.chartbeat.com/js/ 37 KB
15 KB 143ms
49ms Script
application/x-javascript 18.239.163.131
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat.js
Requested by: Host: macleans.ca
URL: https://macleans.ca/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.163.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-163-131.bos50.r.cloudfront.net
Software: nginx /
Resource Hash: 2241d391f10f461a915b6ef47bc0c8103bf0e7289aff47e1bcfed5ff2a84d119

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 23:34:16 GMT
content-encoding: gzip
via: 1.1 b02a8eb804b8f534af3cca692f9e33a0.cloudfront.net (CloudFront)
last-modified: Wed, 09 Aug 2023 00:45:38 GMT
server: nginx
x-amz-cf-pop: BOS50-P3
age: 6525
etag: W/"64d2e1b2-94a1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-amz-cf-id: SRREM7Pm0Ll_7E_Y0u0QpnWxpy9aEpdneiYIKHMbT4lHlv_Ikj2fOQ==
expires: Tue, 17 Oct 2023 23:34:16 GMT

GET
H2 200 b8391b55-6a16-46a2-b625-b4a52f7d6e23 Show response
stream.playbuzz.com/player/ 618 KB
181 KB 90ms
49ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://stream.playbuzz.com/player/b8391b55-6a16-46a2-b625-b4a52f7d6e23

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5d8ff78bb9943dcd8c8df7d99122636d632f1407dfa1b3190ef3c50d6edbe191

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 17 Oct 2023 01:23:01 GMT
via: 1.1 varnish, 1.1 varnish
age: 322
x-cache: HIT, HIT
content-length: 184646
x-served-by: cache-iad-kiad7000132-IAD, cache-yyz4537-YYZ
server: nginx
x-timer: S1697505781.280436,VS0,VE32
etag: W/"9a9d1-5TLmt/SJTWekbuweIihbpjFaElM"
access-control-max-age: 600
access-control-allow-methods: GET, POST, PUT, DELETE, PATCH
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
vary: Accept-Encoding, x-pb-country, x-pb-connection, x-pb-embedid, x-pb-itemid, x-pb-videoid, x-pb-player, x-pb-bot-name, x-pb-is-bot, x-pb-country, x-pb-connection, x-pb-embedid, x-pb-itemid, x-pb-videoid, x-pb-player, x-pb-bot-name, x-pb-is-bot
accept-ranges: bytes
access-control-allow-headers: Accept, Authorization, Content-Type
x-cache-hits: 2, 1

GET
H/1.1 200
OK services Show response
sr.studiostack.com/v3/ 26 KB
26 KB 397ms
36ms Script
application/x-javascript 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/v3/services
Requested by: Host: macleans.ca
URL: https://macleans.ca/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: b9ba234ac2fe34f541fb33a5dccc17d68f098f8087d691cf5f7db808363a888c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:01 GMT
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 26237
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

GET
H2 200 copypastesubscribeformlogic.js Show response
js.createsend1.com/javascript/ 12 KB
5 KB 1382ms
35ms Script
text/javascript 18.239.183.85
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.createsend1.com/javascript/copypastesubscribeformlogic.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-58ST9BH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.239.183.85 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-239-183-85.bos50.r.cloudfront.net

Software

csw /

Resource Hash

90581f5e78f586fc87ab1d4c0836347c281095346a869a356436d61d0e97e074

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 00:31:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 9773a5091daf4b94a65f88adf32fd1fc.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-P4
age: 3080
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 17 Oct 2023 00:26:11 GMT
server: csw
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3269
x-amz-cf-id: ZsZ-FosrsTHkX-zJduIMY4nezoTtLMTLg1KDzDKJJlLzFj2PKHaWdA==
expires: Tue, 17 Oct 2023 01:26:11 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 111ms
36ms Script
text/javascript 142.251.111.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-58ST9BH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f102.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 16 Oct 2023 23:40:52 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 6129
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Tue, 17 Oct 2023 01:40:52 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
168 B 44ms
43ms Ping
text/plain 142.251.111.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-PSNJJL83JG&gtm=45je3ab0&_p=1249529835&cid=1994954187.1697505781&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1697505781&sct=1&seg=0&dl=https%3A%2F%2Fmacleans.ca%2F&dt=Macleans.ca%20-%20Canada%E2%80%99s%20magazine&en=page_view&_fv=1&_nsi=1&_ss=1&ep.content_name=content%20name%20not%20available&ep.author_name=author%20name%20not%20available&ep.cms_id=cms%20id%20not%20available&ep.href=https%3A%2F%2Fmacleans.ca%2F&ep.brand=Macleans
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-PSNJJL83JG&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.111.102 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bk-in-f102.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:01 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://macleans.ca
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ping
ping.chartbeat.net/ 43 B
201 B 110ms
36ms Image
image/gif 52.6.76.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=macleans.ca&p=%2F&u=Dc6ed-B72GghuayYt&d=macleans.ca&g=55711&g0=macleans%20%3A%20&g1=author%20name%20not%20available&n=1&f=00001&c=0&x=0&m=0&y=5891&o=1600&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&PA=https%3A%2F%2Fmacleans.ca%2F&b=755&t=BV2hahDrMlOpZgJ_wb-ELBBOvKc_&V=141&i=Macleans.ca%20-%20Canada%E2%80%99s%20magazine&tz=420&sn=1&sv=Bo768ND7D0mYCRRa_UBpGk69w9Dat&sd=1&im=066b2f7f&_
Requested by: Host: macleans.ca
URL: https://macleans.ca/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.6.76.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-76-142.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 17 Oct 2023 01:23:01 GMT
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-length: 43
expires: 0

GET
H2 200 versions Show response
player.ex.co/ 750 B
1 KB 1322ms
17ms Fetch
application/javascript 151.101.130.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://player.ex.co/versions

Requested by

Host: stream.playbuzz.com
URL: https://stream.playbuzz.com/player/b8391b55-6a16-46a2-b625-b4a52f7d6e23

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.130.132 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

d55ecce76b7466421fb833136b15d4c92040236c12e360f29f3e82031e7f0578

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
date: Tue, 17 Oct 2023 01:23:02 GMT
age: 40527
x-cache: HIT, HIT
content-length: 750
x-served-by: cache-iad-kjyo7100158-IAD, cache-yyz4521-YYZ
server: nginx
x-timer: S1697505783.728456,VS0,VE0
etag: W/"2ee-UViHUK0oRrTCVPuBu00ZVIdWz4w"
access-control-max-age: 600
access-control-allow-methods: GET, POST, PUT, DELETE, PATCH
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
vary: x-pb-country, x-pb-connection, x-pb-embedid, x-pb-itemid, x-pb-videoid, x-pb-player, x-pb-bot-name, x-pb-is-bot, x-pb-country, x-pb-connection, x-pb-embedid, x-pb-itemid, x-pb-videoid, x-pb-player, x-pb-bot-name, x-pb-is-bot
accept-ranges: bytes
access-control-allow-headers: Accept, Authorization, Content-Type
x-cache-hits: 1, 316

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
94 B 43ms
43ms XHR
text/plain 142.251.111.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1249529835&t=pageview&_s=1&dl=https%3A%2F%2Fmacleans.ca%2F&ul=en-us&de=UTF-8&dt=Macleans.ca%20-%20Canada%E2%80%99s%20magazine&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAAABAAAAACAEC~&jid=534074641&gjid=1568912173&cid=1994954187.1697505781&tid=UA-108831724-1&_gid=1535254586.1697505782&_r=1&_slc=1&gtm=45He3ab0n8158ST9BH&cd1=content%20name%20not%20available&cd2=author%20name%20not%20available&cd3=cms%20id%20not%20available&cd4=https%3A%2F%2Fmacleans.ca%2F&cd18=cms%20id%20not%20available_Macleans&cd19=1994954187.1697505781&z=1970589102

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f102.1e100.net

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://macleans.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://macleans.ca
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 15_Avatar-750x422.jpeg
macleans.ca/wp-content/uploads/2023/10/ 133 KB
134 KB 152ms
151ms Image
image/jpeg 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://macleans.ca/wp-content/uploads/2023/10/15_Avatar-750x422.jpeg

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

080fced9c42413ea185bb8a99a693cac40a1f448843558c90454639e5890c0b2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
alt-svc: h3=":443"; ma=86400
content-length: 136003
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 11 Oct 2023 14:11:33 GMT
server: cloudflare
etag: "6526ad15-21343"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 8174bbded984a232-YYZ
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 8_Mindreading-489x275.jpeg.webp
macleans.ca/wp-content/uploads/2023/10/ 48 KB
49 KB 84ms
83ms Image
image/webp 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://macleans.ca/wp-content/uploads/2023/10/8_Mindreading-489x275.jpeg.webp

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5e888c099eaa9302340e11e9411dc11ff92b2f0d1331d99432be566445cd6ae

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
alt-svc: h3=":443"; ma=86400
content-length: 49042
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 11 Oct 2023 14:11:06 GMT
server: cloudflare
etag: "6526acfa-bf92"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/webp
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 8174bbded98aa232-YYZ
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 11_Loneliness-1-489x275.jpeg
macleans.ca/wp-content/uploads/2023/10/ 39 KB
40 KB 80ms
79ms Image
image/jpeg 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://macleans.ca/wp-content/uploads/2023/10/11_Loneliness-1-489x275.jpeg

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84156ae066474e0c636a1c380f8e96a05591295096463f0a4912dd9a5df246ff

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
alt-svc: h3=":443"; ma=86400
content-length: 39899
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 11 Oct 2023 16:33:48 GMT
server: cloudflare
etag: "6526ce6c-9bdb"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 8174bbded990a232-YYZ
expires: Thu, 31 Dec 2037 23:55:55 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
346 B 364ms
43ms XHR
text/plain 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-108831724-1&cid=1994954187.1697505781&jid=534074641&gjid=1568912173&_gid=1535254586.1697505782&_u=YADAAAAAAAAAACAEC~&z=355642799

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f156.1e100.net

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://macleans.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 17 Oct 2023 01:23:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://macleans.ca
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H/1.1 200
OK attention-event
sr.studiostack.com/track/ Frame 0
0 101ms
35ms Preflight
text/html 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-event
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://macleans.ca
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Access-Control-Allow-Origin: *
Allow: POST
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 4
Content-Type: text/html; charset=utf-8
Date: Tue, 17 Oct 2023 01:23:01 GMT
ETag: W/"4-Yf+Bwwqjx254r+pisuO9HfpJ6FQ"
Expires: 0
Pragma: no-cache
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

POST
H/1.1 200
OK attention-event Show response
sr.studiostack.com/track/ 0
396 B 91ms
34ms XHR
text/plain 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-event
Requested by: Host: sr.studiostack.com
URL: https://sr.studiostack.com/v3/services
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://macleans.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

Expires: 0
Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:01 GMT
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 0
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

GET
H/1.1 200
OK attention-data Show response
sr.studiostack.com/track/ 107 B
594 B 157ms
56ms XHR
application/json 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-data?media=250774&ref=https%3A%2F%2Fmacleans.ca%2F
Requested by: Host: sr.studiostack.com
URL: https://sr.studiostack.com/v3/services
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 4d6ccad25edacdb6163e9e7e7a145f1a6206cb0f558ad41e25e70c0d5d07215d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:01 GMT
ETag: W/"6b-vNUYIoSnM1k2elBDn0D4+C0GOZw"
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 107
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

GET
H3 200 TRAVEL_ST_JOHNS_WEB_EN1_FLAT1-1000x563.jpg.webp
macleans.ca/wp-content/uploads/2023/09/ 153 KB
154 KB 69ms
69ms Image
image/webp 104.18.27.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://macleans.ca/wp-content/uploads/2023/09/TRAVEL_ST_JOHNS_WEB_EN1_FLAT1-1000x563.jpg.webp

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.27.168 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d0a4a23b2b6f5fdac53a6c939a94c25e58578e69cc35a3d5b307b900123c8ec5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
alt-svc: h3=":443"; ma=86400
content-length: 156308
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 28 Sep 2023 19:52:43 GMT
server: cloudflare
etag: "6515d98b-26294"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/webp
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 8174bbdfaaeba232-YYZ
expires: Thu, 31 Dec 2037 23:55:55 GMT

POST
H2 200 events Show response
collector.ex.co/main/ 17 B
155 B 109ms
36ms XHR
application/json 54.85.101.118
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector.ex.co/main/events
Requested by: Host: stream.playbuzz.com
URL: https://stream.playbuzz.com/player/b8391b55-6a16-46a2-b625-b4a52f7d6e23
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.85.101.118 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-101-118.compute-1.amazonaws.com
Software: /
Resource Hash: cebe87559cf861d01e9c6b1cefd38ab1db9e13c8fe316b85a296b6cf220f883e

Request headers

Referer: https://macleans.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 17 Oct 2023 01:23:02 GMT
etag: W/"11-MaL8I3MaqLPWbOrdrabTmSWS9PM"
content-length: 17
content-type: application/json; charset=utf-8

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 121ms
49ms Image
image/gif 142.251.163.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-108831724-1&cid=1994954187.1697505781&jid=534074641&_u=YADAAAAAAAAAACAEC~&z=896281851

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f105.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
408 B 374ms
50ms Image
image/gif 142.251.111.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-108831724-1&cid=1994954187.1697505781&jid=534074641&_u=YADAAAAAAAAAACAEC~&z=896281851

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 180649612 Show response
fundingchoicesmessages.google.com/i/ 158 KB
52 KB 166ms
68ms Script
application/javascript 172.253.115.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/180649612?ers=3

Requested by

Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f113.1e100.net

Software

ESF /

Resource Hash

1fe9ded65826966445cafc9a8e33bb4d7ff2705829010966ef8a60ab8e22e371

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-EvP1TjlxFUFhmbSDKOCmBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:04 GMT
content-security-policy: script-src 'report-sample' 'nonce-EvP1TjlxFUFhmbSDKOCmBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 299 KB
85 KB 18ms
18ms Script
application/x-javascript 31.13.80.12
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=764f9b1902beb510f1f2e61deff1aee3

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.80.12 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-yyz1.fbcdn.net

Software

Resource Hash

853f48bd0321d7b4cb0b8dbc21875669fa0bc0548ee5694f7acb4a60c4f973d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://macleans.ca/
Origin: https://macleans.ca
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 17 Oct 2023 01:23:04 GMT
content-md5: 7BAbGymVF37X8rcAs9PE0Q==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 86679
x-fb-debug: b7HJ328gCrg/5hlMrnf2XrIO3r/ae8dnDmwAHXwWtqeZvlJ7uTRtmyvpDZiQyOpMzMyb0A3W043AAqjgPx7vPg==
x-fb-content-md5: b6c2cc63ec052213e3e66eb20eb52f12
cross-origin-opener-policy: same-origin-allow-popups
etag: "af99fa78a83c8559908ac6d2d083ab28"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Wed, 16 Oct 2024 00:02:52 GMT

GET
H2 200 adsct
t.co/i/ 43 B
376 B 179ms
61ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=1f8293ce-0c71-42ce-96df-04b5b8dfb838&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=6f527be5-7480-4b2e-b895-8f5ac006df18&tw_document_href=https%3A%2F%2Fmacleans.ca%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv46n&type=javascript&version=2.3.29

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-response-time: 5
date: Tue, 17 Oct 2023 01:23:04 GMT
strict-transport-security: max-age=0
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: 81d7f4e89996b114
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: efe5e1c2b290778b5b0b7c78cd695a79e40575426d003bac278b240710e85e9d
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
394 B 1528ms
128ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=1f8293ce-0c71-42ce-96df-04b5b8dfb838&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=6f527be5-7480-4b2e-b895-8f5ac006df18&tw_document_href=https%3A%2F%2Fmacleans.ca%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv46n&type=javascript&version=2.3.29

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-response-time: 74
date: Tue, 17 Oct 2023 01:23:05 GMT
strict-transport-security: max-age=631138519
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: 0ff1d03b9ceb6600
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: 6f472c9146a61662022e824cfe8d8ec53bf70622a3a2bbbe247fce22e7775492
content-length: 43

GET
H2 200 274931283831629 Show response
connect.facebook.net/signals/config/ 139 KB
36 KB 91ms
90ms Script
application/x-javascript 31.13.80.12
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/274931283831629?v=2.9.134&r=stable&domain=macleans.ca

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.80.12 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-yyz1.fbcdn.net

Software

Resource Hash

29e9ad9ab38ae2e5a8d904987b7179484e40bb50b14f0e04b9cc420c38ce3866

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 17 Oct 2023 01:23:04 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: 56sbb77VXAyT+eDgTPwVlui86HGCUFGcehKSYzDpdE8c+Tgkax5YuaoXk+CasuJSTssiT3vhdP8E9HVFAgvfPA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/664672480/ 42 B
154 B 52ms
51ms Image
image/gif 142.251.163.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/664672480/?random=1697505781016&cv=11&fst=1697504400000&bg=ffffff&guid=ON&async=1&gtm=45He3ab0&u_w=1600&u_h=1200&url=https%3A%2F%2Fmacleans.ca%2F&frm=0&tiba=Macleans.ca%20-%20Canada%E2%80%99s%20magazine&fmt=3&is_vtc=1&random=2944569384&rmt_tld=0&ipr=y

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f105.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:04 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.ca/pagead/1p-user-list/664672480/ 42 B
154 B 50ms
50ms Image
image/gif 142.251.111.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/664672480/?random=1697505781016&cv=11&fst=1697504400000&bg=ffffff&guid=ON&async=1&gtm=45He3ab0&u_w=1600&u_h=1200&url=https%3A%2F%2Fmacleans.ca%2F&frm=0&tiba=Macleans.ca%20-%20Canada%E2%80%99s%20magazine&fmt=3&is_vtc=1&random=2944569384&rmt_tld=1&ipr=y

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:04 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 AGSKWxXT7kYtQG5zCI4yQZz9OSxIh7srg0AyNHK4CjYm5XxflIxPQSqu--LI9iunmFKBZiVvJQ9v4ZojUFbpFrGdjrUuGEAy7MYo5haq0G-ygXfu5nBmwkz4vbjNZK67suppddBaf9H28g== Show response
fundingchoicesmessages.google.com/f/ 13 KB
7 KB 87ms
86ms Script
application/javascript 172.253.115.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXT7kYtQG5zCI4yQZz9OSxIh7srg0AyNHK4CjYm5XxflIxPQSqu--LI9iunmFKBZiVvJQ9v4ZojUFbpFrGdjrUuGEAy7MYo5haq0G-ygXfu5nBmwkz4vbjNZK67suppddBaf9H28g==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk3NTA1Nzg0LDU4NjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9tYWNsZWFucy5jYS8iLG51bGwsW1s4LCIxajBlc051MFJXQSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdXV0

Requested by

Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f113.1e100.net

Software

ESF /

Resource Hash

f77e8efca370d16dab04b2703f2d4387de471022e63f64a06af0e333cc3b6d70

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-T0qTHiRlcc9y_nz6pel7Vw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:04 GMT
content-security-policy: script-src 'report-sample' 'nonce-T0qTHiRlcc9y_nz6pel7Vw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 rap
vault.gostatera.com/collect/ 2 B
135 B 279ms
91ms Ping
text/plain 52.37.69.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vault.gostatera.com/collect/rap
Requested by: Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.37.69.61 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-37-69-61.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://macleans.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 17 Oct 2023 01:23:04 GMT
access-control-expose-headers
content-length: 2
vary: Origin
content-type: text/plain; charset=utf-8

POST
H2 200 rap
vault.gostatera.com/collect/ 2 B
136 B 277ms
89ms Ping
text/plain 52.37.69.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vault.gostatera.com/collect/rap
Requested by: Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.37.69.61 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-37-69-61.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://macleans.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 17 Oct 2023 01:23:04 GMT
access-control-expose-headers
content-length: 2
vary: Origin
content-type: text/plain; charset=utf-8

POST
H2 200 rap
vault.gostatera.com/collect/ 2 B
135 B 279ms
92ms Ping
text/plain 52.37.69.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vault.gostatera.com/collect/rap
Requested by: Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.37.69.61 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-37-69-61.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://macleans.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 17 Oct 2023 01:23:04 GMT
access-control-expose-headers
content-length: 2
vary: Origin
content-type: text/plain; charset=utf-8

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 24 KB
12 KB 854ms
853ms Fetch
text/plain 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1600121213626427&correlator=3881640036341040&output=ldjh&gdfp_req=1&vrg=202310120101&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&iu_parts=180649612%2CMAC_DESKTOP_WALLPAPER%2CMAC_DESKTOP_C1&enc_prev_ius=%2F0%2F1%2C%2F0%2F2&prev_iu_szs=1x1%2C728x90%7C970x250%7C970x90&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1697505784639&lmt=1697530699&adxs=0%2C436&adys=75%2C75&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0&ucis=1%7C2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Fmacleans.ca%2F&vis=1&psz=1600x6219%7C1600x6219&msz=1600x0%7C1600x0&fws=4%2C4&ohw=1600%2C1600&ga_vid=1994954187.1697505781&ga_sid=1697505785&ga_hid=1249529835&ga_fc=true&dlt=1697505780775&idt=3535&prev_scp=%7Camznbid%3D1%26amznp%3D1&cust_params=post_hash%3D839d77835bb7f9daf9950c7a562b0eb2c8424dfd%26category%3D%252F%26hostname%3Dmacleans.ca%26is_staging%3Dfalse&adks=4126696251%2C562129336&frm=20&is_cau=%2C

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310120101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

289b09264b08ca46f1b721355015a1b01196e00066af0d44425a61190867ef95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:05 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11621
x-xss-protection: 0
google-lineitem-id: -2,-1
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://macleans.ca
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame CB15 6 KB
3 KB 118ms
37ms Document
text/html 172.253.62.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310120101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f132.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://macleans.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 17 Oct 2023 01:23:04 GMT
expires: Wed, 16 Oct 2024 01:23:04 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 rap
vault.gostatera.com/collect/ 2 B
135 B 234ms
90ms Ping
text/plain 52.37.69.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vault.gostatera.com/collect/rap
Requested by: Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.37.69.61 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-37-69-61.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://macleans.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 17 Oct 2023 01:23:04 GMT
access-control-expose-headers
content-length: 2
vary: Origin
content-type: text/plain; charset=utf-8

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 305ms
18ms Image
text/plain 31.13.80.36
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=274931283831629&ev=PageView&dl=https%3A%2F%2Fmacleans.ca%2F&rl=&if=false&ts=1697505784693&sw=1600&sh=1200&v=2.9.134&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=30&fbp=fb.1.1697505784690.1700535618&cs_est=true&ler=empty&it=1697505784537&coo=false&tm=1&rqm=GET

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.80.36 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-yyz1.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 17 Oct 2023 01:23:04 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 / Show response
sync.cootlogix.com/api/sync/iframe/ Frame 16EA 109 B
422 B 105ms
33ms Document
text/html 142.93.204.154
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 142.93.204.154 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: a1aa01f31d4087317f5d4e5ef4ea70a73e38124a45f1553dbe8968ea16068b84

Request headers

Referer: https://macleans.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 109
content-type: text/html
date: Tue, 17 Oct 2023 01:23:04 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H/1.1

200
OK

iu3 Show response
s.amazon-adsystem.com/ Frame C0FB
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&dcc=t

394 B
1 KB

61ms
60ms

Document
text/html

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&dcc=t

Requested by

Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

8435efe820017f9a898318d0ccba0846b94d8fa405174d21d0c4edb0fd5dc08f

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://macleans.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 394
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 17 Oct 2023 01:23:05 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: A3321NXWP9CW0Y92H3KH

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Tue, 17 Oct 2023 01:23:05 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: G8WW5327X5W61QT1AVGD

GET
H/1.1 200
OK pr Show response
s.amazon-adsystem.com/v3/ Frame 1677 3 KB
4 KB 45ms
45ms Document
text/html 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&dcc=t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

0a8c43f26673a5e7d593025cff6844c834b60f8c3cf577a37b1c9a95f3a0e0e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&dcc=t
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 3554
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 17 Oct 2023 01:23:05 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: BSFEHY8Q8V4Q3MS3SZN1

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 1677
Redirect Chain

https://csync.loopme.me/?pubid=11405&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dloopme.com%26id%3D%7Bviewer_token%7D
https://s.amazon-adsystem.com/ecm3?ex=loopme.com&id=3c64bd8b-fccb-411a-9433-5641948ad7f5

43 B
479 B

47ms
46ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=loopme.com&id=3c64bd8b-fccb-411a-9433-5641948ad7f5

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:05 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 1ZTG9GDZ1KSZ9M2PYSD2
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=loopme.com&id=3c64bd8b-fccb-411a-9433-5641948ad7f5
date: Tue, 17 Oct 2023 01:23:05 GMT
server: _
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 1677
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=amazon&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=amazon&zcc=1&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D&cb=1697505787318
https://ad.turn.com/r/cs?pid=45&rndcb=35169248
https://sync.1rx.io/usersync/turn/7059221617362624609?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-007b6c37-ae98-4f10-adc8-cbebe3dcf623-005?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3DRX-007b6c37-ae98-4f10-adc8-cbeb...
https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-007b6c37-ae98-4f10-adc8-cbebe3dcf623-005

43 B
479 B

42ms
41ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-007b6c37-ae98-4f10-adc8-cbebe3dcf623-005

Requested by

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:09 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: QYE088NYRDD866MGBX4C
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Tue, 17 Oct 2023 01:23:09 GMT
Server: Tengine
ETag: RX007b6c37ae984f10adc8cbebe3dcf623005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-007b6c37-ae98-4f10-adc8-cbebe3dcf623-005
Content-Type: text/html
Connection: keep-alive

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 1677
Redirect Chain

https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3405073889017883000V10

43 B
479 B

47ms
46ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3405073889017883000V10

Requested by

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:08 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: XH4QKERD1J44YEK9CYH8
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:08 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3405073889017883000V10
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Tue, 17 Oct 2023 01:23:08 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 1677
Redirect Chain

https://match.prod.bidr.io/cookie-sync/amzn?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dbeeswax.com%26id%3D%24UID
https://match.prod.bidr.io/cookie-sync/amzn?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dbeeswax.com%26id%3D%24UID&_bee_ppp=1
https://s.amazon-adsystem.com/ecm3?id=AACU-k7KW8QAABqkr6rUzQ&ex=beeswax.com

43 B
479 B

42ms
42ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=AACU-k7KW8QAABqkr6rUzQ&ex=beeswax.com

Requested by

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:08 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 9N2AV474F6S6RVSWFXVZ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?id=AACU-k7KW8QAABqkr6rUzQ&ex=beeswax.com
Date: Tue, 17 Oct 2023 01:23:08 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 1677
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=aps&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsmaato.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=e9b35e5b13

43 B
479 B

131ms
40ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=e9b35e5b13

Requested by

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:05 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: NPG41WT8VQ8HFTA2BQ1F
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Tue, 17 Oct 2023 01:22:44 GMT
via: 1.1 65742b7123c3e2092c47edac9577810a.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: BOS50-P3
age: 21
x-cache: Hit from cloudfront
location: https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=e9b35e5b13
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: i9B4ZN6I4wRaDqNc7cuq2XYRgaRxOlQ7B0-Mvx8iuJNO_9tANuxI3Q==

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 1677
Redirect Chain

https://um.simpli.fi/amazon/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsimpli.fi%26id%3D
https://s.amazon-adsystem.com/ecm3?id=3297F192560D4730894264FA0DD2E476&ex=simpli.fi&status=ok

43 B
479 B

44ms
43ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=3297F192560D4730894264FA0DD2E476&ex=simpli.fi&status=ok

Requested by

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:05 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: X6M96906RKDS08H0KTV9
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Tue, 17 Oct 2023 01:23:05 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://s.amazon-adsystem.com/ecm3?id=3297F192560D4730894264FA0DD2E476&ex=simpli.fi&status=ok
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Mon, 16 Oct 2023 01:23:05 GMT

GET
H/1.1

200
OK

sync.php
pixel-us-east.rubiconproject.com/exchange/ Frame 1677
Redirect Chain

https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__
https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__&s=2
https://sync.outbrain.com/sync-external?uid=T0azmDArakekTh0kVQx7&redirect=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Famazon_tam%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63...
https://u.openx.net/w/1.0/cm?id=00df9f64-6f67-4cae-aeb2-d951da52047c&r=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fobhb%3Dhttps%253A%252F%252Fb1sync.zemanta.com%252Fusersync%252Famazon_tam%252F...
https://u.openx.net/w/1.0/cm?cc=1&id=00df9f64-6f67-4cae-aeb2-d951da52047c&r=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fobhb%3Dhttps%253A%252F%252Fb1sync.zemanta.com%252Fusersync%252Famazon_tam...
https://sync.outbrain.com/cookie-sync?obhb=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Famazon_tam%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG...
https://pixel-us-east.rubiconproject.com/exchange/sync.php?obhb=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Famazon_tam%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7...

42 B
775 B

39ms
38ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-us-east.rubiconproject.com/exchange/sync.php?obhb=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Famazon_tam%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZUWIPKUGBQXU3KEIFZGC23FNNKGQMDLKZIXQNY&p=15268&obUid=wNfwKaY6DVjqxEhr2_kIvCE-udeTzgadLvsyoGy8QZFqyhct07a63a3JHjS-Byvv&gdpr=%24GDPR_APPLIES&gdpr_consent=%24CONSNT_STRING&us_privacy=%24CCPA&initiator=s2s
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 83041abbe8494cb29eff3083edd6dff6
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location: https://pixel-us-east.rubiconproject.com/exchange/sync.php?obhb=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Famazon_tam%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZUWIPKUGBQXU3KEIFZGC23FNNKGQMDLKZIXQNY&p=15268&obUid=wNfwKaY6DVjqxEhr2_kIvCE-udeTzgadLvsyoGy8QZFqyhct07a63a3JHjS-Byvv&gdpr=%24GDPR_APPLIES&gdpr_consent=%24CONSNT_STRING&us_privacy=%24CCPA&initiator=s2s
Date: Tue, 17 Oct 2023 01:23:09 GMT
Cache-Control: no-cache
X-TraceId: 79e37c2fcb6781e25fe3902577169398
Content-Length: 0

GET
H2

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame F985
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

2 KB
857 B

59ms
56ms

Document
text/html

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 60cd4bba2b90b26bc4b8a840ab12fb40887b6b493ea5e0c7139168eea606b389

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 8174bbf79d1d53fb-YYZ
content-encoding: br
content-type: text/html
date: Tue, 17 Oct 2023 01:23:05 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hXONT3UTtYjI8HIJnvLnzvITyTJAP4O8rVSiOW5inxtVe6DJKoU6nTbAkt23nXs0r0AnmRrgZOapwGPEn1XuqTZF%2B0BqgLC7Y8ifs7ccJvowEr7Ec2%2FKVwmmEv1jfa6OZzEdNTUx%2FIpMBw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 8174bbf73c7053fb-YYZ
content-length: 0
date: Tue, 17 Oct 2023 01:23:05 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ym4u2aGrCI7W%2Fy7dkZdbHcYYSg0bBDZHSwFam5esGV8AXcBvgfTRANs0FpW6HB%2BW%2BTlGA2lCFCFDgym4o%2F1LXJvBU28ve30ahgwU5goxyVVedA771tYkoYGMbmo7UWSw9FSabe63WQ4NBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame D78A 0
176 B 279ms
57ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Tue, 17 Oct 2023 01:23:05 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame DE55
Redirect Chain

https://ssbsync-us.smartadserver.com/api/sync?callerId=2
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=8721594384017978332&gdpr=0&gdpr_consent=

43 B
479 B

88ms
40ms

Document
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=8721594384017978332&gdpr=0&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 17 Oct 2023 01:23:05 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: PTGV6GJQ6912TBX14YFX

Redirect headers

content-length: 0
date: Tue, 17 Oct 2023 01:23:04 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=8721594384017978332&gdpr=0&gdpr_consent=

GET
H2 200 / Show response
match.sharethrough.com/jwumXNuB/v1/ Frame C41F 845 B
1 KB 1378ms
34ms Document
text/html 54.236.119.39
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.236.119.39 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-236-119-39.compute-1.amazonaws.com
Software: /
Resource Hash: 8e61da668539083cdc135d7fee79dd76173e6b12124d9a692df6ff1d3d5789e5

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-length: 845
date: Tue, 17 Oct 2023 01:23:06 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 4144 15 KB
6 KB 3268ms
100ms Document
text/html 23.215.40.199
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.215.40.199 McAllen, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-215-40-199.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 94061a925c5d84bf776554ac894020c407a9a4c89b979d538de3cf45591fe423

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=83515
content-encoding: gzip
content-length: 5606
content-type: text/html
date: Tue, 17 Oct 2023 01:23:08 GMT
expires: Wed, 18 Oct 2023 00:35:03 GMT
last-modified: Fri, 01 Sep 2023 11:18:33 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET usync.html
eus.rubiconproject.com/ Frame FC51 0
0

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 26BC
Redirect Chain

https://ib.adnxs.com/getuid?https://s.amazon-adsystem.com/ecm3?id=$UID&ex=appnexus.com
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID%26ex%3Dappnexus.com
https://s.amazon-adsystem.com/ecm3?id=7332518813481760111&ex=appnexus.com

43 B
479 B

41ms
40ms

Document
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?id=7332518813481760111&ex=appnexus.com

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 17 Oct 2023 01:23:05 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: 6M6KTGMWZ33N6E5WWZZ1

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 29d14ae6-dc39-4dbe-a28f-f4b5c7298d80
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Tue, 17 Oct 2023 01:23:05 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://s.amazon-adsystem.com/ecm3?id=7332518813481760111&ex=appnexus.com
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.21.3
x-proxy-origin: 86.48.15.34; 86.48.15.34; 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
x-xss-protection: 0

GET
H/1.1

200
OK

amazon Show response
ce.lijit.com/beacon/ Frame 30A7
Redirect Chain

https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com
https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com
https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1

1 KB
1 KB

32ms
32ms

Document
text/html

23.92.190.69
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.69 Houston, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: 48cc921dfba1b45614021b10eb1ea7eba1ac0e4f1eb57d3b23f9eeb520da8093

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Encoding: gzip
Content-Length: 472
Content-Type: text/html
Date: Tue, 17 Oct 2023 01:23:06 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
Vary: Accept-Encoding, User-Agent
X-Sovrn-Pod: ad_ap3ewr1

Redirect headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length: 0
Date: Tue, 17 Oct 2023 01:23:06 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Location: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap3ewr1

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 89D8
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=2805667729428079344355

43 B
479 B

43ms
42ms

Document
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=2805667729428079344355

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 17 Oct 2023 01:23:06 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: AZYJ8NHYRH7QHX1VN7RK

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Tue, 17 Oct 2023 01:23:06 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=2805667729428079344355
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 container.html Show response
4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 2284 6 KB
3 KB 38ms
37ms Document
text/html 172.253.62.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f132.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://macleans.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 17 Oct 2023 01:23:05 GMT
expires: Wed, 16 Oct 2024 01:23:05 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 rap
vault.gostatera.com/collect/ 2 B
135 B 100ms
100ms Ping
text/plain 52.37.69.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vault.gostatera.com/collect/rap
Requested by: Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.37.69.61 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-37-69-61.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://macleans.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 17 Oct 2023 01:23:05 GMT
access-control-expose-headers
content-length: 2
vary: Origin
content-type: text/plain; charset=utf-8

GET
H2 200 grumi.js Show response
rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/ Frame 2284 177 KB
59 KB 41ms
37ms Script
text/javascript 18.239.168.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js
Requested by: Host: macleans.ca
URL: https://macleans.ca/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.168.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-168-105.bos50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3f46c1859f11e88dd7f05b4e26e6958ed0a852e8660d452ccb938ff741fcb240

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:21:51 GMT
x-amz-version-id: ZoAABqmCABj3kBnfvtuOge4b.tLOBh7S
content-encoding: br
last-modified: Tue, 17 Oct 2023 01:03:52 GMT
server: AmazonS3
via: 1.1 e4aa00d43c392896077df2add1b436f4.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-P3
etag: W/"58d3ae0fedd0f43a548a7d45cfdcf938"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public,max-age=3600,stale-while-revalidate=3600,immutable,must-revalidate
age: 75
x-amz-cf-id: Nmex4EkVr8Rv0oJiXhO2tEm-WzC2o3oKXIIEN53zyOC4PcNeTccjEw==

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame F985 43 B
855 B 138ms
50ms Image
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZS3h-b8FpCnTVEQXH-FQ_QAADyQAAAAB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:05 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 7A7XMX61KC1MPY4QCYBC
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame F985
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZS3h-b8FpCnTVEQXH-FQ_QAADyQAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEL8aVPcoMx-wn9WFRR6q4Xs&google_cver=1

43 B
767 B

52ms
52ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEL8aVPcoMx-wn9WFRR6q4Xs&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fo4zhDpmry9BA8bcuhotYxJvDogadY3YvVX5jBl7xFTEgdzC6D1eBE0Coccy1T7ybsSLw6s0SHhS6CVy5iSZsl%2BJn2EKIzXb5va6xRy3S2TK20F3k9dzfgq4biJiMLCWugDYkLdCdUuC8w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8174bbf85ed736d6-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEL8aVPcoMx-wn9WFRR6q4Xs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame F985
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZS3h.b8FpCnTVEQXH.FQ-QAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEE643kvq9RK3F9_GQbs7esI&google_cver=1&google_hm=2

43 B
735 B

55ms
55ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEE643kvq9RK3F9_GQbs7esI&google_cver=1&google_hm=2
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CRX38kMfdB71fxMSOTTQ5LIFOxYo8Fu2Seec%2FjT1qip9gjytw7Q09F99hvLZPrPzEf4D6KKY%2Bn9ePw%2BMrDsGrz0fnvjYXyAJtCQX20fKzOcqbqkfEnYX%2BgysgU7SLBdKaGe2SvhelNc79A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8174bbf8bf9d36d6-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEE643kvq9RK3F9_GQbs7esI&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame F985
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://match.adsrvr.org/track/cmb/casale?
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=515cf6f8-7a1d-44a8-9545-d02c6c07e305&expiration=1700097787&gdpr=0&gdpr_consent=

43 B
737 B

50ms
50ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=515cf6f8-7a1d-44a8-9545-d02c6c07e305&expiration=1700097787&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bq4hLwgglHZdz%2FiPS7SnBSRLBpXdNkKLzEKOYYaC6BNzghjHnct6vpstJlF6W15sJTy0kakCJB5FxDfZf0SoGlKCFZSZYlau%2F5iBTlRgkTJmorsgxYJNVZmc%2Buh95UBDAGSmdBVLf%2FeKxA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8174bc05c84636d6-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=515cf6f8-7a1d-44a8-9545-d02c6c07e305&expiration=1700097787&gdpr=0&gdpr_consent=
date: Tue, 17 Oct 2023 01:23:07 GMT
server: Kestrel
content-length: 323

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame F985
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D46%26external_user_id%3D%24UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=6242155078849264757

43 B
731 B

48ms
48ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=6242155078849264757
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FhwOXe5E15HRTl85elZ0llRZZHQr6VaBtzVug7hfsxXWQTTbWyee55hCHIegB4tVwh67qLt0pM010sffbbUGeVrIPFWLur7Am8kP3wa3HRBBOiR6n0WCRjZD50qK6JNETXjXcEp7T6nXxA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8174bbf8dfdc36d6-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
an-x-request-uuid: 55f38adb-a3ee-4116-8aa1-674fba01092f
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=6242155078849264757
x-proxy-origin: 86.48.15.34; 86.48.15.34; 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET cm
cm.ctnsnet.com/int/ Frame F985 0
0

GET ibs:dpid=23728&dpuuid=ZS3h.b8FpCnTVEQXH.FQ-QAA%263876
dpm.demdex.net/ Frame F985 0
0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame F985 43 B
479 B 153ms
44ms Image
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=index.com&id=ZS3h-b8FpCnTVEQXH-FQ_QAADyQAAAAB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:05 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: RJZHHHM0H9HGZYQHY2GV
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

crum Show response
dsum-sec.casalemedia.com/ Frame 9C46
Redirect Chain

https://um4.eqads.com/um/cs
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=b3a568d0-c902-4453-96a0-73d083e1d174&expiration=1705454586

43 B
735 B

57ms
57ms

Document
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=b3a568d0-c902-4453-96a0-73d083e1d174&expiration=1705454586
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://ssum-sec.casalemedia.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 8174bbff1c3736d6-YYZ
content-length: 43
content-type: image/gif
date: Tue, 17 Oct 2023 01:23:06 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pToK28UBJAtNOpOji%2BTZjqud8kCZ%2Fztx8UfvFssHgHw89WPQ5c0XMHA5mJSOnX8esuxWRwYRLXWsYVbXOtSH5XLA5CTJj2MCFyM0bad6dLjKr3Qft7%2BrU1PNE4sZGdvIw756Pjl78y2RFw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

cache-control: no-cache
content-length: 0
date: Tue, 17 Oct 2023 01:23:06 GMT
expires: 0
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=b3a568d0-c902-4453-96a0-73d083e1d174&expiration=1705454586

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame EC95 645 B
254 B 67ms
67ms Document
text/html 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeqSBC14Z0BGJu52_gBMAE&v=APEucNW984lm5m3IG2lhBjeFfmbf_xTOGMIo6FKAcIWSCOhVmZKXfQVZ-f7O21LUDh9t-ZQFmy1IbXb9kM64dlWkfDGjtiSgmsBg3R648HQI129WxMfRn1Q

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 17 Oct 2023 01:23:05 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 2284 89 KB
31 KB 148ms
73ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:05 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31491
x-xss-protection: 0
server: cafe
etag: 6167930392490353973
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 17 Oct 2023 01:23:05 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 2284 3 KB
2 KB 359ms
35ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/window_focus_fy2021.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 18:12:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25807
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 18:12:58 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 2284 20 KB
8 KB 360ms
36ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

cafe /

Resource Hash

def028b193b87150eeb974ece780b8476797f52aa2edc9d7031e35bb5d0edd15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 18:30:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24739
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8337
x-xss-protection: 0
server: cafe
etag: 13483435759450910196
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 18:30:46 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 2284 0
0 48ms
46ms Image
text/html 142.251.163.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ9cXu-6-Ox2Cz9IvU2H-UEnBxJZnN7QbFeaQa8sBwydlbNFr03tzsXEg6_oihzc2CcJpl4L5Kjqj2rXubssAeP4wTjGQ
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.163.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f105.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2284 187 KB
59 KB 3415ms
70ms Script
text/javascript 142.251.16.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f157.1e100.net

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 17 Oct 2023 01:23:09 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2284 42 B
110 B 169ms
96ms Image
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Cjqj1w1Nd94YfdIm_mw5YNc_FuQMVW8p5gWB80UOmSqyhBclWaP7ihkEu2YQYmqjcB_ByLe_w8UZRNkNu0A_Je923N_x3u5k3FFVke0s3iKKoxQKE

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2284 0
121 B 168ms
96ms Image
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=2595873142407564507&x=1&ct=76

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 56ms
56ms Image
image/gif 172.253.115.113
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=1&rn=0.8491282844771273

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f113.1e100.net

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-CBcR_Rcl4nfADUMFlGO2Bw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:05 GMT
content-security-policy: script-src 'report-sample' 'nonce-CBcR_Rcl4nfADUMFlGO2Bw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 59ms
58ms Image
image/gif 172.253.115.113
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=2&rn=10.90250270044221

Requested by

Host: macleans.ca
URL: https://macleans.ca/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f113.1e100.net

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-PuhgvojU9Nk3c0lO1dufig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:05 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-PuhgvojU9Nk3c0lO1dufig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame EC95
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE643kvq9RK3F9_GQbs7esI&google_cver=1&gdpr=0

43 B
738 B

49ms
49ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE643kvq9RK3F9_GQbs7esI&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeqSBC14Z0BGJu52_gBMAE&v=APEucNW984lm5m3IG2lhBjeFfmbf_xTOGMIo6FKAcIWSCOhVmZKXfQVZ-f7O21LUDh9t-ZQFmy1IbXb9kM64dlWkfDGjtiSgmsBg3R648HQI129WxMfRn1Q
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dO4YJghamt%2BpGv48disnQ9aNBbKcAoDPd36ZVE6GN%2BAZI2HCLQ%2FN3Ek1Wf3LACbyvaFgAnB%2Fv33YtC4XKniSqRRTN3FrDw0xQTFHDjV8dZ2ybpzIG%2Bu5ho2DmlLHLzH1hDf5WMlhdkf%2FHw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8174bbf9286736d6-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE643kvq9RK3F9_GQbs7esI&google_cver=1&gdpr=0
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame EC95
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZS3h.b8FpCnTVEQXH.FQ-QAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE643kvq9RK3F9_GQbs7esI&google_cver=1&google_hm=2

43 B
732 B

61ms
60ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE643kvq9RK3F9_GQbs7esI&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeqSBC14Z0BGJu52_gBMAE&v=APEucNW984lm5m3IG2lhBjeFfmbf_xTOGMIo6FKAcIWSCOhVmZKXfQVZ-f7O21LUDh9t-ZQFmy1IbXb9kM64dlWkfDGjtiSgmsBg3R648HQI129WxMfRn1Q
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oRwPLM8%2Beo9DCBhfuk495LStmNYrw4AmpZw1aydp7fhu2NfqS9k5bafGWKAvO3QWNVfAIPzr5n%2Fign8vl6jSx5XluI4h1ayqoQupmvRuEHHv3v5WRROSqMV%2FakoU5QVBXb5Hl77lZsKtcg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8174bbfa1a9936d6-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE643kvq9RK3F9_GQbs7esI&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame EC95
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEAYUAHMp1yr-oImPgR-zU2I&google_cver=1

43 B
840 B

35ms
35ms

Image
image/gif

68.67.160.137
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEAYUAHMp1yr-oImPgR-zU2I&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeqSBC14Z0BGJu52_gBMAE&v=APEucNW984lm5m3IG2lhBjeFfmbf_xTOGMIo6FKAcIWSCOhVmZKXfQVZ-f7O21LUDh9t-ZQFmy1IbXb9kM64dlWkfDGjtiSgmsBg3R648HQI129WxMfRn1Q

Protocol

Server

68.67.160.137 Fairfield, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
an-x-request-uuid: f500f05d-9cdf-4dc6-b8a7-a5a916823413
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 86.48.15.34; 86.48.15.34; 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEAYUAHMp1yr-oImPgR-zU2I&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EC95
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjI0MjE1NTA3ODg0OTI2NDc1Nw%3D%3D

170 B
188 B

48ms
47ms

Image
image/png

172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjI0MjE1NTA3ODg0OTI2NDc1Nw%3D%3D

Requested by

Protocol

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
an-x-request-uuid: 461cc2eb-3c6a-48cb-8193-bd4dbdc6a92c
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjI0MjE1NTA3ODg0OTI2NDc1Nw%3D%3D
x-proxy-origin: 86.48.15.34; 86.48.15.34; 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 AGSKWxWRnrz_Z4EKzx0-8YCKJsa8ttnmG8TyFm79TzLsOUUlGhbs9H7Mj2eZgespGNzmuIsTq3EVCk6gU0MyFuMTnpMVNsI4GjE2nHLmxFLQWDrRbiDr8AoS-Qa1HmcZZJ5J40EIL0Qo2g== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 123ms
52ms XHR
text/html 172.253.115.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWRnrz_Z4EKzx0-8YCKJsa8ttnmG8TyFm79TzLsOUUlGhbs9H7Mj2eZgespGNzmuIsTq3EVCk6gU0MyFuMTnpMVNsI4GjE2nHLmxFLQWDrRbiDr8AoS-Qa1HmcZZJ5J40EIL0Qo2g==

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.1j0esNu0RWA.es5.O/am=gAE/d=1/rs=AJlcJMx_-2Gi72uxExQRO9AUXKjJRXIGGQ/m=kernel_loader,loader_js_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f113.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-wCSQeaFz80PabIQoToYikA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://macleans.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 17 Oct 2023 01:23:05 GMT
content-security-policy: script-src 'report-sample' 'nonce-wCSQeaFz80PabIQoToYikA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://macleans.ca
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2284 0
56 B 92ms
92ms Ping
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9500568075996&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2284 0
56 B 93ms
92ms Ping
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9500568075996&version=m202309260101&ct=76&x=1&cor=2595873142407564300

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2284 90 KB
38 KB 78ms
78ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A13wyrmNxYfwfyCN2EQude2j1Icys3pXtf_3KFx9uc-emvTzKv2ZtejmrG7mIqSaV839wyWPxWBNsKM9PlvwHX7-QKZA&cry=1&dbm_d=AKAmf-DOyJKh4gkLnoPOTyrmV3Hj6f3mr3sVCoFBWRcNeLvdxuco7CTMhy4EJpvYE2Boyy8-qUVf-wgPsZwaMOLxIY3E9BUWcKJiyuIZITTGZl4vFHyPtEZ88rXnzdaS44GvNjk69jf7GUsSBY9guQlXR95ak9ebfl6-TIFSm7gYFK8XvtN-Ubg6Ukv_XBd9SmaIKWZLrQNxsmmBHCnHRA_3iNbY3kOIqStxNsu8WhZ-vuPebWFYvMyCW9BUA6ySnpZMSM2E653CpK5sqgb7D3AwEbyhNMiBqnGOPMC5rJX0_aetoA2VpWhd_uWHWCI114zKRgH5KtZpxCy6eHZkYbjErLf3R9-Y36VcV6q6DBRGnIFmrZuhXy9oD7QgwhFNVPthmJqyvhUMLxHN6xX0GPybDJMWAqJFsTWpslLQVXlqYYuYBbacasglDC8c5l3hXDRJyFq-U1nyFfiV6gP0e_tqx-slN0Offrc3lx2JBinlAUdh42q-jgpiUKkCvTrcensXcvdPbHD9K3vzIHeQNF7AnTUVOMV-_egDLPQ3GLxy-pB46wYvAhBy2dghH_kjS0qfr6Zkf3vz8cY1j_grjPC7L-8_g1uC5pAOenRboyh2C867dSUED3lf2PaErpjqGFk0qMqSYyk3q3c31v5yRUXCKYhdh5RVOeRPUYg5kBcA3IvDAJr2PjGBje7Hr7UWWCRRc34jefW22cDlp5tkecNCHaVolnDDs08sfxcIcYox2s46sVFIbqXNKOU7xEzETLiZU3yji4ELq6N03uPucR1MTq1TxyZi8Fw6IiNyMhwgpKGOqFlZxGw2XIL1ot_pSr4FhKcrin5fgoyAUEyjFuMES3kRoAMtT3EJTuCAesAUhnY-lb91pSxUS-fsWQvftjtal-wjY54TXkRrfO0cdJibQCjjpzlNIew5htAcCUQUQgbwZGFx0PdVv_HFO47Njb1aKxoEGHtNZ_G7XSqm_lnoRggmeebXlMVM1j43yldFcuRxJlTc3RC5K-thyBEhj_otUNgbjbrXvucoUJFUJDXrr4IKnojZSA2LnSgsSWztYiPnhsFTs-SheBKCWY1HnMMY--aIr-Bs3UlEp-XbqVpcDnLQHJsNPDtoNAeGRBXAUWZ7Ikb3rE7HDJjTwqjBpTrTja7M56YNlYx-qde71e_0gxYxl3gNvZMpYTNVvY2PECWC8K6qCq9WZ3sKXM7rHyeD5JAeZp1cwqUKE7iXdLg8jjhmxb1TfcBuX5ZTGjLedDpA_FXOEIVUUTjH4_K3xfm-SYHc7JpEqPo-LuSKLw5nGAawA48Yvawx2V-e7wWhXjfA9TlANPAh3aNMbXwQxL5ezZzygW6NkuYThnoeg-V9fS9Ht_ELga7bbekDfmpv1Cuj2neVAtQLAZ4WKQbXRITNx-8cAztXReJqbEokWfN6ReX738UFjMEc0jIuvOM1jyCa5NeKNSTa2CHBbYvpvHqVEi8nGYqDX9NI69Frg2K5I79rjGLkZz25Mwpr_QbUodUCkXrckJ8iRoIqdPcH9bFcbz0SLUdRNvApmoMfERT-zmE8SEmOqsiFi0CAiSapKAbW56Lf2o9H46nMe_bbjnIGpV8VzKnMnRI3TnLdZqbIm_cB9s4BzEBmzon05t-wYOnHLqIagMgopiyvD4Kbq_m4wpBcBAyP1TWyEOeMTnbwtIkFMjbOu1jb-HKtrak_Q9Rabp7nRWcAvlc1pmB9Cc9x83LbAY9yobsEp76ADrGJsmnggkMoGNljRDPfMQmBCN-flZ9vAQfWV6nvB54maoTYZN8CH1xML7U-TaYCU3pD3vXPmGxI83NyVCtukVHwCrA3kQiL2h1bIpcmbrNzcz4YfC9Owd6ARGYDV6yxHOi8MB7hj1-qnquruHPbDx6azoBjFgy8oDsRuktVOIallswFGrJzPzhjpRI8oJ2srH9ViybmKoRBqOnyr6Ce0H-QfhuluAFb9gmeVqElFkmKT0MOXMDKN26dULZu3q8u8D0_sdJPZhXe1_MCvzU0Ct9vR6UuBNXW4Jhak5T0MnTVDsafA0dY5gBfC1a0xgm4fEv2DtH6ACSR8WpGD0cOvkRGMv_JRoETCp30_qYepNzAfOiawjnHEbbBM82EBZ8KqaEP1Vqf9aWbH4WuRjTkorm5i5pyKzlaT_CyyFrNpR0DSZAE9oSDi6g5G6eru8bX9231cTsN0njLvLwMlyQrnqIirn_4Qw16QkI-O7-VeDsQECjCP0bcJWIfXm7BMS26KTvsGiZZZq7Rv5iEVKMd8zs5a0Jx3LMoVYTdjcz8NIueJwJolcpxK1jZlEfWZS75d-M0BAvkcC38uvrjj5sYfdiR6dVbWhbFUoO-F86ywdPCjEPu2SRxaUx7RvZC9BG2BiDYSF4NyN69Clo0koygFtk_IaEchIMh6W-WViQ9WUkqJwoToNYaiL84v7WYxY9MiKlAHJlm5ZTu0LZozC613JhpB1O52RDahzrMG0J6ctuf5xYqaa8tnmDzWNP85eRfHrNPo1BNKdoGIeEIPgi3T-d4Ro4CXrVlnbA7o77D4wjpZHArqlJg-7HOEkoIFcQjqIvZDoScvi0fURIs_j5ZQupVuVSwBmKK1SRHi4cHIDpFLtSV06KFoV7mIH0h1HlWlBidA6jGLGXmKvHy4HM8Mrlxx-OSetsnxhehl395rkZQgNXuHvAdJxEypZcptnwZxr5Ty7BDtCyHgDUTIPh2flFyjQd9df56g2ItDcSVYDqurWSSeaHUaAJnrorTfy-rhnjuXGFX625-Byb3XmkUEmIEygOXv3LHIDY0zPXw3qx_IYr0Q12eHSfDlJRttI7_QYMd8S7QOa1IwBXHnUN1sC2ba3M_ZW5Cf4I71i6zDM1gMJpyxPYqPJGIkwDsjZ92mBSKpYfwcUrm3uVs4bb8DPtJY3EZM7J0Og6_79qGpsG1ZFMJmPT04BtqiAjZIyTG2t4AgsNIZ1zM9q0-mMM7PUjTIQ_QbMWJrNCzmYalpI7F0_6xxnkasLry5vkAQn6J_DbtKkahbY8uS60YHnvaDtpQKxOtKDenYZrV55kLastKe37L9mKRHuj5fjjMK9cXbTj1wz3Hyv1PcpHSWWnLmVytEVyHaYsDonQ21CUnuswdi5SIlaa-tgq_ZLyN3FfO-EFwu-zm40Y5luiANsomfU483nFxwl_lUdqHCr9DsHGpABLojgrisDj8dnG7N1mtTEp7JP2-lbeEYA7I41D9Mhoegjo02jxD3b3TxKYGNFVgbL4Gpxn70GI55GePObPVextBtqkX8QDVgYN6qHIfJba8IkOsFewOrK-qBUPqZ5UNjzWcsaYgi9UtSs54HAsdFRTWX5vZF_lL69nQR30lI_UeyOXq0bKrSBPb2-tIR-1UIkWOKDgh3eUJAX_EH87UJTXkeCZrSPqJ_lRK3MWWUhwLJx7HXqgSPgw6mte9rLsqRgiK0_QWVZa_Z36ROm3UkwQ3dvCimNaOHvuzvBVDOhE1OTDUm-xHl5NBOeiYqEx7tOo7pdEjQbIkdc9gQ1ZGsdTYuZ8XX9qIq_6V9ynWtn82g72puyz9o1UX4WVjLQ7-UyVMKUuK1TEzCNXNouDa7CwjhyQ7uDBSTHYUSBHOJWr9aosx68ZtOkyJfTsERQl8FcT7WZ5ZtRbfpE_a5E10R_OZF-vu6-oKmQ&cid=CAQSPADICaaNjsNGnHwFABRDqvt7BfYT1uHadUmwvq4kzvQu2qg19XL29evXnOmGzCWkroo1Assp4HHurOHnBBgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fmacleans.ca%2F&ds=l&xdt=1&iif=1&cor=2595873142407564300&adk=3944675600&idt=170&cac=0&dtd=93

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

1ac287252f7e8955fa6f7f683437518bee9aeaa06a98091d070355db466c3b25

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:05 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38576
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 2284 111 KB
39 KB 114ms
37ms Script
text/javascript 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
Origin: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 13:48:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 41670
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Oct 2023 13:48:36 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/ Frame 2284 11 KB
4 KB 35ms
35ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/omrhp.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 13:46:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41819
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 13:46:07 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/ Frame 2284 30 KB
11 KB 35ms
34ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/abg_lite.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

c75166534a7cf375f7963558a6a55858688f6c289c9d200706ce1592669ffe3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 13:33:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 42589
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11596
x-xss-protection: 0
server: cafe
etag: 6499730840814102677
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 13:33:17 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 2284 41 KB
14 KB 36ms
35ms Script
text/javascript 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:10:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 371558
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Oct 2024 18:10:28 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E53F 1 KB
643 B 35ms
35ms Document
text/html 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com
URL: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 41165
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 13:57:01 GMT
etag: 48472445140208031
expires: Tue, 17 Oct 2023 13:57:01 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 2284 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1905ba0cf8abf8175135dd5a914b0c5f71ed70039428d231c7243b1473d5bfd6

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E53F
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEF8tdCYfZtD5mtQ2UqMfxyc&google_cver=1&google_push=AXcoOmQm5cnEnHsO7bHWmlBYnda7flNm9Eyo5xmfl6ZJ1JfqFaUDRl0...
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=6556c742310c05a6&is_secure=true&networkId=14000&version=1&google_gid=CAESEF8tdCYfZtD5mtQ2UqMfxyc&google_cver=1&google_push=AXcoOmQm5cnE...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAACi5fwJX-d9wNelw2nAAAAAAA&expiration=1697592186&google_cver=1&is_secure=true&google_gid=CAESEF8tdCYfZtD5mtQ2UqMfx...

170 B
188 B

48ms
48ms

Image
image/png

172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAACi5fwJX-d9wNelw2nAAAAAAA&expiration=1697592186&google_cver=1&is_secure=true&google_gid=CAESEF8tdCYfZtD5mtQ2UqMfxyc&google_push=AXcoOmQm5cnEnHsO7bHWmlBYnda7flNm9Eyo5xmfl6ZJ1JfqFaUDRl0Hnu880zd5zAh4_4bCDXfT9cOi6fTPfhG0GShFkxyHR5w

Requested by

Host: 4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com
URL: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:06 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAACi5fwJX-d9wNelw2nAAAAAAA&expiration=1697592186&google_cver=1&is_secure=true&google_gid=CAESEF8tdCYfZtD5mtQ2UqMfxyc&google_push=AXcoOmQm5cnEnHsO7bHWmlBYnda7flNm9Eyo5xmfl6ZJ1JfqFaUDRl0Hnu880zd5zAh4_4bCDXfT9cOi6fTPfhG0GShFkxyHR5w
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E53F
Redirect Chain

https://aep.mxptint.net/sn.ashx?google_gid=CAESEPowy1ItGHrVfvue6lDaD50&google_cver=1&google_push=AXcoOmR_zmxqK0ul3lKhwgxobpy_qd6FcR4KbqB6I9DjVgAEMLTn2lf4sQ88VfAr7nXJLW7c9SgTtVy8_UpHSdc94AqbAHgzh-9A
https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AXcoOmR_zmxqK0ul3lKhwgxobpy_qd6FcR4KbqB6I9DjVgAEMLTn2lf4sQ88VfAr7nXJLW7c9SgTtVy8_UpHSdc94AqbAHgzh-9A&google_hm=UjMzNjQ1XzEwQUFC...

170 B
188 B

48ms
48ms

Image
image/png

172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AXcoOmR_zmxqK0ul3lKhwgxobpy_qd6FcR4KbqB6I9DjVgAEMLTn2lf4sQ88VfAr7nXJLW7c9SgTtVy8_UpHSdc94AqbAHgzh-9A&google_hm=UjMzNjQ1XzEwQUFCMTkyOF9EMjM0OUY2OQ%3D%3D

Requested by

Host: 4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com
URL: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AXcoOmR_zmxqK0ul3lKhwgxobpy_qd6FcR4KbqB6I9DjVgAEMLTn2lf4sQ88VfAr7nXJLW7c9SgTtVy8_UpHSdc94AqbAHgzh-9A&google_hm=UjMzNjQ1XzEwQUFCMTkyOF9EMjM0OUY2OQ%3D%3D
Date: Tue, 17 Oct 2023 01:23:06 GMT
Cache-Control: private
Strict-Transport-Security: max-age=-380510587; includeSubDomains
P3P: CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE", CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE"
Content-Length: 346
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E53F
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESEMSIWsCWmwJ3DOOOBtd_4o8&google_cver=1&google_push=AXcoOmSHM07KNQPEyDgxUKeHaN_WtGnDmIvNPeGh25nKrNa0HZ19Yb9l7-VB7nNkEvuo68rFIVJHi...
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmSHM07KNQPEyDgxUKeHaN_WtGnDmIvNPeGh25nKrNa0HZ19Yb9l7-VB7nNkEvuo68rFIVJHiJMiG-OIL-sk7mC1oqm8r8oU

170 B
188 B

48ms
48ms

Image
image/png

172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmSHM07KNQPEyDgxUKeHaN_WtGnDmIvNPeGh25nKrNa0HZ19Yb9l7-VB7nNkEvuo68rFIVJHiJMiG-OIL-sk7mC1oqm8r8oU

Requested by

Host: 4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com
URL: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 17 Oct 2023 01:23:06 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: A1E0859887E949778BB396CDC769DDF9 Ref B: YTO01EDGE0722 Ref C: 2023-10-17T01:23:07Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmSHM07KNQPEyDgxUKeHaN_WtGnDmIvNPeGh25nKrNa0HZ19Yb9l7-VB7nNkEvuo68rFIVJHiJMiG-OIL-sk7mC1oqm8r8oU
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYH311zL9X1ZNCZZ6PKEw==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E53F
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEINnzGkfh5ZVCyfy-6L_gaA&google_cver=1&google_push=AXcoOmTGZiBMV9A4iRXEe2m5UUaxHDcOkLv-hbOjj7VZ3EmthaOaU252IsJR2j0UfwXoQbkmu2wB13fI2QQvYoiI...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=dSYcuUx9SJQJgvZkYqHLDg&google_push=AXcoOmTGZiBMV9A4iRXEe2m5UUaxHDcOkLv-hbOjj7VZ3EmthaOaU252IsJR2j0UfwXoQbkmu2wB13fI2QQvYoiIaDEu54wRk_k

170 B
188 B

50ms
49ms

Image
image/png

172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=dSYcuUx9SJQJgvZkYqHLDg&google_push=AXcoOmTGZiBMV9A4iRXEe2m5UUaxHDcOkLv-hbOjj7VZ3EmthaOaU252IsJR2j0UfwXoQbkmu2wB13fI2QQvYoiIaDEu54wRk_k

Requested by

Host: 4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com
URL: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 17 Oct 2023 01:23:06 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=dSYcuUx9SJQJgvZkYqHLDg&google_push=AXcoOmTGZiBMV9A4iRXEe2m5UUaxHDcOkLv-hbOjj7VZ3EmthaOaU252IsJR2j0UfwXoQbkmu2wB13fI2QQvYoiIaDEu54wRk_k
x-host: tde-deliveryengine-production-69fbf984b9-nhbrb
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E53F
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEBhVyF5ha_UdadoXCrRWkAw&google_cver=1&google_push=AXcoOmQVKjsQrzZJLOs1Z9xriGLzmlN0k4YTiPkQTpJ0CrOIQL-nRcJNOX1DhY0JhvXuMOg2o6Ozdl2BtvY_VQwEV...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEBhVyF5ha_UdadoXCrRWkAw&google_cver=1&google_push=AXcoOmQVKjsQrzZJLOs1Z9xriGLzmlN0k4YTiPkQTpJ0CrOIQL-nRcJNOX1DhY0JhvXuMOg2o6Ozdl2BtvY_VQwEV...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmQVKjsQrzZJLOs1Z9xriGLzmlN0k4YTiPkQTpJ0CrOIQL-nRcJNOX1DhY0JhvXuMOg2o6Ozdl2BtvY_VQwEVAC_iK3e_ATC&google_hm=Hf5zhGZHiRv4LqNJTgaBpJjM

170 B
188 B

47ms
47ms

Image
image/png

172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmQVKjsQrzZJLOs1Z9xriGLzmlN0k4YTiPkQTpJ0CrOIQL-nRcJNOX1DhY0JhvXuMOg2o6Ozdl2BtvY_VQwEVAC_iK3e_ATC&google_hm=Hf5zhGZHiRv4LqNJTgaBpJjM

Requested by

Host: 4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com
URL: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 17 Oct 2023 01:23:06 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmQVKjsQrzZJLOs1Z9xriGLzmlN0k4YTiPkQTpJ0CrOIQL-nRcJNOX1DhY0JhvXuMOg2o6Ozdl2BtvY_VQwEVAC_iK3e_ATC&google_hm=Hf5zhGZHiRv4LqNJTgaBpJjM
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1dca1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E53F
Redirect Chain

https://b1sync.zemanta.com/usersync/googleopenbidding/?google_gid=CAESEJCe2s-mkcX0tLx9fkzdu-o&google_cver=1&google_push=AXcoOmS20Cr6TYraU-NkSr53i-vUEMhT0yZCT5gAO0eW7uQXxN01Yvt6yXEHUAENWJQ_9ttsFcLtW...
https://b1sync.zemanta.com/usersync/googleopenbidding/?google_cver=1&google_gid=CAESEJCe2s-mkcX0tLx9fkzdu-o&google_push=AXcoOmS20Cr6TYraU-NkSr53i-vUEMhT0yZCT5gAO0eW7uQXxN01Yvt6yXEHUAENWJQ_9ttsFcLtW...
https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=AXcoOmS20Cr6TYraU-NkSr53i-vUEMhT0yZCT5gAO0eW7uQXxN01Yvt6yXEHUAENWJQ_9ttsFcLtW5HPtRFH1rQ7pz5g5NWv6DwL&google_hm=ZVdTcEJjZjVQVlQy...

170 B
188 B

49ms
49ms

Image
image/png

172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=AXcoOmS20Cr6TYraU-NkSr53i-vUEMhT0yZCT5gAO0eW7uQXxN01Yvt6yXEHUAENWJQ_9ttsFcLtW5HPtRFH1rQ7pz5g5NWv6DwL&google_hm=ZVdTcEJjZjVQVlQyd0JHRFE4UHM=

Requested by

Host: 4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com
URL: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:08 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=AXcoOmS20Cr6TYraU-NkSr53i-vUEMhT0yZCT5gAO0eW7uQXxN01Yvt6yXEHUAENWJQ_9ttsFcLtW5HPtRFH1rQ7pz5g5NWv6DwL&google_hm=ZVdTcEJjZjVQVlQyd0JHRFE4UHM=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 240
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

report
sync.teads.tv/um/ Frame E53F
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEP3HD-2yWTqI...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=N2YzMDFhM2EtZTJkOS00NDI3LWJlZGQtNDY4YTFlNzE4MGZh&google_push=AXcoOmQah0To2tOR3fU2TsoPn000goWIp68aOO_oJmdNzhGaxIDPwwX3ZCov5WeGVuQhc...
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

45ms
44ms

Image
image/gif

23.60.1.46
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: 4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com
URL: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 23.60.1.46 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-1-46.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

expires: Tue, 17 Oct 2023 01:23:07 GMT
pragma: no-cache
date: Tue, 17 Oct 2023 01:23:07 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:07 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame E53F 0
12 B 45ms
44ms Image
text/html 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IikthlBAy0eVt5qFDV8gk-DN4BhXcrnr5aAfcc7h354eawdnAiBB8P4vOGWg_lN3IJKrNcgBQ

Requested by

Host: 4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com
URL: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:06 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 677B 22 KB
8 KB 36ms
36ms Document
text/html 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 370953
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 12 Oct 2023 18:20:33 GMT
expires: Fri, 11 Oct 2024 18:20:33 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 FvrbBlV_jFWbJeQ31HKG04hrbzYZAPR58b-SgZjo0Pc.js Show response
pagead2.googlesyndication.com/bg/ Frame 677B 37 KB
14 KB 36ms
35ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/FvrbBlV_jFWbJeQ31HKG04hrbzYZAPR58b-SgZjo0Pc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

sffe /

Resource Hash

16fadb06557f8c559b25e437d47286d3886b6f361900f479f1bf928198e8d0f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 13:30:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 301953
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14696
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 12 Oct 2024 13:30:33 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/ Frame 482F 7 KB
2 KB 107ms
36ms Document
text/html 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/index.html?ev=01_250

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

18d6da59018d8d9e7e638430f4101c6e0b497331e64b246d6f2a9860b781411f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 17025
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2314
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 20:39:21 GMT
expires: Tue, 15 Oct 2024 20:39:21 GMT
last-modified: Thu, 13 Jul 2023 15:30:11 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2284 0
0 108ms
103ms Fetch
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuNfz7n4KrDlctsmjjn9dN6gS1rIkr7YCGPJdXlfgb9cMj01WKz7qb8-ETvg6vg9OyubAszhmDXOrW5rPot3u31DrNHUFil_USFboEClMz6DXJaCna65a0Up4_-ztxL2ykLKHmZL30Ac6fCUGugC1ROFnGS2GpFQ_L6BCMsb9kjTaUETe_bnqys26-giLiobXmtR2dqOlj3pl5tS18sQT70iplLEQKu_-q2pr1jfR4IwlkzfAHAB-veaFLve10dgSg5kwMHXesGJtmN312F9oGETkQSv1PPKD05r7BMQhF5Hw5Y9Q2saYmJlGiIs7Af_4srvPkrG54pMVWnet3DMR7abLhbAAfOF3YNjWKKillKSi2586Zs8YNtXBLM59506b971hJMb6Ar74D5XPomJsBUaPJ8Aw2loSIyPdERhZjeu186PWSEgK5UOS2TA6yY3vvAOoJXRP3T34T44oIOLFxpsmb9bcUhAcLMSMzBejB5Z_02rImmPjTn7zjBYw-N2LPqDVmlSoUx0zdNwdTEfy2Zm54grWSxO0cH5l1LjH6p0U6xlrbh33Ie29Kivy4gqMpWvn1D7hDsTLjdLzYTL9Dp5NqCkg2wveytiZ8YnM8-y4Z8SUwjT2Ej5sVLlo6dXy0AqjiQ2YdePFvbzvjdO1OkxjACSMerOMx_6WK58nypPFLkwlFPw4pTD2QYxc_UbW8Fu0jNw3nFPQnPcZAoJPJvOm9JRtRtLit_RHCRz0Epm-3KcC4-C-5zlgjsEXvojhnDitT5YqG18eQpWSHRA8JVcdQBmNJTHHXWO70noggwRw96dCvtFpIYgxJlvO2pizZYVFh52p-5opTco8M8r9saVt92jB-uN6vkYrHDii8m1Jw5g3SgpY-QwgXFNHTf14XEjm9liiIAEENbMmZJLj2kBUkBTGkwEdBZbi1P0Ny00R-_mNiyf6rz42YzCA19jx1mJ_RdmIrcWsOqvb3lKWT7O92k-no2dS8mabXwhuuXlN6yMl4ZcTRII9URDbFPbmF_xheS-llfVsCNXkhQLMVU5goZO3mFt7IdDMoCkPGHvhWkt_c2wVfK16ZX0FdU0ouDenndVBLo0EgwMA3Y5zuQwroEjjjjY-38S9PohS1MLoXMvYYDIkPZePvReSjG_Y9Lm0uHoHCxDPWsGecLQbFsExqwlMJDR4mgs2D5_cdX8pX4cARWU5UyDL0KaCJUkgpGSG2vSCpNqIGVO2AK9cSMkCuEERnzCaiSTm4QwEEF5GFey2UkVF4Hykdbd5HzXNtrgCV03ZazFA593URTLYNKgBs2Sv59cpo_XsYdRDLyt7Y98JsKF3k2MUOlO1TDKZzNoKKmcXetApgUlw4pcrGi8L4Xmuk4m6GEbw0E8vkxM8PMkTI6pF4Zr8LJM7U1tGaNne51Dje_CywuDBMPv2VQbwfdr7oYkOuyc4hG5PJ3IzmL_lc&sai=AMfl-YTFgvd1qPSuhkpsY6Ohc_GLewRxzcFFEDaU9YlPgdJsaCo4DRecCdNdoboli1huVVQ4ltxSR2ISJwbgCnEb56M4jwtRLcnjsFXZ4NxbN5V4O1yumuaLWXGRKgC9anE7TOMynsZMa0mgsvKzY7vx0TYCIUoo1mVQuo-_DK9M1DVI8wdozON4H2tFC1dO62hBwFY2YUWiOec8c781_rs833nlj3pQDzHsX_4FJRBc8ruufGtim4lofuhI-sAnaS6Ylgvxah8&sig=Cg0ArKJSzCwfnqPolrUDEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=164&cbvp=1&cstd=152&cisv=r20231011.20495&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 17 Oct 2023 01:23:06 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 30A7 43 B
479 B 44ms
43ms Image
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=Hf5zbPZHfawiHPRWTgiLYuVO&ex=sovrn.com&gdpr=0&gdpr_consent=

Requested by

Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:06 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: SRYV86N88NE49ZD9MNJW
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 30A7
Redirect Chain

https://ums.acuityplatform.com/tum?umid=27&uid=Hf5zbPZHfawiHPRWTgiLYuVO&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=66&3pid=841381824345

43 B
1 KB

33ms
32ms

Image
image/gif

23.92.190.69
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=66&3pid=841381824345
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.69 Houston, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:06 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3ewr1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Access-Control-Allow-Origin: *
Location: https://ce.lijit.com/merge?pid=66&3pid=841381824345
Content-Length: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 30A7
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D92%263pid%3D%24UID&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=92&3pid=6242155078849264757&gdpr=0&gdpr_consent=

43 B
858 B

33ms
32ms

Image
image/gif

23.92.190.69
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=92&3pid=6242155078849264757&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.69 Houston, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:06 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3ewr1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:06 GMT
an-x-request-uuid: 848799b0-8f59-4175-ba70-b1edcd01a9bf
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://ce.lijit.com/merge?pid=92&3pid=6242155078849264757&gdpr=0&gdpr_consent=
x-proxy-origin: 86.48.15.34; 86.48.15.34; 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 30A7
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=sovrn&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=80&3pid=LNTN47OR-16-1IVP&gdpr=0

43 B
1 KB

33ms
33ms

Image
image/gif

23.92.190.69
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=80&3pid=LNTN47OR-16-1IVP&gdpr=0
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.69 Houston, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:06 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3ewr1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ce.lijit.com/merge?pid=80&3pid=LNTN47OR-16-1IVP&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 8bab65602db075726861004da5629947
Expires: 0

GET
H2 204 sovrn
tr.blismedia.com/v1/api/sync/ Frame 30A7 0
173 B 328ms
39ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/sovrn?gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:06 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 30A7
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=sovrn&gdpr=0&gdpr_consent=
https://sync.1rx.io/usersync2/rmpssp?sub=sovrn&zcc=1&cb=1697505787353
https://ad.turn.com/r/cs?pid=45&rndcb=978373977
https://sync.1rx.io/usersync/turn/7059221617362624609?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-8b2ab8de-8bbf-466c-add0-06dafd7cd3b1-005?redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D97%263pid%3DRX-8b2ab8de-8bbf-466c-add0-06dafd7cd3b1-005
https://ce.lijit.com/merge?pid=97&3pid=RX-8b2ab8de-8bbf-466c-add0-06dafd7cd3b1-005

43 B
1 KB

34ms
34ms

Image
image/gif

23.92.190.69
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=97&3pid=RX-8b2ab8de-8bbf-466c-add0-06dafd7cd3b1-005
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.69 Houston, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:09 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3ewr1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Date: Tue, 17 Oct 2023 01:23:09 GMT
Server: Tengine
ETag: RX8b2ab8de8bbf466cadd006dafd7cd3b1005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://ce.lijit.com/merge?pid=97&3pid=RX-8b2ab8de-8bbf-466c-add0-06dafd7cd3b1-005
Content-Type: text/html
Connection: keep-alive

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.1.1/ Frame 482F 56 KB
21 KB 29ms
28ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.1.1/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

732117ac92a33b760d9290a33f1541762ee9449dc417ea249b5a0df50738ad16

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 8436847
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 20728
last-modified: Mon, 04 May 2020 16:10:25 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e71-e1e2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=by9%2Fz6PBz3Li0V%2BgKScau3fasKlSf4nwaJJ8bpGjUCGJGvPmVNSqrQcEeoi80Ot%2BynNQfn7m%2BNaxzX%2BTJw5gQKcd%2FCGvEPSiOR0ZVSoiKEGKO9kcpFJIfw%2FXA86y7Q26fGfumdB7"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8174bbfc791ba1f6-YYZ
expires: Sun, 06 Oct 2024 01:23:06 GMT

GET
H3 200 bg1.jpg
s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/images/ Frame 482F 89 KB
89 KB 37ms
36ms Image
image/jpeg 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/images/bg1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

4556e7ac207a21a2955aef46f86844c6d35763bcbada3fe5d807ee39d8e9e801

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 20:39:21 GMT
x-content-type-options: nosniff
age: 17025
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 91257
x-xss-protection: 0
last-modified: Thu, 13 Jul 2023 15:30:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 15 Oct 2024 20:39:21 GMT

GET
H3 200 bg2.jpg
s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/images/ Frame 482F 60 KB
60 KB 53ms
52ms Image
image/jpeg 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/images/bg2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

b42302174746c5a2bed6fe521587049c2906c70e85ecc0ed8640c5d87184c842

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 20:39:21 GMT
x-content-type-options: nosniff
age: 17025
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61331
x-xss-protection: 0
last-modified: Thu, 13 Jul 2023 15:30:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 15 Oct 2024 20:39:21 GMT

GET
H3 200 bg3.jpg
s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/images/ Frame 482F 104 KB
104 KB 49ms
49ms Image
image/jpeg 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/images/bg3.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

62f12a2915fb293499dbdd358761f36898481a4c2cf3d83ee7e8e87d7a287687

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 20:39:21 GMT
x-content-type-options: nosniff
age: 17025
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106881
x-xss-protection: 0
last-modified: Thu, 13 Jul 2023 15:30:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 15 Oct 2024 20:39:21 GMT

GET
H3 200 bg4.jpg
s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/images/ Frame 482F 56 KB
56 KB 65ms
64ms Image
image/jpeg 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/images/bg4.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

5664b0381f0f4f767609603b19a0b397f1f6c32fae688d8b5f4c345f19e20d4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 20:39:21 GMT
x-content-type-options: nosniff
age: 17025
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57021
x-xss-protection: 0
last-modified: Thu, 13 Jul 2023 15:30:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 15 Oct 2024 20:39:21 GMT

GET
H3 200 bg5.jpg
s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/images/ Frame 482F 94 KB
95 KB 61ms
60ms Image
image/jpeg 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/images/bg5.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

f28f970a6692700aa96cb9c6c78416f3ea6ecff1e7d3d78ac2fc04512fb1143f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6244944716104710179/K3121_Telluride_MF_970x250_EN/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 20:39:21 GMT
x-content-type-options: nosniff
age: 17025
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 96747
x-xss-protection: 0
last-modified: Thu, 13 Jul 2023 15:30:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 15 Oct 2024 20:39:21 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 43ms
43ms Ping
text/plain 142.251.111.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-PSNJJL83JG&gtm=45je3ab0&_p=1249529835&cid=1994954187.1697505781&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=2&sid=1697505781&sct=1&seg=0&dl=https%3A%2F%2Fmacleans.ca%2F&dt=Macleans.ca%20-%20Canada%E2%80%99s%20magazine&en=get_user_data&ep.content_name=content%20name%20not%20available&ep.author_name=author%20name%20not%20available&ep.cms_id=cms%20id%20not%20available&ep.href=https%3A%2F%2Fmacleans.ca%2F&ep.brand=Macleans&_et=22&up.client_id=1994954187.1697505781.
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-PSNJJL83JG&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.111.102 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bk-in-f102.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://macleans.ca
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 677B 0
20 B 94ms
94ms Image
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BdGAe-eEtZc-0OurRoPwPr4OFgAQAAAAAOAHgBAI&bg=!OjmlOXbNAAYMG8UMLBs7ADQBe5WfOF6LEqD0qoPqCwOwQ_nn2hGF-OIKmfrKVm7g9OPz-MqRlsIK0G-sVKB4RK9o0VkqAgAAAEZSAAAACGgBB5kC_IfJVG5gid9SygL3eagauuUVrZLYe0GI94qjd_f9V8nHAeysEpcSTfbVzGij43s7jsmFUsUMN21_-hvrg6ZjDkdj28cRnj-4oIui8Gen6q4mseODUO6epWKqXL80_evBLJumb_7whLuzi-iY10Gv4vQmXe5pG3LernZJABUDEHtJttjBZe-7t-NKS1J94T297tXq6J6TqRr5w8Owo0VOvNGGnx8JIpbpG6adXU7rC3VcwHLzaGRsSe_kmsY8w0otTzg0zSUBCYs4lOdR7rp1mfDFhPAUmQEZh-s4GVyFddK9QepxywaS7u82T0qvVFnkzq556Zp1qjWuhixzioNbjMvGxaYizctOmIgqx4gsA6QyGlQQilpb1RwgfYC7rEOO169IBVdQQvZ2MlqkFp_Rku3o9Vbz9dw5Nq6j7vteR0vQDYAFCZGosv7_53pFivD8T35pPaFbs_FBzPlCq4bTnG_VVz-vt6tDqy0KbpTAEl23xnb6Ia9Dir9LguHQgEmUnKB5jFaWLRxtVteb6Wl_eq7QgU27u7qUnKIgJsg6eLCo7U4JGWC9FlAeJvqIssJpnPqALTev0m8FyHkqUqpNVHQSgYv1ZuicrAVmtwgVxEZP0K4dQAOXqg1B5cg9Mnk4Na1Tx8CBYPni4BDKQakRZvkjRuFbB_tZ-ZuC0CHSU3gOmX1jDW9ly37GjHW1CHUHotDpP6KeeHo16DrqRhNkfsUr0RjPM9Uyj2g5-xIaiVbZ5chN5SYTlThlOcmN9CEQWNF2xvrYDQ4-WnLAE44_8akgLtVB7C_QTpNWrVBGR_8Tki-HmpUYhmsprTGrNzMZRSDXIdVy_5zetWcgTkfg1A4ikhp5EN8Z4ZVIQJ2aE7qP6XuTmXbtBYcGlNbkBIph-C9KkEN3NP99pcjdRNYlyJ5wZM798LwbcOnQsLZNiBUz7Dp8wvx9lchsBG3iJJmyVwoBl6EXP5f1-C_JQDM4sMJ7oyD7QYykPJNEwPufrVqBuJ1Asz64pz0fspwl

Requested by

Host: 4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com
URL: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 slideshowintad Show response
fundingchoicesmessages.google.com/f/AGSKWxWHcmK2HqOynl-937LCMxAR8yQJBcaSHhzn1thoOtrZFpOSURD-1IxjdauaW4BXZeopJS4gefK1vAsyVoqFwm_SeRJ8xvA3F9C2znxcN8WxuW190PDWiCpRBgYbNuD5QpVJ0s991wORhMpbblDXEnE1yOaI0... 54 B
109 B 56ms
55ms Script
application/javascript 172.253.115.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWHcmK2HqOynl-937LCMxAR8yQJBcaSHhzn1thoOtrZFpOSURD-1IxjdauaW4BXZeopJS4gefK1vAsyVoqFwm_SeRJ8xvA3F9C2znxcN8WxuW190PDWiCpRBgYbNuD5QpVJ0s991wORhMpbblDXEnE1yOaI09rxAqDvp_zNRNo8NO63UDhWAwp3jNG_/_/Disable%2BAdblock./msgads./slideshowintad?/compiled/ads-/video-ads-player.

Requested by

Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f113.1e100.net

Software

ESF /

Resource Hash

fd440a9b7a7346da2f42db953f73e67f147041b0f56c07a0b143368243eb8b6c

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-NlWjIw_j1YiAGDpX8xglRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:06 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-NlWjIw_j1YiAGDpX8xglRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 lidar.js Show response
pagead2.googlesyndication.com/pagead/js/ 84 KB
30 KB 37ms
36ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/lidar.js?fcd=true

Requested by

Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

c7e5fe828286e27fec246482197421480446ed9ea3e084eb58ae1131195431c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 00:53:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1757
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30409
x-xss-protection: 0
server: cafe
etag: 13050188084380071190
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 17 Oct 2023 01:53:49 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWRnrz_Z4EKzx0-8YCKJsa8ttnmG8TyFm79TzLsOUUlGhbs9H7Mj2eZgespGNzmuIsTq3EVCk6gU0MyFuMTnpMVNsI4GjE2nHLmxFLQWDrRbiDr8AoS-Qa1HmcZZJ5J40EIL0Qo2g==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f113.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-3b3gSRpViHZgvImSwLG0Jw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://macleans.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 17 Oct 2023 01:23:06 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-3b3gSRpViHZgvImSwLG0Jw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://macleans.ca
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2284 0
0 95ms
95ms Fetch
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuNfz7n4KrDlctsmjjn9dN6gS1rIkr7YCGPJdXlfgb9cMj01WKz7qb8-ETvg6vg9OyubAszhmDXOrW5rPot3u31DrNHUFil_USFboEClMz6DXJaCna65a0Up4_-ztxL2ykLKHmZL30Ac6fCUGugC1ROFnGS2GpFQ_L6BCMsb9kjTaUETe_bnqys26-giLiobXmtR2dqOlj3pl5tS18sQT70iplLEQKu_-q2pr1jfR4IwlkzfAHAB-veaFLve10dgSg5kwMHXesGJtmN312F9oGETkQSv1PPKD05r7BMQhF5Hw5Y9Q2saYmJlGiIs7Af_4srvPkrG54pMVWnet3DMR7abLhbAAfOF3YNjWKKillKSi2586Zs8YNtXBLM59506b971hJMb6Ar74D5XPomJsBUaPJ8Aw2loSIyPdERhZjeu186PWSEgK5UOS2TA6yY3vvAOoJXRP3T34T44oIOLFxpsmb9bcUhAcLMSMzBejB5Z_02rImmPjTn7zjBYw-N2LPqDVmlSoUx0zdNwdTEfy2Zm54grWSxO0cH5l1LjH6p0U6xlrbh33Ie29Kivy4gqMpWvn1D7hDsTLjdLzYTL9Dp5NqCkg2wveytiZ8YnM8-y4Z8SUwjT2Ej5sVLlo6dXy0AqjiQ2YdePFvbzvjdO1OkxjACSMerOMx_6WK58nypPFLkwlFPw4pTD2QYxc_UbW8Fu0jNw3nFPQnPcZAoJPJvOm9JRtRtLit_RHCRz0Epm-3KcC4-C-5zlgjsEXvojhnDitT5YqG18eQpWSHRA8JVcdQBmNJTHHXWO70noggwRw96dCvtFpIYgxJlvO2pizZYVFh52p-5opTco8M8r9saVt92jB-uN6vkYrHDii8m1Jw5g3SgpY-QwgXFNHTf14XEjm9liiIAEENbMmZJLj2kBUkBTGkwEdBZbi1P0Ny00R-_mNiyf6rz42YzCA19jx1mJ_RdmIrcWsOqvb3lKWT7O92k-no2dS8mabXwhuuXlN6yMl4ZcTRII9URDbFPbmF_xheS-llfVsCNXkhQLMVU5goZO3mFt7IdDMoCkPGHvhWkt_c2wVfK16ZX0FdU0ouDenndVBLo0EgwMA3Y5zuQwroEjjjjY-38S9PohS1MLoXMvYYDIkPZePvReSjG_Y9Lm0uHoHCxDPWsGecLQbFsExqwlMJDR4mgs2D5_cdX8pX4cARWU5UyDL0KaCJUkgpGSG2vSCpNqIGVO2AK9cSMkCuEERnzCaiSTm4QwEEF5GFey2UkVF4Hykdbd5HzXNtrgCV03ZazFA593URTLYNKgBs2Sv59cpo_XsYdRDLyt7Y98JsKF3k2MUOlO1TDKZzNoKKmcXetApgUlw4pcrGi8L4Xmuk4m6GEbw0E8vkxM8PMkTI6pF4Zr8LJM7U1tGaNne51Dje_CywuDBMPv2VQbwfdr7oYkOuyc4hG5PJ3IzmL_lc&sai=AMfl-YTFgvd1qPSuhkpsY6Ohc_GLewRxzcFFEDaU9YlPgdJsaCo4DRecCdNdoboli1huVVQ4ltxSR2ISJwbgCnEb56M4jwtRLcnjsFXZ4NxbN5V4O1yumuaLWXGRKgC9anE7TOMynsZMa0mgsvKzY7vx0TYCIUoo1mVQuo-_DK9M1DVI8wdozON4H2tFC1dO62hBwFY2YUWiOec8c781_rs833nlj3pQDzHsX_4FJRBc8ruufGtim4lofuhI-sAnaS6Ylgvxah8&sig=Cg0ArKJSzCwfnqPolrUDEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=448&vt=11&dtpt=284&dett=3&cstd=152&cisv=r20231011.20495&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:06 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWRnrz_Z4EKzx0-8YCKJsa8ttnmG8TyFm79TzLsOUUlGhbs9H7Mj2eZgespGNzmuIsTq3EVCk6gU0MyFuMTnpMVNsI4GjE2nHLmxFLQWDrRbiDr8AoS-Qa1HmcZZJ5J40EIL0Qo2g==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f113.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-OdBtqOb7x2WS3fQzSMMKOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://macleans.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 17 Oct 2023 01:23:06 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-OdBtqOb7x2WS3fQzSMMKOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://macleans.ca
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWRnrz_Z4EKzx0-8YCKJsa8ttnmG8TyFm79TzLsOUUlGhbs9H7Mj2eZgespGNzmuIsTq3EVCk6gU0MyFuMTnpMVNsI4GjE2nHLmxFLQWDrRbiDr8AoS-Qa1HmcZZJ5J40EIL0Qo2g==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f113.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-CZs5wcPosQDKoQMnZwmE2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://macleans.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 17 Oct 2023 01:23:06 GMT
content-security-policy: script-src 'report-sample' 'nonce-CZs5wcPosQDKoQMnZwmE2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://macleans.ca
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWRnrz_Z4EKzx0-8YCKJsa8ttnmG8TyFm79TzLsOUUlGhbs9H7Mj2eZgespGNzmuIsTq3EVCk6gU0MyFuMTnpMVNsI4GjE2nHLmxFLQWDrRbiDr8AoS-Qa1HmcZZJ5J40EIL0Qo2g==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f113.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-TgQmFc2so3pPJFuPAJqx9g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://macleans.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 17 Oct 2023 01:23:06 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-TgQmFc2so3pPJFuPAJqx9g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://macleans.ca
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxWgY7Rd3kOfp92T-_SzvWmlG5E4tFz5IAS9MrFq95HUHYAkWdsyfTGgy-JFphi4Cuid86YzCAIgWidGWzfnMpruUah2W1YemIru9PAJouPj6eH5YTed5QkRGuZVk8_d5EQgVTJ3iQ== Show response
fundingchoicesmessages.google.com/f/ 4 KB
2 KB 67ms
67ms Script
application/javascript 172.253.115.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWgY7Rd3kOfp92T-_SzvWmlG5E4tFz5IAS9MrFq95HUHYAkWdsyfTGgy-JFphi4Cuid86YzCAIgWidGWzfnMpruUah2W1YemIru9PAJouPj6eH5YTed5QkRGuZVk8_d5EQgVTJ3iQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk3NTA1Nzg2LDUxNTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vbWFjbGVhbnMuY2EvIixudWxsLFtbOCwiMWowZXNOdTBSV0EiXSxbOSwiZW4tVVMiXSxbMTksIjIiXV1d

Requested by

Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f113.1e100.net

Software

ESF /

Resource Hash

5d4c4d921229428739779ecd4f3b675102d57929c4a748cff50c102074b6fd7f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce--gs-zKFrKEnfHkhJlKCiuA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:06 GMT
content-security-policy: script-src 'report-sample' 'nonce--gs-zKFrKEnfHkhJlKCiuA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxUwI_6uxZInJlKV7lUo1RdnxhJwT-EltZejYdVGZMSyyQIBY4OLbQqy6tl4EvdHv-SILTfQRjui6Pu3-8ezqyzudhr2-fHvlSZBrXjPXhWGtKlJjhEHbw7TL-_Q1Gmt2AgCDsqQjQ== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 66ms
66ms Script
application/javascript 172.253.115.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUwI_6uxZInJlKV7lUo1RdnxhJwT-EltZejYdVGZMSyyQIBY4OLbQqy6tl4EvdHv-SILTfQRjui6Pu3-8ezqyzudhr2-fHvlSZBrXjPXhWGtKlJjhEHbw7TL-_Q1Gmt2AgCDsqQjQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk3NTA1Nzg2LDU4NjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vbWFjbGVhbnMuY2EvIixudWxsLFtbOCwiMWowZXNOdTBSV0EiXSxbOSwiZW4tVVMiXSxbMTksIjIiXV1d

Requested by

Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f113.1e100.net

Software

ESF /

Resource Hash

b186e56166aa6a8f8e9047574baa1345a23a43bae8fb5153d58af4d2a863cffb

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-JMDnwr6YaDkAZgxACt3Mkg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:06 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-JMDnwr6YaDkAZgxACt3Mkg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame C41F 43 B
479 B 41ms
41ms Image
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=sharethrough.com&id=b2e17537-64dd-45c3-beb6-16e2d7e1628f

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:06 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 49DJ7NXNNVMK99SPTHFM
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame C41F
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=515cf6f8-7a1d-44a8-9545-d02c6c07e305&gdpr=0&gdpr_consent=

68 B
279 B

35ms
35ms

Image
image/png

54.236.119.39
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=515cf6f8-7a1d-44a8-9545-d02c6c07e305&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 54.236.119.39 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-236-119-39.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:07 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=515cf6f8-7a1d-44a8-9545-d02c6c07e305&gdpr=0&gdpr_consent=
date: Tue, 17 Oct 2023 01:23:07 GMT
server: Kestrel
content-length: 323

GET
H2

200

v1
match.sharethrough.com/sync/ Frame C41F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&gdpr=0&gdpr_consent=&google_hm=YjJlMTc1MzctNjRkZC00NWMzLWJlYjYtMTZlMmQ3ZTE2Mjhm
https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=

68 B
279 B

35ms
34ms

Image
image/png

54.236.119.39
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 54.236.119.39 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-236-119-39.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:06 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:06 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame C41F 43 B
363 B 1104ms
33ms Image
image/gif 74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=41&p=244&cp=sharethrough&cu=1&gdpr=0&gdpr_consent=&us_privacy=&url=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D7658cb1d77a660882b48db06%26source_user_id%3D%40%40CRITEO_USERID%40%40

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:07 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 204253
expires: Tue, 17 Oct 2023 00:00:00 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame C41F
Redirect Chain

https://x.bidswitch.net/sync?ssp=sharethrough&user_id=b2e17537-64dd-45c3-beb6-16e2d7e1628f&gdpr=0&gdpr_consent=&gdpr_pd=1&us_privacy=&expires=365
https://x.bidswitch.net/ul_cb/sync?ssp=sharethrough&user_id=b2e17537-64dd-45c3-beb6-16e2d7e1628f&gdpr=0&gdpr_consent=&gdpr_pd=1&us_privacy=&expires=365
https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=sharethrough
https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=sharethrough
https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=77cb5f25-0fd3-4147-81b7-53267282a3b7&ssp=sharethrough
https://match.sharethrough.com/sync/v1?source_id=bf2b131f1f7eff9d8892972c&source_user_id=c72b9298-307f-4008-a9c3-a7e8f18dd304&seat_user_id=&seat_key=&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

68 B
279 B

35ms
34ms

Image
image/png

54.236.119.39
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=bf2b131f1f7eff9d8892972c&source_user_id=c72b9298-307f-4008-a9c3-a7e8f18dd304&seat_user_id=&seat_key=&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 54.236.119.39 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-236-119-39.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:08 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Location: //match.sharethrough.com/sync/v1?source_id=bf2b131f1f7eff9d8892972c&source_user_id=c72b9298-307f-4008-a9c3-a7e8f18dd304&seat_user_id=&seat_key=&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Date: Tue, 17 Oct 2023 01:23:08 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

POST
H/1.1 200
OK attention-event Show response
sr.studiostack.com/track/ 0
396 B 34ms
34ms XHR
text/plain 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-event
Requested by: Host: sr.studiostack.com
URL: https://sr.studiostack.com/v3/services
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://macleans.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

Expires: 0
Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:06 GMT
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 0
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

OPTIONS
H/1.1 200
OK attention-event
sr.studiostack.com/track/ Frame 0
0 72ms
72ms Preflight
text/html 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-event
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://macleans.ca
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Access-Control-Allow-Origin: *
Allow: POST
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 4
Content-Type: text/html; charset=utf-8
Date: Tue, 17 Oct 2023 01:23:06 GMT
ETag: W/"4-Yf+Bwwqjx254r+pisuO9HfpJ6FQ"
Expires: 0
Pragma: no-cache
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

GET
H3 200 AGSKWxVGiyfcy3Ru9pganxQuTPrf3oGh05ZJpZRNkEim_tU8zVVaJsim8OLpySVewvQ3oybQmW72W8q8sRgK9QICIVCyV8UE1gTxKdbNCKjtjfRNsBR2xK8A2fZiJhuiGMqvNcj9wM23Jg== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 70ms
70ms Script
application/javascript 172.253.115.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVGiyfcy3Ru9pganxQuTPrf3oGh05ZJpZRNkEim_tU8zVVaJsim8OLpySVewvQ3oybQmW72W8q8sRgK9QICIVCyV8UE1gTxKdbNCKjtjfRNsBR2xK8A2fZiJhuiGMqvNcj9wM23Jg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk3NTA1Nzg2LDY1NzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMCw5XSxudWxsLDIsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9tYWNsZWFucy5jYS8iLG51bGwsW1s4LCIxajBlc051MFJXQSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdXV0

Requested by

Host: output-to-go.mblycdn.com
URL: https://output-to-go.mblycdn.com/bundles/macleans.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f113.1e100.net

Software

ESF /

Resource Hash

1bfd1d5158c8a0e02b2631da167c8d99c4c99f641ac87b8803c12a13363fb3f4

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-tIn8ToPNxCiRGsaZmM422w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://macleans.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:06 GMT
content-security-policy: script-src 'report-sample' 'nonce-tIn8ToPNxCiRGsaZmM422w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxU1Tjgd4yeK4IJqmr_xVNZikcJbJXA97d9K-6sg_DNiDQMCDiOCtXsrRUJHAZIoZsdWckdj2fGiIp31UXY0J1yGq-ybxCbAghEoEy7q6lwtse7Nbdbk06mJI9hzYFzNZzrTSl7G5Q== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 53ms
53ms XHR
text/html 172.253.115.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU1Tjgd4yeK4IJqmr_xVNZikcJbJXA97d9K-6sg_DNiDQMCDiOCtXsrRUJHAZIoZsdWckdj2fGiIp31UXY0J1yGq-ybxCbAghEoEy7q6lwtse7Nbdbk06mJI9hzYFzNZzrTSl7G5Q==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f113.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-HC-jNRwduxLoSzYI66XZpw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://macleans.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 17 Oct 2023 01:23:06 GMT
content-security-policy: script-src 'report-sample' 'nonce-HC-jNRwduxLoSzYI66XZpw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://macleans.ca
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 4144 2 KB
2 KB 105ms
32ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=69246366&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: c4b62559f01d81ebb702d493221a2384e71137d17f13c7930d0b1aff0e25273b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 17 Oct 2023 01:23:08 GMT
content-length: 1736
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK dcm Show response
s.amazon-adsystem.com/ Frame ED0E 43 B
855 B 47ms
47ms Document
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 17 Oct 2023 01:23:08 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: SWTDDMZXWMNDYVQX7ZAH

GET
H/1.1 200
OK ecm3 Show response
s.amazon-adsystem.com/ Frame EC3E 43 B
479 B 43ms
41ms Document
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UID27BB6CF6-5140-48B1-B11E-5A8F2CB00133

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 17 Oct 2023 01:23:08 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: 9KZRYHCMHDKHYH5HMXYF

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 4144
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=J7ts9lFASLGxHlqPLLABMw%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

15 KB
15 KB

67ms
66ms

Image
text/html

23.215.40.199
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 23.215.40.199 McAllen, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-215-40-199.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:08 GMT
content-encoding: gzip
last-modified: Fri, 01 Sep 2023 11:18:33 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=83515
accept-ranges: bytes
content-length: 5606
expires: Wed, 18 Oct 2023 00:35:03 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:08 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 4144
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=27BB6CF6-5140-48B1-B11E-5A8F2CB00133
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3371&partner_device_id=27BB6CF6-5140-48B1-B11E-5A8F2CB00133
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=70bae9d2-7c7b-455d-af26-b175e85ff634%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=515cf6f8-7a1d-44a8-9545-d02c6c07e305&ttd_puid=70bae9d2-7c7b-455d-af26-b175e85ff634%2C%2C

95 B
124 B

53ms
53ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=515cf6f8-7a1d-44a8-9545-d02c6c07e305&ttd_puid=70bae9d2-7c7b-455d-af26-b175e85ff634%2C%2C

Requested by

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:08 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=515cf6f8-7a1d-44a8-9545-d02c6c07e305&ttd_puid=70bae9d2-7c7b-455d-af26-b175e85ff634%2C%2C
date: Tue, 17 Oct 2023 01:23:08 GMT
server: Kestrel
content-length: 359

GET
H2 403 FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3A...
us01.z.antigena.com/l/ Frame 4144 0
0 1120ms
34ms Image
text/html 40.76.134.238
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us01.z.antigena.com/l/FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3AWUAJgUx%2027BB6CF6-5140-48B1-B11E-5A8F2CB00133&rnd=RND
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 40.76.134.238 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H2 200 xuid
eb2.3lift.com/ Frame 4144 37 B
354 B 43ms
40ms Image
image/gif 52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7976&xuid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&dongle=u6nf&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 17 Oct 2023 01:23:08 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 4144
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MjdCQjZDRjYtNTE0MC00OEIxLUIxMUUtNUE4RjJDQjAwMTMz&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
95 B

1244ms
84ms

Image
image/gif

104.36.113.107
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 17 Oct 2023 01:23:09 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:08 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 4144
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEGZln6iKds2q9w1-h9z7Qlk&google_cver=1

42 B
346 B

1242ms
83ms

Image
image/gif

104.36.113.107
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEGZln6iKds2q9w1-h9z7Qlk&google_cver=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 17 Oct 2023 01:23:08 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:08 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEGZln6iKds2q9w1-h9z7Qlk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 4144
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:3297F192560D4730894264FA0DD2E476

42 B
513 B

1255ms
81ms

Image
image/gif

104.36.113.107
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:3297F192560D4730894264FA0DD2E476
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 17 Oct 2023 01:23:09 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Tue, 17 Oct 2023 01:23:08 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:3297F192560D4730894264FA0DD2E476
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Mon, 16 Oct 2023 01:23:08 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 4144
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=515cf6f8-7a1d-44a8-9545-d02c6c07e305&gdpr=0&gdpr_consent=

42 B
542 B

1508ms
82ms

Image
image/gif

104.36.113.107
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=515cf6f8-7a1d-44a8-9545-d02c6c07e305&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 17 Oct 2023 01:23:09 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=515cf6f8-7a1d-44a8-9545-d02c6c07e305&gdpr=0&gdpr_consent=
date: Tue, 17 Oct 2023 01:23:08 GMT
server: Kestrel
content-length: 355

GET
H2 200 27BB6CF6-5140-48B1-B11E-5A8F2CB00133
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 4144 43 B
602 B 1125ms
39ms Image
image/gif 34.203.51.33
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/27BB6CF6-5140-48B1-B11E-5A8F2CB00133?gdpr=0&gdpr_consent=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.203.51.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-203-51-33.compute-1.amazonaws.com

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:09 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

POST
H2 200 init Show response
gw.geoedge.be/api/ Frame 2284 0
218 B 147ms
50ms XHR
text/plain 13.35.84.214
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gw.geoedge.be/api/init
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.84.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-84-214.bos50.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Tue, 17 Oct 2023 01:23:09 GMT
via: 1.1 b81a40638278505048c4309d0d50192a.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-C1
content-length: 0
x-amz-cf-id: c3hmdFhMmMBP3RyJ_wbtYLn9AAjOMNpZ9mRuKm25F5hg9CdxMqyZvw==
x-cache: Miss from cloudfront

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2284 42 B
64 B 170ms
100ms Fetch
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvKHyCFys8l0yEr2wOWmWSkGkOMkGHnIijCV3W5VgTWisrl6_VR1fgXjgd6z2KXvhM0riJF_pVLGVtQa4FujO4suP70yj-3TzDzfe1Too3o310HxcjWyfH5RFTAYDvt6KbvjiV-i0LHhA&sai=AMfl-YSnMv8KKQ8Oc84e7P_D67SbCIvjUcb_NlDEa0-t-RUXChXqsl-GNqoDFNNmnKGHMRwa-sz4YIECk3z7aSZUcY9ngoB68FZfo1hURzHDyxjnLrbiW1HTuMGc1rPz&sig=Cg0ArKJSzIeBlzX4_UtCEAE&cid=CAQSPADICaaNjsNGnHwFABRDqvt7BfYT1uHadUmwvq4kzvQu2qg19XL29evXnOmGzCWkroo1Assp4HHurOHnBBgB&id=lidar2&mcvt=1000&p=95,315,345,1285&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231011&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=562129336&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1697505785528&rpt=3639&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/d3a9ffb8-fe00-4841-8c1e-a701489572a4/grumi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2284 0
20 B 91ms
91ms Ping
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9500568075996&version=m202309260101&ct=76&x=1&cor=2595873142407564300

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 4144 0
260 B 252ms
81ms Script
text/plain 104.36.113.111

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156011&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.36.113.111 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 01:23:10 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 4144 2 KB
2 KB 33ms
32ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=59463278&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: bbaa173f5d4fcc596249493fbc1dbccc6dc767db2b984a381216025d1688bafb

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 17 Oct 2023 01:23:10 GMT
content-length: 1549
content-type: text/html; charset=UTF-8

POST
H/1.1 200
OK attention-event Show response
sr.studiostack.com/track/ 0
396 B 35ms
34ms XHR
text/plain 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-event
Requested by: Host: sr.studiostack.com
URL: https://sr.studiostack.com/v3/services
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://macleans.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

Expires: 0
Pragma: no-cache
Date: Tue, 17 Oct 2023 01:23:11 GMT
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 0
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

OPTIONS
H/1.1 200
OK attention-event
sr.studiostack.com/track/ Frame 0
0 36ms
35ms Preflight
text/html 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-event
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://macleans.ca
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Access-Control-Allow-Origin: *
Allow: POST
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 4
Content-Type: text/html; charset=utf-8
Date: Tue, 17 Oct 2023 01:23:11 GMT
ETag: W/"4-Yf+Bwwqjx254r+pisuO9HfpJ6FQ"
Expires: 0
Pragma: no-cache
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

GET

rtset
bh.contextweb.com/bh/ Frame 76D6
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFDVS1rN0tXOFFBQUJxa3I2clV6UQ&gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Csyn%2Cpm&bee_sync_current_partner=adx&b...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Csyn%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partneruserid=AACU-k7KW8QAABqkr6rUzQ&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Csyn%252C...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Csyn%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=8721594384017978332&gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?ev=AACU-k7KW8QAABqkr6rUzQ&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D8721594384017978332%26gdpr%3D0%26gdpr_consen...

0
0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame E784
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6242155078849264757&gdpr=0&gdpr_consent=

42 B
297 B

82ms
81ms

Document
image/gif

104.36.113.107
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6242155078849264757&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 17 Oct 2023 01:23:10 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 98aa15a5-d58e-4f56-a308-c89c3fb3ccbb
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Tue, 17 Oct 2023 01:23:11 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6242155078849264757&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.21.3
x-proxy-origin: 86.48.15.34; 86.48.15.34; 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
x-xss-protection: 0

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame 8DD8 0
338 B 118ms
40ms Document
image/gif 169.197.150.7

General

Check archive.org

Show headers Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.7 -, , ASN (),
Reverse DNS
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-length: 0
content-type: image/gif
date: Tue, 17 Oct 2023 01:23:11 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: c

GET
H/1.1 200
OK ecm3 Show response
s.amazon-adsystem.com/ Frame AFCF 43 B
479 B 41ms
41ms Document
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UID27BB6CF6-5140-48B1-B11E-5A8F2CB00133

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 17 Oct 2023 01:23:11 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: M7XRZY1M5MX3Q7M4EDCG

GET
H2

200

insync
thrtle.com/ Frame 4144
Redirect Chain

https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&gdpr=0&gdpr_consent=
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&vxii_pid=12&vxii_pid1=10067&vxii_rcid=7da77c62-80c3-49de-a122-a6201fe847ab

43 B
294 B

37ms
37ms

Image
image/gif

3.223.197.111

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&vxii_pid=12&vxii_pid1=10067&vxii_rcid=7da77c62-80c3-49de-a122-a6201fe847ab
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 3.223.197.111 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
date: Tue, 17 Oct 2023 01:23:11 GMT
content-length: 43
content-type: image/gif

Redirect headers

location: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&vxii_pid=12&vxii_pid1=10067&vxii_rcid=7da77c62-80c3-49de-a122-a6201fe847ab
date: Tue, 17 Oct 2023 01:23:11 GMT
content-type: text/html; charset=utf-8
content-length: 211
p3p: CP="NOI OUR BUS UNI COM NAV"

GET
H2 200 sd
us-u.openx.net/w/1.0/ Frame 4144 43 B
171 B 65ms
63ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=540245193&val=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:11 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 Martin
crb.kargo.com/api/v1/dsync/ Frame 4144 43 B
358 B 116ms
39ms Image
image/gif 44.199.102.125

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crb.kargo.com/api/v1/dsync/Martin?exid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.199.102.125 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:11 GMT
x-accel-expires: 0
vary: Origin
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 204 sync
sync.bfmio.com/ Frame 4144 0
425 B 144ms
35ms Image
text/plain 44.205.178.7

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=187&uid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.205.178.7 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Connection: keep-alive
Date: Tue, 17 Oct 2023 01:23:11 GMT

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 4144
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-9fbMjk9E2uWqluDGgwsAOA1aoWVz7z8-~A&gdpr=0

0
129 B

84ms
81ms

Image
text/plain

104.36.113.111

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-9fbMjk9E2uWqluDGgwsAOA1aoWVz7z8-~A&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 104.36.113.111 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 22:37:34 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-9fbMjk9E2uWqluDGgwsAOA1aoWVz7z8-~A&gdpr=0
date: Tue, 17 Oct 2023 01:23:11 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 4144
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=61cfba47-db32-4fb2-b599-cd9e542a5edf&gdpr=0&gdpr_consent=

1 B
256 B

82ms
81ms

Image
text/html

104.36.113.107
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=61cfba47-db32-4fb2-b599-cd9e542a5edf&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Tue, 17 Oct 2023 01:23:10 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=61cfba47-db32-4fb2-b599-cd9e542a5edf&gdpr=0&gdpr_consent=
Date: Tue, 17 Oct 2023 01:23:11 GMT
Connection: keep-alive
X-CI-RTID: b35b223a-1ba6-4e7e-a14c-5cfb1e6877c0
Content-Length: 205
Content-Type: text/html; charset=utf-8

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 4144
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=10ba28c12c5205a6&is_secure=true&networkId=17100&version=1&nuid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAACYPYAbBMyiANnaRa7AAAAAAA&expiration=1697592191&nuid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&...

42 B
374 B

85ms
85ms

Image
image/gif

104.36.113.107
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAACYPYAbBMyiANnaRa7AAAAAAA&expiration=1697592191&nuid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-LoopMe_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 17 Oct 2023 01:23:11 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 17 Oct 2023 01:23:11 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAACYPYAbBMyiANnaRa7AAAAAAA&expiration=1697592191&nuid=27BB6CF6-5140-48B1-B11E-5A8F2CB00133&is_secure=true&gdpr_consent=&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fmacleans.ca&pubid=e0a2486b-0b5b-4021-8fca-83886d0240c7

Domain: exchange.cootlogix.com
URL: https://exchange.cootlogix.com/prebid/multi/646c34f46a97d6e2d21efe26

Domain: c2shb.pubgw.yahoo.com
URL: https://c2shb.pubgw.yahoo.com/bidRequest

Domain: c2shb.pubgw.yahoo.com
URL: https://c2shb.pubgw.yahoo.com/bidRequest

Domain: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Domain: cm.ctnsnet.com
URL: https://cm.ctnsnet.com/int/cm?exc=19

Domain: dpm.demdex.net
URL: https://dpm.demdex.net/ibs:dpid=23728&dpuuid=ZS3h.b8FpCnTVEQXH.FQ-QAA%263876?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Domain: bh.contextweb.com
URL: https://bh.contextweb.com/bh/rtset?ev=AACU-k7KW8QAABqkr6rUzQ&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D8721594384017978332%26gdpr%3D0%26gdpr_consent%3D%26bee_sync_partners%3Dsyn%252Cpm%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3&gdpr=0

Verdicts & Comments Add Verdict or Comment

124 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

88 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.macleans.ca/	1970-01-20 15:31:47	Name: __cf_bm Value: 7QUPiirXYZVVcD18fb1ZKxZM6GTJfhTemNS_5HpNWBc-1697505780-0-AZzbkvinnifkUfI+33jdhM+jLRZV1+zO2a29rkk2jX9mD7b9svFY3GVIdaOSNvSGa+egVrMcKOS3XARWy3n5d88=
.mblycdn.com/	1970-01-20 15:31:47	Name: __cf_bm Value: pMRbLYERCl._C3l0qxxwVcQ8Op5VarNm880EsBLAD1w-1697505780-0-AYFazh+0fNVj2/9PyW0UKiCbJDz7+zCyEv5KyQhRd873aORvtVrW3yGaGtu0nfwuhcRGtCfMLhEseUBNfN4+h5U=
.macleans.ca/	1970-01-21 01:07:45	Name: _ga_PSNJJL83JG Value: GS1.1.1697505781.1.0.1697505781.0.0.0
.macleans.ca/	1970-01-21 01:00:33	Name: _cb Value: Dc6ed-B72GghuayYt
.macleans.ca/	1970-01-21 01:00:33	Name: _chartbeat2 Value: .1697505781383.1697505781383.1.Bo768ND7D0mYCRRa_UBpGk69w9Dat.1
.macleans.ca/	1970-01-20 15:31:47	Name: _cb_svref Value: null
.macleans.ca/	1970-01-21 01:07:45	Name: _ga Value: GA1.2.1994954187.1697505781
.macleans.ca/	1970-01-20 15:33:12	Name: _gid Value: GA1.2.1535254586.1697505782
.macleans.ca/	1970-01-20 15:31:45	Name: _gat_UA-108831724-1 Value: 1
.macleans.ca/	1969-12-31 23:59:59	Name: __psid Value: 1697505781652
macleans.ca/	1970-01-20 15:41:50	Name: AWSALBTG Value: v3hz7IW1BkI+cLiUQBReB5xfn8Mtt64AGjnWP2Ton/WyOvRx8AHaf76wCSB2EHa2aCVqRI86tlRXdGF2GexgLa8uh3F7bXMfKCHrsudu6rmMFz0AGzGKUWcZ0wjyrYuYvjSHkdAAeV80CemygxgbtWwn5E4skKHOJ/UfxRgBBSJwWSu1atE=
macleans.ca/	1970-01-20 15:41:50	Name: AWSALBTGCORS Value: v3hz7IW1BkI+cLiUQBReB5xfn8Mtt64AGjnWP2Ton/WyOvRx8AHaf76wCSB2EHa2aCVqRI86tlRXdGF2GexgLa8uh3F7bXMfKCHrsudu6rmMFz0AGzGKUWcZ0wjyrYuYvjSHkdAAeV80CemygxgbtWwn5E4skKHOJ/UfxRgBBSJwWSu1atE=
macleans.ca/	1970-01-20 15:41:50	Name: AWSALB Value: SuVWXmivcexYdNZFFK98vX4fhHWOEi1yNk2kcXvDX0VDwED+fK01iV2cVdzpe7hJ7/XtAmkq/GwywE0ze8qBrrmH7uCxVsj+6RhI3a4DnvqcjgYfoGLyoAoSrAHr
macleans.ca/	1970-01-20 15:41:50	Name: AWSALBCORS Value: SuVWXmivcexYdNZFFK98vX4fhHWOEi1yNk2kcXvDX0VDwED+fK01iV2cVdzpe7hJ7/XtAmkq/GwywE0ze8qBrrmH7uCxVsj+6RhI3a4DnvqcjgYfoGLyoAoSrAHr
.macleans.ca/	1970-01-21 00:17:21	Name: rap-user Value: {%22last_session_start%22:1697505784622%2C%22user_id%22:%22fe34ef9f-173a-4c44-b1c8-28365c440148%22}
.macleans.ca/	1970-01-20 15:31:47	Name: rap-session Value: {%22property_name%22:%22macleans%22%2C%22property_vertical%22:%22%22%2C%22property_version%22:1%2C%22device%22:%22desktop%22%2C%22geo%22:%22ca%22%2C%22click_id%22:null%2C%22source%22:%22direct%22%2C%22experiments%22:{}%2C%22experiments_participating%22:0%2C%22session_id%22:%225e813c55-9aa5-40c8-97d8-2b285a851ca3%22%2C%22session_start%22:1697505784622%2C%22user_loyalty%22:%22new%22%2C%22page_view_id%22:%227feaa99c-d9f2-4529-aed8-342dfff8e665%22%2C%22page_depth%22:1}
.t.co/	1970-01-21 01:07:45	Name: muc_ads Value: 8fd1fdca-dc8b-4c7e-aea5-4f68772f7d14
.macleans.ca/	1970-01-20 17:41:21	Name: _fbp Value: fb.1.1697505784690.1700535618
.amazon-adsystem.com/	1970-01-20 21:43:16	Name: ad-id Value: A5OL4gcRbEcAi_rL5ZDwC94
.amazon-adsystem.com/	1970-01-21 01:07:45	Name: ad-privacy Value: 0
.doubleclick.net/	1970-01-21 01:07:45	Name: IDE Value: AHWqTUkUTYG9v8QupT9nOu95IymzAGcELTSYxPaan-1w79MkMFSfoHW4ifwP8jPgEqE
.simpli.fi/	1970-01-21 00:18:48	Name: suid Value: 3297F192560D4730894264FA0DD2E476
.macleans.ca/	1970-01-21 00:53:21	Name: __gads Value: ID=ba6ba5f11916927f:T=1697505784:RT=1697505784:S=ALNI_MagAwx6cNRGW6TJ9rpwFQ-DRfRf3Q
.macleans.ca/	1970-01-21 00:53:21	Name: __gpi Value: UID=00000d9a42dc13ce:T=1697505784:RT=1697505784:S=ALNI_MamUD7BcWtnkQ4fXy02VedxGzIIjQ
.casalemedia.com/	1970-01-21 00:17:21	Name: CMID Value: ZS3h.b8FpCnTVEQXH.FQ-QAA
.casalemedia.com/	1970-01-20 17:41:21	Name: CMPS Value: 3876
.casalemedia.com/	1970-01-20 17:41:21	Name: CMPRO Value: 3876
.csync.loopme.me/	1970-01-20 17:44:14	Name: viewer_token Value: 3c64bd8b-fccb-411a-9433-5641948ad7f5
.smartadserver.com/	1970-01-21 01:02:00	Name: pid Value: 8721594384017978332
.smaato.net/	1970-01-20 16:02:00	Name: SCM Value: e9b35e5b13
.smaato.net/	1970-01-20 16:02:00	Name: SCMaps Value: e9b35e5b13
.adnxs.com/	1970-01-20 17:41:21	Name: uuid2 Value: 6242155078849264757
.adnxs.com/	1970-01-20 17:41:21	Name: anj Value: dTM7k!M41.D>6NRF']wIg2ImPwZa$e!@wnfH8K6pQK`!5=E<L5?%K94A]cma't8V<5tIc5by:W`otsO?wLnyr79o<bpRzqF1`b`r)*A@-c
.doubleclick.net/	1970-01-20 19:50:57	Name: APC Value: AfxxVi6IINUPjI7KtFw-xXBEf-0_lFSx1FFgd8bVutxocIL3hOTHgQ
.twitter.com/	1970-01-21 01:07:45	Name: personalization_id Value: "v1_xpUwGpaRhFcpfIPs9n+/5Q=="
.lijit.com/	1970-01-21 00:17:21	Name: ljt_reader Value: Hf5zbPZHfawiHPRWTgiLYuVO
.lijit.com/	1970-01-21 00:17:21	Name: ljtrtbexp Value: eJyrVrIwULIyNLO0MDc0NbYw01GyNEflm5mhyRuh8U2Q%2BbUAptoQqQ%3D%3D
.lijit.com/	1970-01-21 00:17:21	Name: _ljtrtb_92 Value: 6242155078849264757
.dotomi.com/	1970-01-20 15:31:45	Name: DotomiTest Value: 6556c742310c05a6
.acuityplatform.com/	1970-01-21 00:17:21	Name: auid Value: 841381824345
.acuityplatform.com/	1970-01-21 00:17:21	Name: aum Value: OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqBMjf6jXVzZXJNYXRjaGluZ0lkJLaRbGFzdERyb3BUaW1lTWlsbGlzJQFFTmcrTpKYbGFzdFN1Y2Nlc3NmdWxNYXRjaE1pbGxpcyUBRU5nK06Sj3RoaXJkUGFydHlVc2VySWRXSGY1emJQWkhmYXdpSFBSV1RnaUxZdVZP+/uGdmVyc2lvbsL7
.lijit.com/	1970-01-21 00:17:21	Name: _ljtrtb_66 Value: 841381824345
.travelaudience.com/	1970-01-21 01:03:26	Name: _tracker Value: %7B%22UUID%22%3A%2275261CB9-4C7D-4894-0982-F66462A1CB0E%22%7D
.blismedia.com/	1970-01-21 00:17:25	Name: b Value: 652DE1FA01E5245B47EC126ABLIS
.rubiconproject.com/	1970-01-21 00:17:21	Name: khaos Value: LNTN47OR-16-1IVP
.sharethrough.com/	1970-01-20 16:14:57	Name: stx_user_id Value: b2e17537-64dd-45c3-beb6-16e2d7e1628f
.lijit.com/	1970-01-21 00:17:21	Name: _ljtrtb_80 Value: LNTN47OR-16-1IVP
.eqads.com/	1970-01-20 17:44:14	Name: EQUser Value: UID=b3a568d0-c902-4453-96a0-73d083e1d174
.macleans.ca/	1970-01-21 00:17:21	Name: FCNEC Value: %5B%5B%22AKsRol9CxrXVoak-6mBucwtvgBCfAlLW1Y79hL3qgMG8E6QPzQbaKLqQXXeJ6ahttQ7didIj0KOfoEiX2DyKlcHm4fY3hFgoNhyopsXmW94PS2tBNoQNFDJPGWvqkChmxuX8ELF4pTWBsz1Md5Eu3hE4Ijf0vlZ5oQ%3D%3D%22%5D%2Cnull%2C%5B%5D%5D
.3lift.com/	1970-01-20 17:41:21	Name: tluid Value: 2805667729428079344355
.bidswitch.net/	1970-01-21 00:17:21	Name: tuuid Value: c72b9298-307f-4008-a9c3-a7e8f18dd304
.bidswitch.net/	1970-01-21 00:17:21	Name: c Value: 1697505787
.bidswitch.net/	1970-01-21 00:17:21	Name: tuuid_lu Value: 1697505787
.mxptint.net/	1970-01-21 01:07:45	Name: mxpim Value: R33645_10AAB1928_D2349F69.1.652DE1FB
.linkedin.com/	1970-01-21 00:17:21	Name: bcookie Value: "v=2&7de02974-a013-43e5-843d-e2da96e26927"
.linkedin.com/	1970-01-20 15:33:12	Name: lidc Value: "b=TGST06:s=T:r=T:a=T:p=T:g=2729:u=1:x=1:i=1697505787:t=1697592187:v=2:sig=AQHEVSycxFs3U-XgewlqbJDh_aA_e-6d"
.teads.tv/	1970-01-21 00:15:55	Name: tt_viewer Value: 7f301a3a-e2d9-4427-bedd-468a1e7180fa
.adsrvr.org/	1970-01-21 00:18:48	Name: TDID Value: 515cf6f8-7a1d-44a8-9545-d02c6c07e305
.sportradarserving.com/	1970-01-21 00:17:21	Name: zuuid Value: 77cb5f25-0fd3-4147-81b7-53267282a3b7
.sportradarserving.com/	1970-01-21 00:17:21	Name: c Value: 1697505788
.sportradarserving.com/	1970-01-21 00:17:21	Name: zuuid_lu Value: 1697505788
.sportradarserving.com/	1970-01-21 00:17:21	Name: zuuid_k Value: 1
.sportradarserving.com/	1970-01-21 00:17:21	Name: zuuid_k_lu Value: 1697505788
.turn.com/	1970-01-20 19:50:57	Name: uid Value: 7059221617362624609
.bidr.io/	1970-01-21 01:00:19	Name: bito Value: AACU-k7KW8QAABqkr6rUzQ
.bidr.io/	1970-01-21 01:00:19	Name: bitoIsSecure Value: ok
.zemanta.com/	1970-01-21 00:17:21	Name: zuid Value: eWSpBcf5PVT2wBGDQ8Ps
.media.net/	1970-01-21 00:17:21	Name: visitor-id Value: 3405073889017883000V10
.ads.pubmatic.com/	1970-01-20 15:33:12	Name: KCCH Value: YES
.pubmatic.com/	1970-01-21 00:17:21	Name: KADUSERCOOKIE Value: 27BB6CF6-5140-48B1-B11E-5A8F2CB00133
.pubmatic.com/	1970-01-20 17:41:21	Name: chkChromeAb67Sec Value: 1
.pubmatic.com/	1970-01-20 15:33:12	Name: pi Value: 156011:2
.pubmatic.com/	1970-01-20 17:41:21	Name: DPSync3 Value: 1698710400%3A201_263%7C1697587200%3A248%7C1698105600%3A265
.pubmatic.com/	1970-01-20 17:41:21	Name: SyncRTB3 Value: 1698710400%3A13_54_250_71_220_21
.tapad.com/	1970-01-20 16:58:09	Name: TapAd_TS Value: 1697505788715
.tapad.com/	1970-01-20 16:58:09	Name: TapAd_DID Value: 70bae9d2-7c7b-455d-af26-b175e85ff634
.adsrvr.org/	1970-01-21 00:18:48	Name: TDCPM Value: CAESFQoGY2FzYWxlEgsIiIjI7bSupzwQBRIXCghwdWJtYXRpYxILCM62g_a0rqc8EAUSFAoFdGFwYWQSCwjwirn3tK6nPBAFGAEgASgCMgsIsIG8pMuupzwQBTgBWgV0YXBhZGAC
.tapad.com/	1970-01-20 16:58:09	Name: TapAd_3WAY_SYNCS Value: 1!6961
.1rx.io/	1970-01-21 00:17:21	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-8b2ab8de-8bbf-466c-add0-06dafd7cd3b1-005%22%2C%22nxtrdr%22%3Afalse%7D
.openx.net/	1970-01-21 00:17:21	Name: i Value: 5749a7cd-cabb-4c61-ba2f-fff7c3dc381f\|1697505789
.yahoo.com/	1970-01-21 00:17:43	Name: A3 Value: d=AQABBP3hLWUCEGsq3jL5cily1dj9ZwpH15AFEgEBAQEzL2U3ZQAAAAAA_eMAAA&S=AQAAAj9QHJlFgts20XK1HN-cDIg
.targeting.unrulymedia.com/	1970-01-21 00:17:21	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-8b2ab8de-8bbf-466c-add0-06dafd7cd3b1-005%22%7D
.rubiconproject.com/	1970-01-21 00:17:21	Name: audit Value: 1\|yiMeGPrPPyHTsxPLE74AEoZMGge4l1nyeNE/IdpXSIBANEhL6jmjsoYzG5pNq4YEFUgF6TlyCmMkEa5N2k7U1SEEFoCDRlfY/fl9UxTBA2KsMyW2j+tLvKMcNyKzNUHRdNagGyTJzJG9+gdfTu7zmf3u19iZBMccXmuH1iSxuEFuvQ1mbTXkKVetd0BIp7qX
.lijit.com/	1970-01-21 00:17:21	Name: ljtrtb Value: eJwNyEEKgDAMBMC%2F5GyhSTfJ1h8IUkXEz4h%2Ft3OcVyJkFUIblYYGl0VY5%2B3jHsjjKhpFt%2Bec321%2BGEzda5LoFkhP%2BX4s9Q9e
.lijit.com/	1970-01-21 00:17:21	Name: _ljtrtb_97 Value: RX-8b2ab8de-8bbf-466c-add0-06dafd7cd3b1-005
.pubmatic.com/	1970-01-20 16:14:57	Name: KRTBCOOKIE_148 Value: 19421-uid:3297F192560D4730894264FA0DD2E476&KRTB&23486-uid:3297F192560D4730894264FA0DD2E476&KRTB&23489-uid:3297F192560D4730894264FA0DD2E476
.pubmatic.com/	1970-01-20 17:41:21	Name: KRTBCOOKIE_80 Value: 22987-CAESEGZln6iKds2q9w1-h9z7Qlk&KRTB&23025-CAESEGZln6iKds2q9w1-h9z7Qlk&KRTB&23386-CAESEGZln6iKds2q9w1-h9z7Qlk
.pubmatic.com/	1970-01-20 16:14:57	Name: PugT Value: 1697505788

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://macleans.ca/ Message: Access to XMLHttpRequest at 'https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fmacleans.ca&pubid=e0a2486b-0b5b-4021-8fca-83886d0240c7' from origin 'https://macleans.ca' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fmacleans.ca&pubid=e0a2486b-0b5b-4021-8fca-83886d0240c7 Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://us01.z.antigena.com/l/FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3AWUAJgUx%2027BB6CF6-5140-48B1-B11E-5A8F2CB00133&rnd=RND Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; report-uri https://vault.gostatera.com/collect/csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4bac258850ebbcf97e8f2972bd47f102.safeframe.googlesyndication.com
a.sportradarserving.com
aax.amazon-adsystem.com
ad.turn.com
ads.pubmatic.com
ads.travelaudience.com
aep.mxptint.net
analytics.twitter.com
ap.lijit.com
b1sync.zemanta.com
bh.contextweb.com
c.amazon-adsystem.com
c2shb.pubgw.yahoo.com
cdnjs.cloudflare.com
ce.lijit.com
cm.ctnsnet.com
cm.g.doubleclick.net
collector.ex.co
config.aps.amazon-adsystem.com
connect.facebook.net
crb.kargo.com
cs.media.net
csync.loopme.me
dclk-match.dotomi.com
dis.criteo.com
dpm.demdex.net
dsum-sec.casalemedia.com
eb2.3lift.com
eus.rubiconproject.com
exchange.cootlogix.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
gw.geoedge.be
ib.adnxs.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
js.createsend1.com
macleans.ca
match.adsrvr.org
match.deepintent.com
match.prod.bidr.io
match.sharethrough.com
maxcdn.bootstrapcdn.com
output-to-go.mblycdn.com
pagead2.googlesyndication.com
ping.chartbeat.net
pixel-us-east.rubiconproject.com
pixel.tapad.com
player.ex.co
pr-bh.ybp.yahoo.com
pubmatic-match.dotomi.com
px.ads.linkedin.com
rumcdn.geoedge.be
s.ad.smaato.net
s.amazon-adsystem.com
s0.2mdn.net
secure.adnxs.com
securepubads.g.doubleclick.net
simage2.pubmatic.com
simage4.pubmatic.com
sr.studiostack.com
ssbsync-us.smartadserver.com
ssum-sec.casalemedia.com
static.ads-twitter.com
static.chartbeat.com
static.cloudflareinsights.com
stats.g.doubleclick.net
stream.playbuzz.com
sync.1rx.io
sync.bfmio.com
sync.cootlogix.com
sync.ipredictive.com
sync.outbrain.com
sync.targeting.unrulymedia.com
sync.teads.tv
t.co
thrtle.com
tpc.googlesyndication.com
tr.blismedia.com
u.openx.net
um.simpli.fi
um4.eqads.com
ums.acuityplatform.com
ups.analytics.yahoo.com
us-u.openx.net
us01.z.antigena.com
vault.gostatera.com
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googletagmanager.com
www.googletagservices.com
x.bidswitch.net
bh.contextweb.com
c.amazon-adsystem.com
c2shb.pubgw.yahoo.com
cm.ctnsnet.com
dpm.demdex.net
eus.rubiconproject.com
exchange.cootlogix.com
104.16.56.101
104.17.178.181
104.17.25.14
104.18.11.207
104.18.27.168
104.18.27.193
104.244.42.195
104.244.42.5
104.36.113.107
104.36.113.111
13.107.42.14
13.35.84.214
142.251.111.102
142.251.111.94
142.251.16.157
142.251.163.105
142.251.163.132
142.251.163.94
142.93.204.154
146.75.28.157
151.101.130.132
151.101.2.137
169.197.150.7
172.253.115.113
172.253.115.148
172.253.115.155
172.253.115.156
172.253.115.95
172.253.122.155
172.253.62.132
172.253.63.154
172.253.63.97
18.161.31.77
18.239.163.131
18.239.164.134
18.239.168.105
18.239.168.109
18.239.168.6
18.239.183.85
199.127.204.171
20.49.104.19
216.34.207.73
23.105.12.143
23.215.40.199
23.215.40.23
23.60.1.46
23.92.190.69
3.223.197.111
3.33.220.150
31.13.80.12
31.13.80.36
34.111.113.62
34.200.65.202
34.203.51.33
34.96.105.8
35.190.0.66
35.194.66.159
35.211.178.172
35.211.233.246
35.214.230.141
35.244.159.8
38.98.69.175
40.76.134.238
44.199.102.125
44.205.178.7
50.116.194.21
52.2.174.221
52.22.163.254
52.223.22.214
52.37.69.61
52.46.128.147
52.6.76.142
54.172.244.151
54.236.119.39
54.85.101.118
63.251.86.49
68.67.160.137
69.173.151.100
69.90.254.78
70.42.32.159
70.42.32.95
74.119.119.150
8.28.7.81
00a269606af95f52ce213e5096cc3a079d73522bc4e3c398789038666bb1454a
034e8dbbf1352f0bbb298fde6bb8361880c7618b3ee2751504f9b9edcdd06284
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
080fced9c42413ea185bb8a99a693cac40a1f448843558c90454639e5890c0b2
0a8c43f26673a5e7d593025cff6844c834b60f8c3cf577a37b1c9a95f3a0e0e0
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0ba9db09f2b371fbaef87d359cd312883f2012539e5156074934b14b636e0af8
101d5796f35e827a17a9c7bf8b944fbe29f62c68fc1cc37c07a4eb927a8fdf4f
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
1651ead8bfc7b35609f4e3e28aac41690b2326bdccfb4f6f7acd0ade9d973bd8
16fadb06557f8c559b25e437d47286d3886b6f361900f479f1bf928198e8d0f7
172cbbcb001b0912af109bec9672c2e9d1d1836fc4c98de982d427145bed8335
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
18d6da59018d8d9e7e638430f4101c6e0b497331e64b246d6f2a9860b781411f
1905ba0cf8abf8175135dd5a914b0c5f71ed70039428d231c7243b1473d5bfd6
1ac287252f7e8955fa6f7f683437518bee9aeaa06a98091d070355db466c3b25
1bfd1d5158c8a0e02b2631da167c8d99c4c99f641ac87b8803c12a13363fb3f4
1ca4054e107c3cd7d462a7694ae63f334f7e9c4619c760fef2d515ef84b3e0f1
1cdebb96c667623475254286eaae5294900e7f0e32c8eaf56af5bf1a8d6fdde3
1fe9ded65826966445cafc9a8e33bb4d7ff2705829010966ef8a60ab8e22e371
2241d391f10f461a915b6ef47bc0c8103bf0e7289aff47e1bcfed5ff2a84d119
22de70828d18a34eed9672ca18cbb242cca446881a1f8d80cf57768cabadbe26
2308397ed0531a82bfbf49cd3c41af4cd7f9a8853cdb773519b6a53eff8b7e35
263986f67058ca70f15d853b413ce45ce8fbf5516aa25208c9eeea3c3cbbeb16
273c8613cdd2852dd5318f224d804ae6d2fc717c48d3f1dab587b6d396fb4fc8
289b09264b08ca46f1b721355015a1b01196e00066af0d44425a61190867ef95
29e9ad9ab38ae2e5a8d904987b7179484e40bb50b14f0e04b9cc420c38ce3866
2a20ad4e44b3670fa88596550896f50accb88cbb683d38c310ee5fb17ae62e33
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
303871abe23595cdb8c911e04c26212e19e4bf4ab0820f9258084b5dabf6c44c
30fc45fb9b07a5298fc8458b65181f914e6b188bbce309a24bcfc345d619593f
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
3db8d3751d195dbcd576f916726f5142ee91c597ceb9ac198b2a2a4971899c8c
3e95d764c2e2b438da629249f5f50d78511a6462bce7b22610da8429eae48d86
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3f46c1859f11e88dd7f05b4e26e6958ed0a852e8660d452ccb938ff741fcb240
44a45d0f087386dbb2e88a2df7d508c5aff5065b04fb39504783c8f9081a0e90
4556e7ac207a21a2955aef46f86844c6d35763bcbada3fe5d807ee39d8e9e801
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
48cc921dfba1b45614021b10eb1ea7eba1ac0e4f1eb57d3b23f9eeb520da8093
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d6ccad25edacdb6163e9e7e7a145f1a6206cb0f558ad41e25e70c0d5d07215d
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
564a53ce84ae022b30816d44aa48589ebfe170c226b098d0245c47fe13341c67
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5664b0381f0f4f767609603b19a0b397f1f6c32fae688d8b5f4c345f19e20d4e
5d4c4d921229428739779ecd4f3b675102d57929c4a748cff50c102074b6fd7f
5d8ff78bb9943dcd8c8df7d99122636d632f1407dfa1b3190ef3c50d6edbe191
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
60cd4bba2b90b26bc4b8a840ab12fb40887b6b493ea5e0c7139168eea606b389
62f12a2915fb293499dbdd358761f36898481a4c2cf3d83ee7e8e87d7a287687
66d90c928a568caccd613e858129faeced51dde2547ab633e1387204d4412d2e
678c4ccdebf6f75d3fb5475863bd385aad141dbad8dc4d6ec5acc4dfaa0005d1
68267fa0ef5a142e91b544f82abd76b34148ef6e39a948dc72a3f93fe3788737
6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc
6f9c72ef22efe8a0e095464ab57ea0d5b6c24fa0abcd9439a1ffe1f522cca92a
732117ac92a33b760d9290a33f1541762ee9449dc417ea249b5a0df50738ad16
76f95019d43447771f1159aee570f2a783269164dfe6919106a2923a3dbf7b08
7703c22844c5d0f1e1f05d4f4980ef179932c7ab78b8e6c4f370a0ddf0dfb0c4
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7a995ccc81e89f240bb6f806ff578ffd6150d35e9a6f6b301bc7ca7c95f5618d
7d2b154c175678193164f11271f2425a3ffef74bccf437a2662ca884260a9c3e
7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85
826cf1b49580fbd87bf009fefa007441301e4f55c804f91d8356d64d5c515fa4
84156ae066474e0c636a1c380f8e96a05591295096463f0a4912dd9a5df246ff
8435efe820017f9a898318d0ccba0846b94d8fa405174d21d0c4edb0fd5dc08f
853f48bd0321d7b4cb0b8dbc21875669fa0bc0548ee5694f7acb4a60c4f973d8
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
8c7ee0238fa5cd80a02ef9870a7fff498ef52097181cb73edb9219dc022fd919
8e61da668539083cdc135d7fee79dd76173e6b12124d9a692df6ff1d3d5789e5
90581f5e78f586fc87ab1d4c0836347c281095346a869a356436d61d0e97e074
94061a925c5d84bf776554ac894020c407a9a4c89b979d538de3cf45591fe423
9629adc1782f930399e57b92f49f9a539f0175a5738db5875b7219a0bd51457e
974b373aafebb2098c590c7ec80e9538cdd824d365234f7df5a101e47a98003c
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9f7d04a1b77ae2f716e1c2db2c3dd81a48d85ed50ea0e1f72e50971ff3d4c9c2
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45
a1aa01f31d4087317f5d4e5ef4ea70a73e38124a45f1553dbe8968ea16068b84
a3a2d01ec05246540e99274a0b9c9cf0a2ebd1a840329e04123e6b714828feb8
a4ac9a37921e7a6c8e60c839da56a0447075185cedf43dc78926e13240820c5e
a5e888c099eaa9302340e11e9411dc11ff92b2f0d1331d99432be566445cd6ae
a883f245f7eccaa08fe38c8da27481e0f416913becbe9d09e4160f9777e9fb5a
a9bc024987f9f4f35dd725c025d7d5f96102ab18844920001f81aa560a9f5baf
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae3e3be32a3e070997abc067d796ae0d4e331d17dc1198d40d2bfea11f343e72
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b186e56166aa6a8f8e9047574baa1345a23a43bae8fb5153d58af4d2a863cffb
b2cf240b501f8685c65d2ee7970229557cb578ef7c91f14f2b3319b4f9a23e95
b42302174746c5a2bed6fe521587049c2906c70e85ecc0ed8640c5d87184c842
b9ba234ac2fe34f541fb33a5dccc17d68f098f8087d691cf5f7db808363a888c
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bbaa173f5d4fcc596249493fbc1dbccc6dc767db2b984a381216025d1688bafb
bde05bd6dffc615a12629f8b6ca67496ca74a5eaf072362e2d5fea1f0b071d8d
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c235f21017bcc11fcaa31d7dfd9855aaebcbf5f6d7ee9bf9f2e98a910907c391
c4b62559f01d81ebb702d493221a2384e71137d17f13c7930d0b1aff0e25273b
c75166534a7cf375f7963558a6a55858688f6c289c9d200706ce1592669ffe3b
c7e5fe828286e27fec246482197421480446ed9ea3e084eb58ae1131195431c8
cca73b5e8f7b1a1976c60afc2fe8ef02eb2ebfb951c0675431345f7ff3bfa107
cebe87559cf861d01e9c6b1cefd38ab1db9e13c8fe316b85a296b6cf220f883e
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d0a4a23b2b6f5fdac53a6c939a94c25e58578e69cc35a3d5b307b900123c8ec5
d55ecce76b7466421fb833136b15d4c92040236c12e360f29f3e82031e7f0578
db22b37c49a446a4aa73ef0938ef6bbff3f77224aa8412606eebd73f78816547
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
def028b193b87150eeb974ece780b8476797f52aa2edc9d7031e35bb5d0edd15
e02af7df9a190d88380e2dcec2050ecaa493ae2d23526dbeec67f6907df3a752
e047eebaebf644af2f57dc6afa9c9a7d5fa4f33208dd743bf41de63a94f8b8a0
e22fdd35ef8fc1a8ce87251400d1c4399a0adaeeb4154dc4b92fd87e2b462157
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f28f970a6692700aa96cb9c6c78416f3ea6ecff1e7d3d78ac2fc04512fb1143f
f36a4e80fd0a1a2425f4f6a6f189607fef3ac00f0d2489bba3e654631312000e
f390fd55c3ab6ca1943271e33629116b2a93290decca83bc07734fdbef8f4d68
f54f5fd6427044fdfd7e8ac6b11c1f78eca62a95ee354378d5ce1b187eb44a09
f6f3776ab0769d072c7c9e5105533803fa8237bb1413db623d0241425c0e4c60
f77e8efca370d16dab04b2703f2d4387de471022e63f64a06af0e333cc3b6d70
fb2e7a84b08e9bf85c9f773bdcf35563f9479ece6cc560314ad31d57d69ed6bf
fd440a9b7a7346da2f42db953f73e67f147041b0f56c07a0b143368243eb8b6c
fd64397011b6d957086ac9b09d4b252ca01c75f22f77e924e920c3d1aeef783f

macleans.ca Open in urlscan Pro 104.18.27.168 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

223 Requests

79 %HTTPS

0 %IPv6

72 Domains

98 Subdomains

62 IPs

4 Countries

2985 kBTransfer

6739 kBSize

88 Cookies

12 Outgoing links

Page URL History

Redirected requests

223 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

macleans.ca Open in urlscan Pro
104.18.27.168 Public Scan

Screenshot
Live screenshot

Full Image

223
Requests

79 %
HTTPS

0 %
IPv6

72
Domains

98
Subdomains

62
IPs

4
Countries

2985 kB
Transfer

6739 kB
Size

88
Cookies

223 HTTP transactions
1 data transactions