www.winnipegfreepress.com Open in urlscan Pro
2a04:fa87:fffd::c000:4221 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://click.email.winnipegfreepress.com/?qs=aebc5b3ad7b704ece85d719f5c87b9e38de0290594b212f7daa0d011b0728a5f48eb4669f3c3f04708982aceee67...
Effective URL:
https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-...
Submission: On January 27 via manual (January 27th 2023, 9:03:53 pm UTC) from CA — Scanned from CA

Summary HTTP 162 Redirects Links 40 Behaviour Indicators

Summary

This website contacted 38 IPs in 4 countries across 24 domains to perform 162 HTTP transactions. The main IP is 2a04:fa87:fffd::c000:4221, located in Ireland and belongs to AUTOMATTIC, US. The main domain is www.winnipegfreepress.com. The Cisco Umbrella rank of the primary domain is 379188.
TLS certificate: Issued by R3 on January 26th 2023. Valid for: 3 months.

This is the only time www.winnipegfreepress.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	13.111.168.112 13.111.168.112	22606 (EXACT-7) (EXACT-7)
20	2a04:fa87:fff... 2a04:fa87:fffd::c000:4221	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2607:f8b0:400... 2607:f8b0:4006:81c::200a	15169 (GOOGLE) (GOOGLE)
5	2600:1400:d:5... 2600:1400:d:595::268b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2607:f8b0:400... 2607:f8b0:4006:809::200e	15169 (GOOGLE) (GOOGLE)
5	2607:f8b0:400... 2607:f8b0:4006:820::2003	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:80f::200a	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:824::200e	15169 (GOOGLE) (GOOGLE)
20	2607:f8b0:400... 2607:f8b0:4006:824::2002	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4006:80c::200e	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:81d::200d	15169 (GOOGLE) (GOOGLE)
4	2607:f8b0:400... 2607:f8b0:4006:820::2008	15169 (GOOGLE) (GOOGLE)
5	2606:2800:220... 2606:2800:220:de:468:2285:c1:4a3	15133 (EDGECAST) (EDGECAST)
11	2a03:2880:f01... 2a03:2880:f012:10c:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1	178.237.33.51 178.237.33.51	8455 (ATOM86-AS...) (ATOM86-AS ATOM86)
3	2607:f8b0:400... 2607:f8b0:4006:824::2003	15169 (GOOGLE) (GOOGLE)
4	86.109.7.56 86.109.7.56	54825 (PACKET) (PACKET)
11	2607:f8b0:400... 2607:f8b0:4006:80f::200e	15169 (GOOGLE) (GOOGLE)
2 4	142.250.80.70 142.250.80.70	15169 (GOOGLE) (GOOGLE)
1	2600:141b:13:... 2600:141b:13::17d7:8252	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	174.137.122.128 174.137.122.128	54668 (MARCHEX-EAST) (MARCHEX-EAST)
2	104.244.42.8 104.244.42.8	13414 (TWITTER) (TWITTER)
1	52.205.39.100 52.205.39.100	14618 (AMAZON-AES) (AMAZON-AES)
9	2a03:2880:f11... 2a03:2880:f112:182:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
4	2607:f8b0:400... 2607:f8b0:4004:c1b::9b	15169 (GOOGLE) (GOOGLE)
2	2600:9000:21e... 2600:9000:21ec:9000:2:53b2:240:93a1	16509 (AMAZON-02) (AMAZON-02)
4 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	2607:f8b0:400... 2607:f8b0:4006:821::2002	15169 (GOOGLE) (GOOGLE)
7	2607:f8b0:400... 2607:f8b0:4006:81c::2004	15169 (GOOGLE) (GOOGLE)
4	2607:f8b0:400... 2607:f8b0:4006:822::2003	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:809::2002	15169 (GOOGLE) (GOOGLE)
1	205.200.191.140 205.200.191.140	7122 (MTS-ASN) (MTS-ASN)
2	2001:4860:480... 2001:4860:4802:32::181	15169 (GOOGLE) (GOOGLE)
10	2607:f8b0:400... 2607:f8b0:4006:817::2001	15169 (GOOGLE) (GOOGLE)
4	145.40.89.32 145.40.89.32	54825 (PACKET) (PACKET)
4	2607:f8b0:400... 2607:f8b0:4006:81c::2002	15169 (GOOGLE) (GOOGLE)
162	38

1 13.111.168.112 (United States) 1 redirects

ASN22606 (EXACT-7, US)
PTR: click.email.winnipegfreepress.com

click.email.winnipegfreepress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a04:fa87:fffd::c000:4221 (Ireland)

ASN2635 (AUTOMATTIC, US)

www.winnipegfreepress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81c::200a (Nutley, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:1400:d:595::268b (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)

cdn.cxense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
scdn.cxense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:809::200e (Nutley, United States)

ASN15169 (GOOGLE, US)

www.googleoptimize.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:820::2003 (Nutley, United States)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80f::200a (Nutley, United States)

ASN15169 (GOOGLE, US)

translate.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:824::200e (Nutley, United States)

ASN15169 (GOOGLE, US)

translate.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2607:f8b0:4006:824::2002 (Nutley, United States)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:80c::200e (Nutley, United States)

ASN15169 (GOOGLE, US)

news.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81d::200d (Nutley, United States)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:820::2008 (Nutley, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:2800:220:de:468:2285:c1:4a3 (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a03:2880:f012:10c:face:b00c:0:3 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.237.33.51 (Rotterdam, Netherlands)

ASN8455 (ATOM86-AS ATOM86, NL)

ssl.geoplugin.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:824::2003 (Nutley, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 86.109.7.56 (Ashburn, United States)

ASN54825 (PACKET, US)

api.cxense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2607:f8b0:4006:80f::200e (Nutley, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.80.70 (Glen Cove, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s35-in-f6.1e100.net

10441863.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:13::17d7:8252 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 174.137.122.128 (United States)

ASN54668 (MARCHEX-EAST, US)

rw1.marchex.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.8 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.205.39.100 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-205-39-100.compute-1.amazonaws.com

winnipeg-free-press-snowplow-collector.localnewslab.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c1b::9b (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:21ec:9000:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.linkedin.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:821::2002 (Nutley, United States)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2607:f8b0:4006:81c::2004 (Nutley, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:822::2003 (Nutley, United States)

ASN15169 (GOOGLE, US)

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:809::2002 (Nutley, United States)

ASN15169 (GOOGLE, US)

adservice.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.200.191.140 (Winnipeg, Canada)

ASN7122 (MTS-ASN, CA)
PTR: 205-200-200-191-140.static.bellmts.net

account.winnipegfreepress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2607:f8b0:4006:817::2001 (Nutley, United States)

ASN15169 (GOOGLE, US)

06152dbe7ff498f171de46fc2c988bb1.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 145.40.89.32 (Ashburn, United States)

ASN54825 (PACKET, US)

comcluster.cxense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p1cluster.cxense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
id.cxense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:81c::2002 (Nutley, United States)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	doubleclick.net 2 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 190 10441863.fls.doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 78	208 KB
22	winnipegfreepress.com 1 redirects click.email.winnipegfreepress.com www.winnipegfreepress.com — Cisco Umbrella Rank: 379188 account.winnipegfreepress.com	525 KB
17	google.com translate.google.com — Cisco Umbrella Rank: 1198 news.google.com — Cisco Umbrella Rank: 5696 accounts.google.com — Cisco Umbrella Rank: 75 adservice.google.com — Cisco Umbrella Rank: 70 www.google.com — Cisco Umbrella Rank: 2 analytics.google.com — Cisco Umbrella Rank: 334	179 KB
16	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 104 06152dbe7ff498f171de46fc2c988bb1.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 149	248 KB
13	cxense.com cdn.cxense.com — Cisco Umbrella Rank: 4746 scdn.cxense.com — Cisco Umbrella Rank: 12385 api.cxense.com — Cisco Umbrella Rank: 8911 comcluster.cxense.com — Cisco Umbrella Rank: 5764 p1cluster.cxense.com — Cisco Umbrella Rank: 8155 id.cxense.com — Cisco Umbrella Rank: 10944	124 KB
11	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 21	21 KB
9	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	41 KB
8	gstatic.com www.gstatic.com fonts.gstatic.com	107 KB
7	twitter.com platform.twitter.com — Cisco Umbrella Rank: 738 syndication.twitter.com — Cisco Umbrella Rank: 1011	163 KB
6	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 824	407 KB
6	google.ca www.google.ca — Cisco Umbrella Rank: 8067 adservice.google.ca — Cisco Umbrella Rank: 12466	1 KB
5	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 353 www.linkedin.com — Cisco Umbrella Rank: 575 px4.ads.linkedin.com — Cisco Umbrella Rank: 6074	4 KB
5	facebook.net connect.facebook.net — Cisco Umbrella Rank: 146	224 KB
4	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 186	193 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	257 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 34 translate.googleapis.com — Cisco Umbrella Rank: 823	79 KB
2	oribi.io cdn.linkedin.oribi.io — Cisco Umbrella Rank: 814	735 B
2	marchex.io rw1.marchex.io — Cisco Umbrella Rank: 26954	12 KB
2	wp.com stats.wp.com — Cisco Umbrella Rank: 2634 pixel.wp.com — Cisco Umbrella Rank: 2462	3 KB
1	localnewslab.io winnipeg-free-press-snowplow-collector.localnewslab.io	317 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 707	5 KB
1	geoplugin.net ssl.geoplugin.net — Cisco Umbrella Rank: 39296	322 B
1	googleoptimize.com www.googleoptimize.com — Cisco Umbrella Rank: 925	46 KB
0	districtm.ca Failed cdn.districtm.ca Failed
162	24

	Domain	Requested by
20	www.winnipegfreepress.com	www.winnipegfreepress.com
14	securepubads.g.doubleclick.net	www.winnipegfreepress.com securepubads.g.doubleclick.net www.googletagservices.com
11	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
9	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
9	www.facebook.com	www.winnipegfreepress.com connect.facebook.net
7	www.google.com	www.winnipegfreepress.com securepubads.g.doubleclick.net tpc.googlesyndication.com
6	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
6	static.xx.fbcdn.net	www.facebook.com
5	connect.facebook.net	www.winnipegfreepress.com connect.facebook.net
5	platform.twitter.com	www.winnipegfreepress.com platform.twitter.com
5	www.gstatic.com	www.winnipegfreepress.com translate.googleapis.com
4	www.googletagservices.com	securepubads.g.doubleclick.net
4	www.google.ca	www.winnipegfreepress.com
4	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
4	10441863.fls.doubleclick.net	2 redirects www.googletagmanager.com
4	api.cxense.com	cdn.cxense.com
4	www.googletagmanager.com	www.winnipegfreepress.com www.googleoptimize.com
3	adservice.google.com	10441863.fls.doubleclick.net securepubads.g.doubleclick.net
3	px.ads.linkedin.com	3 redirects
3	fonts.gstatic.com	fonts.googleapis.com
3	news.google.com	www.winnipegfreepress.com news.google.com
3	cdn.cxense.com	www.winnipegfreepress.com cdn.cxense.com
2	comcluster.cxense.com	cdn.cxense.com
2	analytics.google.com	www.googletagmanager.com
2	adservice.google.ca	adservice.google.com securepubads.g.doubleclick.net
2	cdn.linkedin.oribi.io	snap.licdn.com
2	syndication.twitter.com	platform.twitter.com www.winnipegfreepress.com
2	rw1.marchex.io	www.googletagmanager.com rw1.marchex.io
2	scdn.cxense.com	www.winnipegfreepress.com
2	translate.googleapis.com	www.winnipegfreepress.com
1	id.cxense.com	cdn.cxense.com
1	p1cluster.cxense.com	cdn.cxense.com
1	06152dbe7ff498f171de46fc2c988bb1.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	account.winnipegfreepress.com	www.winnipegfreepress.com
1	px4.ads.linkedin.com	www.winnipegfreepress.com
1	www.linkedin.com	1 redirects
1	winnipeg-free-press-snowplow-collector.localnewslab.io	www.winnipegfreepress.com
1	snap.licdn.com	www.googletagmanager.com
1	pixel.wp.com	www.winnipegfreepress.com
1	ssl.geoplugin.net	www.winnipegfreepress.com
1	stats.wp.com	www.winnipegfreepress.com
1	accounts.google.com	www.winnipegfreepress.com
1	translate.google.com	www.winnipegfreepress.com
1	www.googleoptimize.com	www.winnipegfreepress.com
1	fonts.googleapis.com	www.winnipegfreepress.com
1	click.email.winnipegfreepress.com	1 redirects
0	cdn.districtm.ca Failed	securepubads.g.doubleclick.net
162	47

This site contains links to these domains. Also see Links.

Domain
account.winnipegfreepress.com
ee.winnipegfreepress.com
winnipeg-can.newsmemory.com
www.fpnewspapers.com
archives.winnipegfreepress.com
marketplace.winnipegfreepress.com
homes.winnipegfreepress.com
fpnewsplatform.winnipegfreepress.com
passages.winnipegfreepress.com
store.winnipegfreepress.com
www.facebook.com
twitter.com
instagram.com
journa.host

Subject Issuer	Validity	Valid
winnipegfreepress.com R3	`2023-01-26` - `2023-04-26`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.cxense.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-17` - `2023-04-17`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.news.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
accounts.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-06` - `2023-11-06`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-11-06` - `2023-02-04`	3 months	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-14` - `2023-12-15`	a year	crt.sh
ssl.geoplugin.net Sectigo RSA Domain Validation Secure Server CA	`2022-04-21` - `2023-04-21`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
*.marchex.io GeoTrust RSA CA 2018	`2022-06-21` - `2023-06-21`	a year	crt.sh
syndication.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2022-02-22` - `2023-02-22`	a year	crt.sh
*.localnewslab.io Amazon	`2022-08-17` - `2023-09-13`	a year	crt.sh
linkedin.oribi.io Amazon	`2022-07-07` - `2023-08-06`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.google.ca GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh

This page contains 21 frames:

Primary Page: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Frame ID: C0C8E3316C07ADC81B782B8BA859096F
Requests: 110 HTTP requests in this frame

Frame: data://truncated
Frame ID: 5D137E8F348FD4461175522BCF5E4E06
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.winnipegfreepress.com
Frame ID: C46CFCC83479781D931EC64C90038CA7
Requests: 2 HTTP requests in this frame

Frame: https://10441863.fls.doubleclick.net/activityi;dc_pre=CJ3np5zT6PwCFdkKaAgdlbwF8Q;src=10441863;type=traff0;cat=lokno00;ord=6286165176138;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing
Frame ID: DA30B5C1AEEC7278F123E16B094AEA93
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CJ3np5zT6PwCFdkKaAgdlbwF8Q;src=10441863;type=traff0;cat=lokno00;ord=6286165176138;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing
Frame ID: 42F96D846595A1AD86911603393A18F5
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.2b2d73daf636805223fb11d48f3e94f7.en.html
Frame ID: AA464588E21528242558FAFCA7040907
Requests: 2 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.2b2d73daf636805223fb11d48f3e94f7.en.html
Frame ID: 4539C2DC0D9FDDF8E3CB3F3554FDE43F
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.ca/ddm/fls/i/dc_pre=CJ3np5zT6PwCFdkKaAgdlbwF8Q;src=10441863;type=traff0;cat=lokno00;ord=6286165176138;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing
Frame ID: EC989CA1C4B69C5E803940DF293CCA48
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 3AEB8BEF1E766D7843E7B8312424414B
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/v5.0/plugins/share_button.php?app_id=129054303830226&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df131de819884e1%26domain%3Dwww.winnipegfreepress.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.winnipegfreepress.com%252Ff2df0d1564bf344%26relation%3Dparent.parent&container_width=34&href=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&layout=button_count&locale=en_US&sdk=joey&size=small
Frame ID: D222A3026082E16C765658BA38D182B3
Requests: 3 HTTP requests in this frame

Frame: https://www.facebook.com/v5.0/plugins/share_button.php?app_id=129054303830226&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df36e3871ea298ec%26domain%3Dwww.winnipegfreepress.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.winnipegfreepress.com%252Ff2df0d1564bf344%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&layout=button_count&locale=en_US&sdk=joey&size=small
Frame ID: CDB474092C9A1821B25E7A91BC07530E
Requests: 3 HTTP requests in this frame

Frame: https://www.facebook.com/v5.0/plugins/share_button.php?app_id=129054303830226&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df38375f52547ce%26domain%3Dwww.winnipegfreepress.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.winnipegfreepress.com%252Ff2df0d1564bf344%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&layout=button_count&locale=en_US&sdk=joey&size=small
Frame ID: 443C5F5593AD1C3E7FE224CE70C2E454
Requests: 3 HTTP requests in this frame

Frame: https://06152dbe7ff498f171de46fc2c988bb1.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: D5048C61D4A2997A629D33DDBCBDA610
Requests: 1 HTTP requests in this frame

Frame: https://cdn.cxense.com/sp1.html
Frame ID: 3E49ABDC12C1352C6C7C764CF9BA27EC
Requests: 4 HTTP requests in this frame

Frame: https://10441863.fls.doubleclick.net/activityi;dc_pre=CPmFjp3T6PwCFYitnwodcaUIdQ;src=10441863;type=traff0;cat=lokno006;ord=495237738078;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing
Frame ID: AFF155746EA3C08BFBB0E888262B9512
Requests: 2 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsseyWnGRzJ4PbF3Xf3SoWJO3K95h9oFaGRo16jcsvd4p2GjbTqySQog0eibxAPy2kau2dJeHnxNYAJY1XBWS9Gyi-4OKkPWSPmxId21Et4hsrccp7gwNUfmSgD_LCIOFiwc_oMR7zrXEWlL0ZaBZluIdFbJd40p-pqE_V8EgMdKkPNJW-nQDZz0RRzrloUNQWA6r-5wTgGrZK3cx1qE9hOh_8RCDMAJT1ymKs50YlYaHZx6Z7IW69pDllaoe-2eShWU_e8o61z0IIghS-ivWfnBSW4soLqoX0prePxYfYvGJ9e_usi_WjA6x3_HBCfjhILm6c8Fdi0mAlmVt8-HIAAN&sai=AMfl-YTlgrAXpM-gLULGwT13WBRr5no0XSAX24oWNoMmJ-vpM6E87xDtpY3kkR1CwSXXoFEMeSwzF_etEjnupOhmETETJrQGjB4DN67l_8tFLpINwaldygvl4zM5kXosa7I0hw&sig=Cg0ArKJSzGAkQVuzOLraEAE&uach_m=[UACH]&adurl=
Frame ID: 56A1BA67DC1692954F125B21A6A2331D
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssl8cJ-5O6oKU8KD3B_UoJ0RdltN7hTQDYJyMMgWTVAT0gPdkCnF-PUl4yjdd4h2fhKzdAxOlkZDM1IN2V3a_PUO6fSXQZ4s3u7LUZrIOyp_teFEVh_OV-M8ewTmX6MNRf1_8ZDYWvOoHbGcWKRNA4r5c8XQ_xe1UQl2Su0VYlpyQrO0gItq2ws1Nh4fU8xJobrn7D1YaW_UERzGQd1lKfxEf7l8NMuDbpUpzj2OOSdpFaa-wg7NfCcm8synvHn26IeWUsJYmDz-vec9vmoEnjeZ9qggQHlc6QiBvZhLLiJxp9HM15pyoMY-RAML1PUg19xXMmnJQv4-c1wZwMIYh8R&sai=AMfl-YSNWx1H0q3_OjzJGHg9zTTw1Or9n0UIhOQCFeIcHUCz2-_nt8kUvY5O-73tb8kbMIPXZm3sjf6qkBiIDmPZmqSEXQutnGAGfNRvRT38Uq5WRLYZeaMEVRHUnZCGRxDN&sig=Cg0ArKJSzO2v2tyktfpNEAE&uach_m=[UACH]&adurl=
Frame ID: C51761E93F93EB979FA7E48FBA33815A
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstlHF81JmfWVuZtXcRgiLoP-I2GQpzYy-K5JiQ0StMUOgcdZigVKBqFGJLdFFZFvi_oYMeIsO0ECj2fhhoTwc-mkjZo_Y4dS-DAqLkNMKTTkASW23b4kVSsycJpRw0kLHQ6nS7mo10P2boGq3-r5883YUc_EH1ScXgjSU85_-uuIIoJbKCqIpI_xpm25M-ewESrW3Sof2AGePp9406gb5us_r8MdUYGJQffzNenKVP2WN4RlcKkJ21vP2o8BmZRFnj1wnBwDGqtEAVdsXww4UU-5jAhFeUg5H9bEpG8PeyFtyqllCOivLDaTe8GZswGwoycy7hsxk4pn77iJ0gAJ1SI3gk3&sai=AMfl-YT6axha5DypFCv0pmYB3DWN2gJURfWlaML69SA2rU316mD6GVBnVcnZ4kxhq91UFwlRfHxk5MSwBQ4iBj4K7TEMrecc_T_MTHJCNH_qhtDOCmnlEZ4yB5ai5R3L65HPlg&sig=Cg0ArKJSzCLMZEwqyoT1EAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: 9BCC7CDBB005332F6CBF1B363456F150
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvvOWJXXmXOstI34hhXuUmCpAKvjkvnkIEh5yqdzgn4xJL0NxETFn2JNilAaflDpeBqM4LHGPO8ohlgQhZ_ZzqhabH-J0u8ZBRjgE2-9rRi8pnSq48uMyhFFop4i-MkzBprKKZIq73vgeXEI5avCl795wTkWwjHqU9SMQ9ngBSVklh-SlF4I7_vSSu0QWCP9ZXAYEY_vVgj5S96HT7miiVNvZLrvJF5FHHrqcLqAbzIuHP-vV3G59CvUbyE3HlyS_M_bfPmBRWnUullGnGg-5QJLt-Y5bIaN3EkWik3ynB442RslBHgKiwj_sjdG7q0L9u82mVDgUWwFd9OF9L9_47V&sai=AMfl-YTnY-uPwLGGcrmsxb0xG1239KAuKcO7MeaMWqR-rhfa1k2aRy5jI1ptFSMITvWDUJU1KhvocgQOR4-ba6VEhpTcrmNorOwdAsAxwJ3CMg_3nP59emEOdYm6eLuts3A6&sig=Cg0ArKJSzOm9Ir-nsLZSEAE&uach_m=[UACH]&adurl=
Frame ID: A1BAEEDE359A023A6E592170F76862A0
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: AD59C9B195A03C9AF8477A1B6F5E953E
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 767FA00AABF4FCAAF811453E16B7364F
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Lower patient volumes at Children’s Hospital likely calm before expected storm, ER director says – Winnipeg Free Press

Page URL History Show full URLs

https://click.email.winnipegfreepress.com/?qs=aebc5b3ad7b704ece85d719f5c87b9e38de0290594b212f7daa0d011b0728a5f48eb4669... HTTP 302
https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-c... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Firebase (Databases) Expand

Overall confidence: 100%
Detected patterns

/firebasejs/([\d.]+)/firebase

Google Sign-in (Social logins) Expand

Overall confidence: 100%
Detected patterns

accounts\.google\.com/gsi/client

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Optimize (A/B Testing) Expand

Overall confidence: 100%
Detected patterns

googleoptimize\.com/optimize\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Lightbox (JavaScript Libraries) Expand

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

Page Statistics

162
Requests

99 %
HTTPS

71 %
IPv6

24
Domains

47
Subdomains

38
IPs

4
Countries

2842 kB
Transfer

8210 kB
Size

30
Cookies

40 Outgoing links

These are links going to different origins than the main page.

URL: https://account.winnipegfreepress.com/email-alerts
Title: Subscribe to Newsletters

Search URL Search Domain Scan URL

URL: https://account.winnipegfreepress.com/home
Title: My Account

Search URL Search Domain Scan URL

URL: https://account.winnipegfreepress.com/logout
Title: Log Out

Search URL Search Domain Scan URL

URL: https://account.winnipegfreepress.com/login
Title: Log in

Search URL Search Domain Scan URL

URL: https://account.winnipegfreepress.com/register
Title: Create Account

Search URL Search Domain Scan URL

URL: http://ee.winnipegfreepress.com/
Title: Winnipeg Free Press

Search URL Search Domain Scan URL

URL: https://winnipeg-can.newsmemory.com/?special=Community+Review+East
Title: Community Review East

Search URL Search Domain Scan URL

URL: https://winnipeg-can.newsmemory.com/?special=Community+Review+West
Title: Community Review West

Search URL Search Domain Scan URL

URL: http://www.fpnewspapers.com/
Title: FP Newspapers Inc.

Search URL Search Domain Scan URL

URL: https://archives.winnipegfreepress.com/
Title: Archives

Search URL Search Domain Scan URL

URL: https://marketplace.winnipegfreepress.com/
Title: Classifieds

Search URL Search Domain Scan URL

URL: https://homes.winnipegfreepress.com/winnipeg-real-estate/
Title: Property Listings

Search URL Search Domain Scan URL

URL: https://homes.winnipegfreepress.com/winnipeg-real-estate-news/category-featured/
Title: Featured News

Search URL Search Domain Scan URL

URL: https://homes.winnipegfreepress.com/winnipeg-real-estate-news/category-renovation-design/
Title: Renovation and design

Search URL Search Domain Scan URL

URL: https://homes.winnipegfreepress.com/winnipeg-real-estate-news/category-new-homes/
Title: New homes

Search URL Search Domain Scan URL

URL: https://homes.winnipegfreepress.com/winnipeg-real-estate-news/category-resale-homes/
Title: Resale homes

Search URL Search Domain Scan URL

URL: https://fpnewsplatform.winnipegfreepress.com/email-alerts/
Title: Newsletters

Search URL Search Domain Scan URL

URL: https://passages.winnipegfreepress.com/
Title: Obituaries

Search URL Search Domain Scan URL

URL: https://store.winnipegfreepress.com/
Title: Photo and Book store

Search URL Search Domain Scan URL

URL: https://www.facebook.com/winnipegfreepress

Search URL Search Domain Scan URL

URL: https://twitter.com/winnipegnews

Search URL Search Domain Scan URL

URL: https://instagram.com/winnipegfreepress/

Search URL Search Domain Scan URL

URL: https://journa.host/@winnipegfreepress

Search URL Search Domain Scan URL

URL: http://marketplace.winnipegfreepress.com/
Title: Classifieds

Search URL Search Domain Scan URL

URL: http://store.winnipegfreepress.com/
Title: Photo and Book store

Search URL Search Domain Scan URL

URL: http://archives.winnipegfreepress.com/
Title: Archives

Search URL Search Domain Scan URL

URL: https://account.winnipegfreepress.com/pages/support
Title: Pay it Forward program

Search URL Search Domain Scan URL

URL: https://ee.winnipegfreepress.com/
Title: E-Edition

Search URL Search Domain Scan URL

URL: https://homes.winnipegfreepress.com/winnipeg-real-estate
Title: Homes

Search URL Search Domain Scan URL

URL: http://marketplace.winnipegfreepress.com/winnipeg/announcements/search/
Title: Announcements

Search URL Search Domain Scan URL

URL: http://marketplace.winnipegfreepress.com/winnipeg/automotive/search/
Title: Automotive

Search URL Search Domain Scan URL

URL: http://marketplace.winnipegfreepress.com/winnipeg/careers/search/
Title: Careers

Search URL Search Domain Scan URL

URL: http://marketplace.winnipegfreepress.com/winnipeg/garage-sales/search/
Title: Garage Sales

Search URL Search Domain Scan URL

URL: http://marketplace.winnipegfreepress.com/winnipeg/merchandise/search/
Title: Merchandise

Search URL Search Domain Scan URL

URL: http://marketplace.winnipegfreepress.com/winnipeg/pets/search/
Title: Pets

Search URL Search Domain Scan URL

URL: http://marketplace.winnipegfreepress.com/winnipeg/real-estate/search/
Title: Real Estate

Search URL Search Domain Scan URL

URL: http://marketplace.winnipegfreepress.com/winnipeg/rentals/search/
Title: Rentals

Search URL Search Domain Scan URL

URL: http://marketplace.winnipegfreepress.com/winnipeg/services/search/
Title: Services

Search URL Search Domain Scan URL

URL: https://account.winnipegfreepress.com/casl
Title: CASL agreement

Search URL Search Domain Scan URL

URL: https://account.winnipegfreepress.com/login?fromArticle=1&rurl=https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says
Title: Log in here »

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://click.email.winnipegfreepress.com/?qs=aebc5b3ad7b704ece85d719f5c87b9e38de0290594b212f7daa0d011b0728a5f48eb4669f3c3f04708982aceee67073d3710e5fd54fe9e91f3232ea59304d386 HTTP 302
https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 58

https://10441863.fls.doubleclick.net/activityi;src=10441863;type=traff0;cat=lokno00;ord=6286165176138;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing HTTP 302
https://10441863.fls.doubleclick.net/activityi;dc_pre=CJ3np5zT6PwCFdkKaAgdlbwF8Q;src=10441863;type=traff0;cat=lokno00;ord=6286165176138;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing

Request Chain 71

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3300905&time=1674853426580&url=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3300905&time=1674853426580&url=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3300905%26time%3D1674853426580%26url%3Dhttps%253A%252F%252Fwww.winnipegfreepress.com%252Fbreakingnews%252F2022%252F12%252F06%252Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%253Futm_source%253DSalesforce%2526utm_medium%253DEmail%2526utm_campaign%253DCOVIDBriefing%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3300905&time=1674853426580&url=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3300905&time=1674853426580&url=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&cookiesTest=true&liSync=true&e_ipv6=AQKpSJbmd6D3xAAAAYX1CydJh_t1-_g9Ezg_3_s83ln9tN6keJXZvqujozKp9XMrEM9bFpm-aQ

Request Chain 122

https://10441863.fls.doubleclick.net/activityi;src=10441863;type=traff0;cat=lokno006;ord=495237738078;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing HTTP 302
https://10441863.fls.doubleclick.net/activityi;dc_pre=CPmFjp3T6PwCFYitnwodcaUIdQ;src=10441863;type=traff0;cat=lokno006;ord=495237738078;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing

162 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says Show response
www.winnipegfreepress.com/breakingnews/2022/12/06/
Redirect Chain

https://click.email.winnipegfreepress.com/?qs=aebc5b3ad7b704ece85d719f5c87b9e38de0290594b212f7daa0d011b0728a5f48eb4669f3c3f04708982aceee67073d3710e5fd54fe9e91f3232ea59304d386
https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_c...

128 KB
22 KB

851ms
786ms

Document
text/html

2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx / WordPress VIP <https://wpvip.com>
Resource Hash: f794ca085ef660ac32c0f77ac6f598c07faec676c8e67b554e5e8eb9e1197eae

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
cache-control: max-age=300, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 27 Jan 2023 21:03:45 GMT
host-header: a9130478a60e5f9135f765b23f26593b
link: <https://www.winnipegfreepress.com/wp-json/>; rel="https://api.w.org/" <https://www.winnipegfreepress.com/wp-json/wp/v2/posts/600192247>; rel="alternate"; type="application/json" <https://www.winnipegfreepress.com/?p=600192247>; rel=shortlink
server: nginx
vary: Accept-Encoding
x-cache: miss
x-hacker: If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.
x-powered-by: WordPress VIP <https://wpvip.com>
x-rq: yyz4 0 2 9980
x-tec-api-origin: https://www.winnipegfreepress.com
x-tec-api-root: https://www.winnipegfreepress.com/wp-json/tribe/events/v1/
x-tec-api-version: v1

Redirect headers

Cache-Control: private
Connection: close
Content-Length: 343
Content-Type: text/html; charset=utf-8
Date: Fri, 27 Jan 2023 21:03:44 GMT
Location: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing

GET
H2 200 gdpr.js Show response
www.winnipegfreepress.com/wp-content/themes/fp-inc-base-theme/static/ 3 KB
1 KB 18ms
17ms Script
application/javascript 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.winnipegfreepress.com/wp-content/themes/fp-inc-base-theme/static/gdpr.js
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: c5ce035dca06b1c179cc4ca71de026bb6bf0ce9e13c31a6d1c0141bca2b35b69

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
x-rq: yyz4 0 2 9980
content-encoding: gzip
last-modified: Thu, 12 Jan 2023 21:46:10 GMT
server: nginx
age: 599159
etag: W/"63c07fa2-c86"
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 1393
expires: Sat, 27 Jan 2024 21:03:45 GMT

GET
H2 200 css2
fonts.googleapis.com/ 29 KB
2 KB 88ms
37ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Open+Sans+Condensed:ital,wght@0,300;0,700;1,300&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;1,300;1,400;1,600;1,700&display=swap

Requested by

Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

677e13931343c9c296edbe034e6ce78a815ebfd4de447675838f2b833efb69ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 27 Jan 2023 21:03:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 27 Jan 2023 21:00:23 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 27 Jan 2023 21:03:45 GMT

GET
H/1.1 200
OK cx.js Show response
cdn.cxense.com/ 107 KB
34 KB 82ms
39ms Script
application/x-javascript 2600:1400:d:595::268b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cxense.com/cx.js
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:595::268b New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: da99004a3dd3736a976dbff7dfe56ebf70076475ba4e60d67506dead66e38ee4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 21:03:45 GMT
Content-Encoding: gzip
Last-Modified: Fri, 20 Jan 2023 05:10:31 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 34709
Expires: Fri, 27 Jan 2023 22:03:45 GMT

GET
H2 200 optimize.js Show response
www.googleoptimize.com/ 119 KB
46 KB 106ms
42ms Script
application/javascript 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleoptimize.com/optimize.js?id=OPT-WQ2K7LM

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

58e308d9b970616ecc6e1fecd78c73de072bce5d42b21c97bdf21223fe74188c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 46251
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 27 Jan 2023 21:03:45 GMT

GET
H2 200 firebase-app.js Show response
www.gstatic.com/firebasejs/8.10.1/ 22 KB
7 KB 71ms
20ms Script
text/javascript 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/firebasejs/8.10.1/firebase-app.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7928369a406440002cb4b79ce79e2374bb580a6f189a16db2e400cdfa80e3130

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 26 Jan 2023 04:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 146972
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7003
x-xss-protection: 0
last-modified: Fri, 28 Jan 2022 20:19:14 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
vary: Accept-Encoding
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 26 Jan 2024 04:14:13 GMT

GET
H2 200 firebase-analytics.js Show response
www.gstatic.com/firebasejs/8.10.1/ 35 KB
11 KB 77ms
27ms Script
text/javascript 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/firebasejs/8.10.1/firebase-analytics.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f114e062db8d6e28b27679e95a074ca452faeb799cc6c04b4189fd04f5dcbe9f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 14:55:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 367698
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10768
x-xss-protection: 0
last-modified: Fri, 28 Jan 2022 20:19:11 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
vary: Accept-Encoding
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 23 Jan 2024 14:55:27 GMT

GET
H2 200 firebase-messaging.js Show response
www.gstatic.com/firebasejs/8.10.1/ 40 KB
11 KB 73ms
22ms Script
text/javascript 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/firebasejs/8.10.1/firebase-messaging.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

69df19aa714c324e70896cd5cc834d9dcc1080b58b2e771e86df18ab10b20859

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 26 Jan 2023 06:12:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 139899
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10881
x-xss-protection: 0
last-modified: Fri, 28 Jan 2022 20:19:08 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
vary: Accept-Encoding
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 26 Jan 2024 06:12:06 GMT

GET
H2 200 translateelement.css
translate.googleapis.com/translate_static/css/ 22 KB
4 KB 78ms
21ms Stylesheet
text/css 2607:f8b0:4006:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://translate.googleapis.com/translate_static/css/translateelement.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::200a Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8953492dba77df435e5fbcd568b638fe049279d04fa0403f859d33e72fea74e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 20:51:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 764
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3632
x-xss-protection: 0
last-modified: Mon, 09 Jan 2023 20:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="rosetta"
vary: Accept-Encoding
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 27 Jan 2023 21:51:01 GMT

GET
H2 200 element.js Show response
translate.google.com/translate_a/ 75 KB
26 KB 119ms
52ms Script
text/javascript 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

74d22fe95c00677f82c878401c5b0670e17d8ef28221b9522d238ab43bc1a172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 80 KB
27 KB 124ms
53ms Script
text/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3b461509de6adf272cd83823068db4ddbf4622882fe8962b8fd73e473d212828

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27582
x-xss-protection: 0
server: sffe
etag: "1465 / 819 of 1000 / last-modified: 1674821399"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 27 Jan 2023 21:03:46 GMT

GET
H2 200 swg.js Show response
news.google.com/swg/js/v1/ 161 KB
49 KB 95ms
25ms Script
text/javascript 2607:f8b0:4006:80c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/js/v1/swg.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1936d94a7cc2ffa181c260469cd7fd27c8b96fc9c255ef3e954b1ac445b7a26a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 20:54:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 539
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/news-frontend
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50295
x-xss-protection: 0
last-modified: Wed, 25 Jan 2023 19:05:16 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="news-frontend"
vary: Accept-Encoding
report-to: {"group":"news-frontend","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/news-frontend"}]}
content-type: text/javascript
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Fri, 27 Jan 2023 21:44:46 GMT

GET
H2 200 swg-gaa.js Show response
news.google.com/swg/js/v1/ 62 KB
18 KB 88ms
19ms Script
text/javascript 2607:f8b0:4006:80c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/js/v1/swg-gaa.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d31fd2b62ba0b51cc44964170e2374b0ed22b61fc82ab34d14634cac7dc92056

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 20:54:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 539
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/news-frontend
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18217
x-xss-protection: 0
last-modified: Wed, 25 Jan 2023 19:05:16 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="news-frontend"
vary: Accept-Encoding
report-to: {"group":"news-frontend","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/news-frontend"}]}
content-type: text/javascript
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Fri, 27 Jan 2023 21:44:46 GMT

GET
H2 200 client Show response
accounts.google.com/gsi/ 192 KB
76 KB 125ms
55ms Script
application/javascript 2607:f8b0:4006:81d::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/gsi/client

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::200d Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

340060d270e292d9c066576ab7f4011753de5d735a72b36056c79586b5e351bc

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-9KL1q-JjDB6crIce0VopRw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:46 GMT
content-security-policy: script-src 'report-sample' 'nonce-9KL1q-JjDB6crIce0VopRw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
report-to: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=1800
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires: Fri, 27 Jan 2023 21:03:46 GMT

GET
H/1.1 200
OK cx.cce.js Show response
scdn.cxense.com/ 23 KB
6 KB 90ms
24ms Script
application/x-javascript 2600:1400:d:595::268b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://scdn.cxense.com/cx.cce.js
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:595::268b New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 5b4c012c740d120a384871f05af3184799f6e2b607767a5d6229e2a82aac103b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 21:03:45 GMT
Content-Encoding: gzip
Last-Modified: Fri, 07 Oct 2022 14:05:13 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5959
Expires: Fri, 27 Jan 2023 22:03:45 GMT

GET
H/1.1 200
OK cx.js Show response
scdn.cxense.com/ 107 KB
34 KB 31ms
31ms Script
application/x-javascript 2600:1400:d:595::268b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://scdn.cxense.com/cx.js
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:595::268b New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: da99004a3dd3736a976dbff7dfe56ebf70076475ba4e60d67506dead66e38ee4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 21:03:45 GMT
Content-Encoding: gzip
Last-Modified: Fri, 20 Jan 2023 05:10:31 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 34709
Expires: Fri, 27 Jan 2023 22:03:45 GMT

GET
H2 200 /
www.winnipegfreepress.com/_static/ 108 KB
15 KB 18ms
18ms Stylesheet
text/css 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.winnipegfreepress.com/_static/??-eJyNj9EOgjAMRX/I0RhQeTF+y+gamJaxrCVmf+/AaCDxwcfb3tPeC89ofECeHQmgCDgvCh1P+DDsu2RTBtHMVI0+VMVwgC1xFxjJeUtMIwXdicg2UzJMvcX8H152W72DcAq6vphN5Ln3QUDIJhyA2Ip6jIk++ZciqYyVnImTqJh3o7WJ/M6yMFguiUejQ/n/9d3G6/F8aU5t3bT1CyeQcfA=
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: b395a9adbc18174a906ebe2c585487fc17c24c5a6976b8f4e1b67cc7cb0ba804

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
x-rq: yyz4 0 2 9980
content-encoding: gzip
last-modified: Tue, 24 Jan 2023 18:04:43 GMT
server: nginx
age: 267921
vary: Accept-Encoding
x-cache: hit
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 15666

GET
H2 200 /
www.winnipegfreepress.com/_static/ 286 KB
60 KB 24ms
23ms Stylesheet
text/css 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.winnipegfreepress.com/_static/??-eJydkE2uwjAMhC+EY0W00LdAnCVNXRpe/lS7FG5PKEJiAUiwsmXPfBob5ww2RaEomP10cJHRu8MgbTpDHpIknl0mNMwkjJkrZLl4YuyoN5MXZZlX+ESx3pUCYYIHrx+XVVfALfalNzNxCgSnWulaVSq4+C1mSTVCO8XOF1Cj1kr/wnFRxnTkl1YZKJRD+wwuWmgNEyyj+wfeyeei/yR7SnIkycb+g9Zqi0X3GNw8+7DTm21VN+vqr7kCno6bNA==
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f7883efa3124b96e5095cddcc1b8c8cb232e0d0c84b277f657ca0e9ce5acee34

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
x-rq: yyz4 0 2 9980
content-encoding: gzip
last-modified: Tue, 24 Jan 2023 18:04:58 GMT
server: nginx
age: 267921
vary: Accept-Encoding
x-cache: hit
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 61454

GET
H2 200 / Show response
www.winnipegfreepress.com/_static/ 559 KB
165 KB 36ms
35ms Script
application/javascript 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.winnipegfreepress.com/_static/??-eJytkbtuwzAMRX+okmLHeSxFh/xAt86yRDs09Col2Ui/PkqQol0C1EIBARxEHhxeiiUw5V0Cl4QyWAqzmQWTR3RRDHT/0sJgL7S8TJHNDW82/MAtOj7FF/H3+QHdCBQIXWpvmCPfV1DO0mkDvaSi0hWPtSY/899D6JTJGqKYyvvMQJdH+U1+2sQsjiQTrNRYhiBDWLm79RrI4RdV5BYXDECsz7f12XzkW95UYMrxyD8LBq0cIRovNegK9iN1Autn+DhjghikKrKbIrutBypvTBE7yZDQu//CvZsc61jBx1Ta3+xrsz90bdftdu10Be0MTdY=
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: a5103dc30d2fd81858efc150e8b8b4547823a322a2efa2cb49d9fbf330ec3ad0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
x-rq: yyz4 0 2 9980
content-encoding: gzip
last-modified: Fri, 20 Jan 2023 19:55:52 GMT
server: nginx
age: 599116
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 168195

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 110 KB
43 KB 92ms
38ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-350959-63

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a1bbd21a4992182e76a30f66098bfb85d7435dda13f39a79ace6215a286474fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 43955
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 27 Jan 2023 21:03:45 GMT

GET
H2 200 h.png
www.winnipegfreepress.com/wp-content/themes/fp-inc-base-theme/images/weather/icons-png/ 3 KB
3 KB 29ms
24ms Image
image/png 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.winnipegfreepress.com/wp-content/themes/fp-inc-base-theme/images/weather/icons-png/h.png
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e51c34133d034c6e711296d7f94369af2dbf385978319a0b95fe96cd8d281fa6

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
x-rq: yyz4 0 2 9980
content-encoding: gzip
last-modified: Wed, 14 Dec 2022 23:01:22 GMT
server: nginx
age: 4846
etag: W/"639a55c2-c60"
x-cache: hit
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 3191
expires: Sat, 27 Jan 2024 21:03:45 GMT

GET
H2 200 freepress_white.svg
www.winnipegfreepress.com/wp-content/themes/wfp-theme/assets/images/ 6 KB
3 KB 30ms
25ms Image
image/svg+xml 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.winnipegfreepress.com/wp-content/themes/wfp-theme/assets/images/freepress_white.svg?v=2
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 9e5147eec2439e9e5dcd6df658a82a4d76b078fcabc9902b35276cbd40886ab9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
content-encoding: gzip
x-rq: yyz4 0 2 9980
last-modified: Wed, 04 Jan 2023 17:08:59 GMT
server: nginx
age: 171
etag: W/"63b5b2ab-18a9"
vary: X-Mobile-Class
x-cache: hit
content-type: image/svg+xml
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 2868
expires: Sat, 27 Jan 2024 21:03:45 GMT

GET
H2 200 katie-may.jpg
www.winnipegfreepress.com/wp-content/uploads/sites/2/2022/07/ 2 KB
2 KB 25ms
20ms Image
image/webp 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.winnipegfreepress.com/wp-content/uploads/sites/2/2022/07/katie-may.jpg?w=61
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: c913ae5f51f7618953f1657260b3c1c074da6c567b3f794f52d0d147113b7c61

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
x-rq: yyz4 87 107 443
last-modified: Sat, 05 Nov 2022 02:48:49 GMT
server: nginx
etag: "3ea45dda1a522073"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2262
expires: Sun, 05 Nov 2023 02:48:49 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 91 KB
28 KB 125ms
20ms Script
application/javascript 2606:2800:220:de:468:2285:c1:4a3
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (nyb/1D0C) /
Resource Hash: 392c9fa9cd1273a2a89d1a83a69cd1f63f21d1d55e7be21e1d8f51f25145668b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 21:03:46 GMT
Content-Encoding: gzip
Age: 22
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length: 27630
Last-Modified: Tue, 24 Jan 2023 21:41:51 GMT
Server: ECS (nyb/1D0C)
Etag: "9e99725b7a4cd730a934afba2a438bb5+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
x-tw-cdn: VZ
Cache-Control: public, max-age=1800

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 93ms
21ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5e8477f1df102403db7db7ac08208d458e2cb2fc4f6681a83b77b389d3546b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.winnipegfreepress.com/
Origin: https://www.winnipegfreepress.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 27 Jan 2023 21:03:45 GMT
content-md5: MxQRMq51ZIQjdPUqTGKQug==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1687
x-fb-rlafr: 0
x-fb-debug: JYcUANhWM4C31GzIfHAYEbLO4tNgfGs74FHGwWAfLUwc6kcOHpuWCdohKHDO9f4cBMvi6ave2jcmSzmSCHtLRQ==
x-fb-trip-id: 1512268381
x-fb-content-md5: 601c76dedecc736af880ec90884c2565
cross-origin-opener-policy: same-origin-allow-popups
etag: "da4c380f7425f67f310056eacd0bae85"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 27 Jan 2023 21:19:08 GMT

GET
H2 200 963057_web1_IMG_2353.jpg
www.winnipegfreepress.com/wp-content/uploads/sites/2/2022/12/ 55 KB
56 KB 394ms
390ms Image
image/webp 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.winnipegfreepress.com/wp-content/uploads/sites/2/2022/12/963057_web1_IMG_2353.jpg?w=1000
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 34034863fb912fd50d587fb4439bb883dabecc04c8e5fbbb5978d2e98c6b4ed9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:46 GMT
x-rq: yyz4 80 86 443
last-modified: Fri, 27 Jan 2023 21:03:46 GMT
server: nginx
etag: "d1a04b6b95c1e138"
vary: Accept
x-cache: MISS
content-type: image/webp
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 56826
expires: Sat, 27 Jan 2024 21:03:46 GMT

GET
H2 200 950317_web1_IMG_2348.jpg
www.winnipegfreepress.com/wp-content/uploads/sites/2/2022/12/ 2 KB
2 KB 25ms
21ms Image
image/webp 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.winnipegfreepress.com/wp-content/uploads/sites/2/2022/12/950317_web1_IMG_2348.jpg?w=100
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: c693665e6f6348a3338c00719c4c7dc5f957b6c48f266e3a097d071d1c93c8b2

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
x-rq: yyz4 80 86 443
last-modified: Wed, 18 Jan 2023 01:08:46 GMT
server: nginx
etag: "4126be34ad014a28"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2336
expires: Thu, 18 Jan 2024 01:08:46 GMT

GET
H2 200 940483_web1_Giving-Tues-IICU-Staff-Pic.jpg
www.winnipegfreepress.com/wp-content/uploads/sites/2/2022/11/ 2 KB
2 KB 286ms
281ms Image
image/webp 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.winnipegfreepress.com/wp-content/uploads/sites/2/2022/11/940483_web1_Giving-Tues-IICU-Staff-Pic.jpg?w=100
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: d4da6245d7658bbd25924859544c251ed40714b2c3e6b2e146065671755e9364

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:46 GMT
x-rq: yyz4 80 86 443
last-modified: Fri, 27 Jan 2023 21:03:46 GMT
server: nginx
etag: "e91ca7d21853881c"
vary: Accept
x-cache: MISS
content-type: image/webp
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1978
expires: Sat, 27 Jan 2024 21:03:46 GMT

GET
H2 200 944276_web1_ER-BG.jpg
www.winnipegfreepress.com/wp-content/uploads/sites/2/2022/11/ 1 KB
1 KB 25ms
21ms Image
image/webp 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.winnipegfreepress.com/wp-content/uploads/sites/2/2022/11/944276_web1_ER-BG.jpg?w=100
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 16f6dd146600a27dfd2add863d1d961ec0ff8a7e0d493ba923768a3654e1947e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
x-rq: yyz4 80 130 443
last-modified: Wed, 18 Jan 2023 01:08:46 GMT
server: nginx
etag: "8a5c1c04b060856f"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1116
expires: Thu, 18 Jan 2024 01:08:46 GMT

GET
H2 200 888275_web1_HSC_7.jpg
www.winnipegfreepress.com/wp-content/uploads/sites/2/2022/11/ 1 KB
2 KB 25ms
22ms Image
image/webp 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.winnipegfreepress.com/wp-content/uploads/sites/2/2022/11/888275_web1_HSC_7.jpg?w=100
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1b7aed5738e8fce4e20cc96c3350fecf58573f4346208f1a3a4de6cc82cdc1e7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
x-rq: yyz4 80 130 443
last-modified: Thu, 26 Jan 2023 22:20:24 GMT
server: nginx
etag: "7d6781b2058d0a2e"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1500
expires: Fri, 26 Jan 2024 22:20:24 GMT

GET
H2 200 847008_web1_Kristjan-Thompson.jpg
www.winnipegfreepress.com/wp-content/uploads/sites/2/2022/10/ 1 KB
2 KB 26ms
22ms Image
image/webp 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.winnipegfreepress.com/wp-content/uploads/sites/2/2022/10/847008_web1_Kristjan-Thompson.jpg?w=100
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 4841d6bb17662095feb86857d8bb59df81a6af8f7bbda7cce3e4e5bab8d0c68c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
x-rq: yyz4 80 86 443
last-modified: Wed, 18 Jan 2023 01:08:46 GMT
server: nginx
etag: "52a7c443454cbfb8"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1534
expires: Thu, 18 Jan 2024 01:08:46 GMT

GET
H2 200 210820-Children-s-Emergency-.jpg
www.winnipegfreepress.com/wp-content/uploads/sites/2/2022/12/ 3 KB
3 KB 26ms
22ms Image
image/webp 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.winnipegfreepress.com/wp-content/uploads/sites/2/2022/12/210820-Children-s-Emergency-.jpg?w=100
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 5664fd4ace6b6125bf33de99937dd0398fa35f40fcfd1ce3159f3362d19205b8

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
x-rq: yyz4 87 203 443
last-modified: Sun, 15 Jan 2023 17:04:07 GMT
server: nginx
etag: "29df2356daa2275c"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2890
expires: Mon, 15 Jan 2024 17:04:07 GMT

GET
H2 200 JTI_logo.png
www.winnipegfreepress.com/wp-content/themes/fp-inc-base-theme/images/ 4 KB
5 KB 38ms
35ms Image
image/png 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.winnipegfreepress.com/wp-content/themes/fp-inc-base-theme/images/JTI_logo.png
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 11443cdc514a219abae49161635dc8d1dcff6723863702099ae81e3697f9ce3d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
x-rq: yyz4 0 2 9980
content-encoding: gzip
last-modified: Mon, 07 Nov 2022 15:14:38 GMT
server: nginx
age: 6516241
etag: W/"636920de-11de"
x-cache: hit
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 4553
expires: Sat, 27 Jan 2024 21:03:45 GMT

GET
H2 200 scripts.js Show response
www.winnipegfreepress.com/wp-content/plugins/lightbox-photoswipe/assets/ps4/ 90 KB
23 KB 18ms
18ms Script
application/javascript 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.winnipegfreepress.com/wp-content/plugins/lightbox-photoswipe/assets/ps4/scripts.js?m=1673561930g
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: a9934b98dff0f90f68a3d07944cd938528ea277225fee38fd63db1db3dae5dd2

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
x-rq: yyz4 0 2 9980
content-encoding: gzip
last-modified: Thu, 12 Jan 2023 22:18:50 GMT
server: nginx
age: 599400
etag: W/"63c0874a-16911"
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 23019
expires: Sat, 27 Jan 2024 21:03:45 GMT

GET
H2 200 e-202304.js Show response
stats.wp.com/ 9 KB
3 KB 60ms
17ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202304.js
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc: HIT yyz
date: Fri, 27 Jan 2023 21:03:45 GMT
content-encoding: br
server: nginx
etag: W/"61be9fd1-3508"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Sun, 21 Jan 2024 08:14:36 GMT

GET
H/1.1 200
OK cookielaw.js Show response
ssl.geoplugin.net/extras/ 108 B
322 B 416ms
102ms Script
application/javascript 178.237.33.51
ATOM86-AS ATOM86

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.geoplugin.net/extras/cookielaw.js?k=67ff89604d31f4c1
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/wp-content/themes/fp-inc-base-theme/static/gdpr.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 178.237.33.51 Rotterdam, Netherlands, ASN8455 (ATOM86-AS ATOM86, NL),
Reverse DNS
Software: Apache /
Resource Hash: c2936776401410192729e2b7d68b6b6f6e824cb6e53df78c87735f255a42b461

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 27 Jan 2023 19:43:34 GMT
cache-control: public, max-age=300
server: Apache
content-length: 108
content-type: application/javascript; charset=utf-8

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 306 KB
92 KB 80ms
71ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TK48WJ9

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

90470325739d0af5dfda30c340794d0b7b36d631c24f64f83a3e7c7519d0eca9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 94364
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 27 Jan 2023 21:03:45 GMT

GET
H2 200 m=el_main Show response
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.tvzdIv5D-Fk.O/d=1/exm=el_conf/ed=1/rs=AN8SPfq0reXC1mmnnZ1UyCZOCXrnJUuBeA/ 207 KB
74 KB 29ms
26ms Script
text/javascript 2607:f8b0:4006:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.tvzdIv5D-Fk.O/d=1/exm=el_conf/ed=1/rs=AN8SPfq0reXC1mmnnZ1UyCZOCXrnJUuBeA/m=el_main

Requested by

Host:
URL: /_/translate_http/_/js/k=translate_http.tr.en_US.tvzdIv5D-Fk.O/d=1/rs=AN8SPfq0reXC1mmnnZ1UyCZOCXrnJUuBeA/m=el_conf

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::200a Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dbc13e868fc37e5decb688b506ac4dea2da1690396694b7289530600e15f0816

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 17:41:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12118
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75142
x-xss-protection: 0
last-modified: Wed, 07 Dec 2022 22:10:10 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="rosetta"
vary: Accept-Encoding
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 27 Jan 2024 17:41:47 GMT

GET
H2 200 wp-emoji-release.min.js Show response
www.winnipegfreepress.com/wp-includes/js/ 18 KB
5 KB 38ms
36ms Script
application/javascript 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.winnipegfreepress.com/wp-includes/js/wp-emoji-release.min.js?ver=6.1.1
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
x-rq: yyz4 0 2 9980
content-encoding: gzip
last-modified: Wed, 04 Jan 2023 20:21:59 GMT
server: nginx
age: 599158
etag: W/"63b5dfe7-48b9"
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 5004
expires: Sat, 27 Jan 2024 21:03:45 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ 44 KB
44 KB 75ms
21ms Font
font/woff2 2607:f8b0:4006:824::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans+Condensed:ital,wght@0,300;0,700;1,300&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;1,300;1,400;1,600;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.winnipegfreepress.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 26 Jan 2023 21:14:27 GMT
x-content-type-options: nosniff
age: 85758
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44856
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Jan 2024 21:14:27 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 110 KB
43 KB 53ms
49ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-350959-63&l=dataLayer&cx=c

Requested by

Host: www.googleoptimize.com
URL: https://www.googleoptimize.com/optimize.js?id=OPT-WQ2K7LM

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8d86c424887cf759c3f4707859f44ccded82148df23defb93d10e7cbe461b886

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 43992
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 27 Jan 2023 21:03:45 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 228 KB
79 KB 79ms
75ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-770Z3PGDW4&l=dataLayer&cx=c

Requested by

Host: www.googleoptimize.com
URL: https://www.googleoptimize.com/optimize.js?id=OPT-WQ2K7LM

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

55b01fdd073fb0f9699d813ca88566575d37c6dc50256577a1d8de0726a516f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 80328
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 27 Jan 2023 21:03:46 GMT

GET
H2 200 fa-solid-900.woff2
www.winnipegfreepress.com/wp-content/client-mu-plugins/frontend/webfonts/ 76 KB
77 KB 19ms
18ms Font
application/font-woff2 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.winnipegfreepress.com/wp-content/client-mu-plugins/frontend/webfonts/fa-solid-900.woff2
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/_static/??-eJydkE2uwjAMhC+EY0W00LdAnCVNXRpe/lS7FG5PKEJiAUiwsmXPfBob5ww2RaEomP10cJHRu8MgbTpDHpIknl0mNMwkjJkrZLl4YuyoN5MXZZlX+ESx3pUCYYIHrx+XVVfALfalNzNxCgSnWulaVSq4+C1mSTVCO8XOF1Cj1kr/wnFRxnTkl1YZKJRD+wwuWmgNEyyj+wfeyeei/yR7SnIkycb+g9Zqi0X3GNw8+7DTm21VN+vqr7kCno6bNA==
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 9834b82ad26e2a37583d22676a12dd2eb0fe7c80356a2114d0db1aa8b3899537

Request headers

Referer: https://www.winnipegfreepress.com/_static/??-eJydkE2uwjAMhC+EY0W00LdAnCVNXRpe/lS7FG5PKEJiAUiwsmXPfBob5ww2RaEomP10cJHRu8MgbTpDHpIknl0mNMwkjJkrZLl4YuyoN5MXZZlX+ESx3pUCYYIHrx+XVVfALfalNzNxCgSnWulaVSq4+C1mSTVCO8XOF1Cj1kr/wnFRxnTkl1YZKJRD+wwuWmgNEyyj+wfeyeei/yR7SnIkycb+g9Zqi0X3GNw8+7DTm21VN+vqr7kCno6bNA==
Origin: https://www.winnipegfreepress.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
content-encoding: gzip
age: 171
x-cache: hit
content-length: 78184
x-rq: yyz4 0 2 9980
last-modified: Wed, 14 Dec 2022 23:01:21 GMT
server: nginx
etag: W/"639a55c1-131bc"
vary: X-Mobile-Class
access-control-allow-methods: GET, HEAD
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Sat, 27 Jan 2024 21:03:45 GMT

GET
H2 200 z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff0GmDuXMRw.woff2
fonts.gstatic.com/s/opensanscondensed/v23/ 16 KB
16 KB 38ms
37ms Font
font/woff2 2607:f8b0:4006:824::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff0GmDuXMRw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0aa6a7045a55ddcb25bbee4d1edcb864081cf59f7fc9bdc1ada22a32ed4ad3ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.winnipegfreepress.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 24 Jan 2023 22:12:26 GMT
x-content-type-options: nosniff
age: 255079
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16324
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 18:08:32 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 Jan 2024 22:12:26 GMT

GET
H2 200 fa-brands-400.woff2
www.winnipegfreepress.com/wp-content/client-mu-plugins/frontend/webfonts/ 75 KB
75 KB 21ms
21ms Font
application/font-woff2 2a04:fa87:fffd::c000:4221
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.winnipegfreepress.com/wp-content/client-mu-plugins/frontend/webfonts/fa-brands-400.woff2
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/_static/??-eJydkE2uwjAMhC+EY0W00LdAnCVNXRpe/lS7FG5PKEJiAUiwsmXPfBob5ww2RaEomP10cJHRu8MgbTpDHpIknl0mNMwkjJkrZLl4YuyoN5MXZZlX+ESx3pUCYYIHrx+XVVfALfalNzNxCgSnWulaVSq4+C1mSTVCO8XOF1Cj1kr/wnFRxnTkl1YZKJRD+wwuWmgNEyyj+wfeyeei/yR7SnIkycb+g9Zqi0X3GNw8+7DTm21VN+vqr7kCno6bNA==
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffd::c000:4221 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 8ea8791754915a898a3100e63e32978a6d1763be6df8e73a39d3a90d691cdeef

Request headers

Referer: https://www.winnipegfreepress.com/_static/??-eJydkE2uwjAMhC+EY0W00LdAnCVNXRpe/lS7FG5PKEJiAUiwsmXPfBob5ww2RaEomP10cJHRu8MgbTpDHpIknl0mNMwkjJkrZLl4YuyoN5MXZZlX+ESx3pUCYYIHrx+XVVfALfalNzNxCgSnWulaVSq4+C1mSTVCO8XOF1Cj1kr/wnFRxnTkl1YZKJRD+wwuWmgNEyyj+wfeyeei/yR7SnIkycb+g9Zqi0X3GNw8+7DTm21VN+vqr7kCno6bNA==
Origin: https://www.winnipegfreepress.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:45 GMT
content-encoding: gzip
age: 171
x-cache: hit
content-length: 76774
x-rq: yyz4 0 2 9980
last-modified: Wed, 14 Dec 2022 23:01:21 GMT
server: nginx
etag: W/"639a55c1-12bc0"
vary: X-Mobile-Class
access-control-allow-methods: GET, HEAD
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Sat, 27 Jan 2024 21:03:45 GMT

GET
H2 200 z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff1GhDuXMRw.woff2
fonts.gstatic.com/s/opensanscondensed/v23/ 15 KB
15 KB 28ms
21ms Font
font/woff2 2607:f8b0:4006:824::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff1GhDuXMRw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b0b111ca14c2147a0f0cb51f1317290eb5ec19b4a9bea595a5ad7ffb7d9661a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.winnipegfreepress.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 24 Jan 2023 22:24:33 GMT
x-content-type-options: nosniff
age: 254352
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14964
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 18:08:11 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 Jan 2024 22:24:33 GMT

GET
H/1.1 200
OK data Show response
api.cxense.com/public/widget/ 129 B
745 B 97ms
25ms Script
text/javascript 86.109.7.56
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.cxense.com/public/widget/data?json=%7B%22context%22%3A%7B%22referrer%22%3A%22%22%2C%22categories%22%3A%7B%22testgroup%22%3A%2231%22%7D%2C%22parameters%22%3A%5B%7B%22key%22%3A%22userState%22%2C%22value%22%3A%22anon%22%7D%2C%7B%22key%22%3A%22testgroup%22%2C%22value%22%3A%2231%22%7D%5D%2C%22autoRefresh%22%3Afalse%2C%22url%22%3A%22https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing%22%7D%2C%22widgetId%22%3A%227aa4ebd5b5458d44d4f7689da2e1117fc40ea430%22%2C%22user%22%3A%7B%22ids%22%3A%7B%22usi%22%3A%22ldf0hif4f9ck4836%22%7D%7D%2C%22prnd%22%3A%22ldf0hif4bosbl6v9%22%7D&media=javascript&sid=null&widgetId=7aa4ebd5b5458d44d4f7689da2e1117fc40ea430&resizeToContentSize=true&useSecureUrls=true&usi=ldf0hif4f9ck4836&rnd=1672192329&prnd=ldf0hif4bosbl6v9&tzo=0&callback=cXJsonpCB1

Requested by

Host: cdn.cxense.com
URL: https://cdn.cxense.com/cx.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

86.109.7.56 Ashburn, United States, ASN54825 (PACKET, US),

Reverse DNS

Software

Jetty(9.4.28.v20200408) /

Resource Hash

2f294402fe8d6fe148cffa9ca444ec933eb0e354fc4d8a97202f141cf7fc6f40

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:46 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
server: Jetty(9.4.28.v20200408)
content-type: text/javascript;charset=utf-8
p3p: policyref="http://www.cxense.com/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-store, no-cache, must-revalidate
content-length: 129
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK data Show response
api.cxense.com/public/widget/ 7 KB
3 KB 94ms
26ms Script
text/javascript 86.109.7.56
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.cxense.com/public/widget/data?json=%7B%22context%22%3A%7B%22referrer%22%3A%22%22%2C%22categories%22%3A%7B%22testgroup%22%3A%2231%22%7D%2C%22parameters%22%3A%5B%7B%22key%22%3A%22userState%22%2C%22value%22%3A%22anon%22%7D%2C%7B%22key%22%3A%22testgroup%22%2C%22value%22%3A%2231%22%7D%5D%2C%22autoRefresh%22%3Afalse%2C%22url%22%3A%22https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing%22%7D%2C%22widgetId%22%3A%2262c38e54b217439759d06038781fa86b8ae4e8b0%22%2C%22user%22%3A%7B%22ids%22%3A%7B%22usi%22%3A%22ldf0hif4f9ck4836%22%7D%7D%2C%22prnd%22%3A%22ldf0hif4bosbl6v9%22%7D&media=javascript&sid=null&widgetId=62c38e54b217439759d06038781fa86b8ae4e8b0&resizeToContentSize=true&useSecureUrls=true&usi=ldf0hif4f9ck4836&rnd=2093518665&prnd=ldf0hif4bosbl6v9&tzo=0&callback=cXJsonpCB2

Requested by

Host: cdn.cxense.com
URL: https://cdn.cxense.com/cx.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

86.109.7.56 Ashburn, United States, ASN54825 (PACKET, US),

Reverse DNS

Software

Jetty(9.4.28.v20200408) /

Resource Hash

a9f23ce14e86d87ad7ef141e4e891d8553a6c51fda3be05b8018719f726e2814

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:46 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: gzip
server: Jetty(9.4.28.v20200408)
content-type: text/javascript;charset=utf-8
p3p: policyref="http://www.cxense.com/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-store, no-cache, must-revalidate
content-length: 2356
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK data Show response
api.cxense.com/public/widget/ 12 KB
7 KB 135ms
68ms Script
text/javascript 86.109.7.56
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.cxense.com/public/widget/data?json=%7B%22context%22%3A%7B%22referrer%22%3A%22%22%2C%22categories%22%3A%7B%22testgroup%22%3A%2231%22%7D%2C%22parameters%22%3A%5B%7B%22key%22%3A%22userState%22%2C%22value%22%3A%22anon%22%7D%2C%7B%22key%22%3A%22testgroup%22%2C%22value%22%3A%2231%22%7D%5D%2C%22autoRefresh%22%3Afalse%2C%22url%22%3A%22https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing%22%7D%2C%22widgetId%22%3A%22d39f003f14070ca28247a61503ecc9e197545ef1%22%2C%22user%22%3A%7B%22ids%22%3A%7B%22usi%22%3A%22ldf0hif4f9ck4836%22%7D%7D%2C%22prnd%22%3A%22ldf0hif4bosbl6v9%22%7D&media=javascript&sid=null&widgetId=d39f003f14070ca28247a61503ecc9e197545ef1&resizeToContentSize=true&useSecureUrls=true&usi=ldf0hif4f9ck4836&rnd=585115353&prnd=ldf0hif4bosbl6v9&tzo=0&callback=cXJsonpCB3

Requested by

Host: cdn.cxense.com
URL: https://cdn.cxense.com/cx.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

86.109.7.56 Ashburn, United States, ASN54825 (PACKET, US),

Reverse DNS

Software

Jetty(9.4.28.v20200408) /

Resource Hash

197ba9e1cadc36e22bd62725373b75f14a1b50946ef4e49b226d1134b3a85ff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:46 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: gzip
server: Jetty(9.4.28.v20200408)
content-type: text/javascript;charset=utf-8
p3p: policyref="http://www.cxense.com/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-store, no-cache, must-revalidate
content-length: 6712
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
116 B 21ms
17ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&blog=200448927&post=600192247&tz=-6&srv=www.winnipegfreepress.com&hp=vip&j=1%3A11.7.1&host=www.winnipegfreepress.com&ref=&fcp=1674&rand=0.6032600831061077
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 27 Jan 2023 21:03:46 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
DATA 200
OK truncated Show response
/ Frame 5D13 1 KB
1 KB Document
text/html

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cb3e03878337b209e27f3752ab8b2f0ba3864dd6b6d71d1d6dc5d3a869e7489b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Content-Type: text/html;charset=UTF-8

GET
H2 200 translate_24dp.png
www.gstatic.com/images/branding/product/1x/ 846 B
1 KB 21ms
20ms Image
image/png 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/product/1x/translate_24dp.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a861509b658aa24fc3aed2867ac3c061e7d818d90b9990959afc6d1b5d4ff99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 19:56:22 GMT
x-content-type-options: nosniff
age: 4044
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 846
x-xss-protection: 0
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 27 Jan 2024 19:56:22 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 301 KB
85 KB 21ms
20ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=68a676a13f227f5e7a1e4c4bb19996a1

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6bf0fd8a77f97f792a50bab40d986b1c19b286e0329a7d705652fd35064a7fbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.winnipegfreepress.com/
Origin: https://www.winnipegfreepress.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 27 Jan 2023 21:03:46 GMT
content-md5: B3XizYIytBXVDe+RXNmK4Q==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 86955
x-fb-rlafr: 0
x-fb-debug: 4YuvURHooxsGlfvG0tEhxY6VGZpqRq2fNVlPljc+SKWXq5oi1HadLJluUkFur2ep4G+VjEpQ4nFob8WV8aH3zw==
x-fb-trip-id: 1512268381
x-fb-content-md5: fe0ad0b84fbbdec4a05cbc147b117fd7
cross-origin-opener-policy: same-origin-allow-popups
etag: "48457526dba3dbec375f208dbf47960d"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sat, 27 Jan 2024 19:24:32 GMT

GET
H2 200 swg-button.css
news.google.com/swg/js/v1/ 21 KB
6 KB 21ms
20ms Stylesheet
text/css 2607:f8b0:4006:80c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/js/v1/swg-button.css

Requested by

Host: news.google.com
URL: https://news.google.com/swg/js/v1/swg.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c429b056c18833dd3d7fe28ab8ba904526ad1375398ffac0a0e4f2d278e1ac43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 20:54:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 540
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/news-frontend
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6458
x-xss-protection: 0
last-modified: Wed, 02 Nov 2022 19:15:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="news-frontend"
vary: Accept-Encoding
report-to: {"group":"news-frontend","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/news-frontend"}]}
content-type: text/css
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Fri, 27 Jan 2023 21:44:46 GMT

GET
H2 200 translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 2 KB
2 KB 20ms
20ms Image
image/png 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/product/2x/translate_24dp.png

Requested by

Host: translate.googleapis.com
URL: https://translate.googleapis.com/translate_static/css/translateelement.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://translate.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 26 Jan 2023 19:29:08 GMT
x-content-type-options: nosniff
age: 92078
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1842
x-xss-protection: 0
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 26 Jan 2024 19:29:08 GMT

GET
H/1.1 200
OK widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html Show response
platform.twitter.com/widgets/ Frame C46C 320 KB
104 KB 20ms
19ms Document
text/html 2606:2800:220:de:468:2285:c1:4a3
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.winnipegfreepress.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (nyb/1D1C) /
Resource Hash: 4002d65e95f94dc87ae8ad170eb8dbc3644921032ac76dcb376537d9304a6fbf

Request headers

Referer: https://www.winnipegfreepress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 256465
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 105435
Content-Type: text/html; charset=utf-8
Date: Fri, 27 Jan 2023 21:03:46 GMT
Etag: "95e1b50b0c179aefb47b5b211bb347b5+gzip"
Last-Modified: Tue, 24 Jan 2023 21:41:13 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (nyb/1D1C)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 76ms
20ms Script
text/javascript 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-350959-63

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 27 Jan 2023 20:07:54 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 3352
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Fri, 27 Jan 2023 22:07:54 GMT

GET
H2 200 pubads_impl_2023012501.js Show response
securepubads.g.doubleclick.net/gpt/ 386 KB
131 KB 23ms
21ms Script
text/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f368aa8ed1ff20a7f45f67285eb393b6b164a71826955217eaac1aa54c31980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 26 Jan 2023 21:48:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83700
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 133524
x-xss-protection: 0
last-modified: Wed, 25 Jan 2023 09:36:27 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 26 Jan 2024 21:48:46 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 147 B
109 B 88ms
40ms XHR
application/json 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.winnipegfreepress.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d21b5b9239def983562bd5751372e2b2449b03b23653bf8b66f0d47cd5ec80a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:46 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 84
x-xss-protection: 0
expires: Fri, 27 Jan 2023 21:03:46 GMT

GET
H2

200

activityi;dc_pre=CJ3np5zT6PwCFdkKaAgdlbwF8Q;src=10441863;type=traff0;cat=lokno00;ord=6286165176138;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingne... Show response
10441863.fls.doubleclick.net/ Frame DA30
Redirect Chain

https://10441863.fls.doubleclick.net/activityi;src=10441863;type=traff0;cat=lokno00;ord=6286165176138;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakin...
https://10441863.fls.doubleclick.net/activityi;dc_pre=CJ3np5zT6PwCFdkKaAgdlbwF8Q;src=10441863;type=traff0;cat=lokno00;ord=6286165176138;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fw...

696 B
563 B

40ms
39ms

Document
text/html

142.250.80.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10441863.fls.doubleclick.net/activityi;dc_pre=CJ3np5zT6PwCFdkKaAgdlbwF8Q;src=10441863;type=traff0;cat=lokno00;ord=6286165176138;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TK48WJ9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.70 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f6.1e100.net

Software

cafe /

Resource Hash

2a0af7dab8ad90d175d40b187c661a55a4fde95dd9ec543e3d96704bd21bf793

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.winnipegfreepress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 387
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 27 Jan 2023 21:03:46 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 27 Jan 2023 21:03:46 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://10441863.fls.doubleclick.net/activityi;dc_pre=CJ3np5zT6PwCFdkKaAgdlbwF8Q;src=10441863;type=traff0;cat=lokno00;ord=6286165176138;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
5 KB 96ms
35ms Script
application/x-javascript 2600:141b:13::17d7:8252
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TK48WJ9

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:13::17d7:8252 New York, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 10 Jan 2023 17:22:56 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=81912
accept-ranges: bytes
content-length: 4777

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 106 KB
27 KB 43ms
21ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ef8f067f829af7c95936a36f38e54c98ab090f937f5557e4c78829ed8fcf5ffd

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 27 Jan 2023 21:03:46 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27859
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: kIDBjkjUxX/RIJ3l14eIr/csmbD9FrZMsvfTf4WqXNbJnS/sN6yb/ziT3BTHBshrSbYoFdq9jaRiV7EDGvFhrg==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 42ms
20ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5e8477f1df102403db7db7ac08208d458e2cb2fc4f6681a83b77b389d3546b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 27 Jan 2023 21:03:46 GMT
content-md5: MxQRMq51ZIQjdPUqTGKQug==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1687
x-fb-rlafr: 0
x-fb-debug: JYcUANhWM4C31GzIfHAYEbLO4tNgfGs74FHGwWAfLUwc6kcOHpuWCdohKHDO9f4cBMvi6ave2jcmSzmSCHtLRQ==
x-fb-content-md5: 601c76dedecc736af880ec90884c2565
cross-origin-opener-policy: same-origin-allow-popups
etag: "da4c380f7425f67f310056eacd0bae85"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
priority: u=3,i
expires: Fri, 27 Jan 2023 21:19:08 GMT

GET
H/1.1 200
OK number-changer.js Show response
rw1.marchex.io/euinc/ 35 KB
10 KB 77ms
26ms Script
text/javascript 174.137.122.128
MARCHEX-EAST

General

Check archive.org

Show headers Download Go to

Full URL

https://rw1.marchex.io/euinc/number-changer.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TK48WJ9

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

174.137.122.128 , United States, ASN54668 (MARCHEX-EAST, US),

Reverse DNS

Software

Apache /

Resource Hash

6493ebe5a8bb3751f00d3c4e48d0c8a8c7dc46be0b79e78d8831f3a2f3f45526

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' www.google-analytics.com privacy-policy.truste.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' www.google-analytics.com privacy-policy.truste.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com; img-src 'self' privacy-policy.truste.com; font-src 'self' fonts.gstatic.com fonts.googleapis.com; media-src 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 21:03:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Server: Apache
Content-Security-Policy: default-src 'self' www.google-analytics.com privacy-policy.truste.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' www.google-analytics.com privacy-policy.truste.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com; img-src 'self' privacy-policy.truste.com; font-src 'self' fonts.gstatic.com fonts.googleapis.com; media-src 'self';
Referrer-Policy: same-origin
Vary: Accept-Encoding,User-Agent
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript
Transfer-Encoding: chunked
Permissions-Policy: accelerometer=(), autoplay=*, camera=(), cross-origin-isolated=(), display-capture=(), document-domain=*, encrypted-media=*, fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=*, payment=(), picture-in-picture=(), publickey-credentials-get=*, screen-wake-lock=(), sync-xhr=*, usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), hid=(), idle-detection=(), serial=(), window-placement=()
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=1, max=87

GET
H2 200 settings Show response
syndication.twitter.com/ Frame C46C 920 B
647 B 155ms
56ms Fetch
application/json 104.244.42.8
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=15119dfe8028c55b3339ac89cbb72f49d52cf5b1

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.winnipegfreepress.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.8 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

0e6809406e07c770b85da35a4faf706f8750b5db94cdc475aa4dfa79033f80eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-response-time: 7
date: Fri, 27 Jan 2023 21:03:46 GMT
content-encoding: gzip
strict-transport-security: max-age=631138519
last-modified: Fri, 27 Jan 2023 21:03:46 GMT
server: tsa_b
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
x-transaction-id: 379d120bb173a1e8
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
perf: 7626143928
x-connection-hash: d815160567b557f8f9feae45c98a4053d436be1c759276a825c2fa18f1254c1e
content-length: 327

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
216 B 37ms
36ms XHR
text/plain 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=2037910435&t=pageview&_s=1&dl=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&ul=en-us&de=UTF-8&dt=Lower%20patient%20volumes%20at%20Children%E2%80%99s%20Hospital%20likely%20calm%20before%20expected%20storm%2C%20ER%20director%20says%20%E2%80%93%20Winnipeg%20Free%20Press&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEDAAUABAAAAACAEK~&jid=973574345&gjid=905688813&cid=197573043.1674853427&tid=UA-126530131-1&_gid=595358482.1674853427&_r=1&_slc=1&gtm=2wg1p0TK48WJ9&z=379804172

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.winnipegfreepress.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:46 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.winnipegfreepress.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 v1 Show response
winnipeg-free-press-snowplow-collector.localnewslab.io/com.google.analytics/ 2 B
317 B 106ms
35ms XHR
text/plain 52.205.39.100
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://winnipeg-free-press-snowplow-collector.localnewslab.io/com.google.analytics/v1
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.39.100 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-39-100.compute-1.amazonaws.com
Software: akka-http/10.1.10 /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://www.winnipegfreepress.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-type: text/plain; charset=UTF-8

Response headers

access-control-allow-origin: https://www.winnipegfreepress.com
date: Fri, 27 Jan 2023 21:03:46 GMT
access-control-allow-credentials: true
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
server: akka-http/10.1.10
content-length: 2
content-type: text/plain; charset=UTF-8

GET
H3 200 524625568278206 Show response
connect.facebook.net/signals/config/ 377 KB
108 KB 21ms
21ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/524625568278206?v=2.9.94&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3f370de109f0ae310d0b3cc8ab1bbfef67fcb50203b4a4aaf18321c51b14ea2b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 27 Jan 2023 21:03:46 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 110297
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: OR0Y9Lph2KTXXuqXpKBLOSciyCflz13RkKH9nGQWgeq+KCje4Iz1E+R8JqDbRsElVfFdW77ql+7pAH12Fm8H8w==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 107ms
21ms Image
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=129054303830226&ev=fb_page_view&dl=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&rl=&if=false&ts=1674853426561&sw=1600&sh=1200&at=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 27 Jan 2023 21:03:46 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
356 B 123ms
33ms XHR
text/plain 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-126530131-1&cid=197573043.1674853427&jid=973574345&gjid=905688813&_gid=595358482.1674853427&_u=YEDAAUAAAAAAACAEK~&z=997045097

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.winnipegfreepress.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Fri, 27 Jan 2023 21:03:46 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.winnipegfreepress.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK getnumdata.js Show response
rw1.marchex.io/euinc/ 249 B
1 KB 26ms
26ms Script
text/javascript 174.137.122.128
MARCHEX-EAST

General

Check archive.org

Show headers Download Go to

Full URL

https://rw1.marchex.io/euinc/getnumdata.js?var=_vsrkpd.d;acc=fwABAV8M0955zACy;cky=rkpd_fwABAV8M0955zACy;ign=1;url=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing;

Requested by

Host: rw1.marchex.io
URL: https://rw1.marchex.io/euinc/number-changer.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

174.137.122.128 , United States, ASN54668 (MARCHEX-EAST, US),

Reverse DNS

Software

Apache /

Resource Hash

8b82448e5551693ea90c222fc2eb8df69f5cbb2f03e75587d1f206e3b35adc03

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' www.google-analytics.com privacy-policy.truste.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' www.google-analytics.com privacy-policy.truste.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com; img-src 'self' privacy-policy.truste.com; font-src 'self' fonts.gstatic.com fonts.googleapis.com; media-src 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 21:03:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self' www.google-analytics.com privacy-policy.truste.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' www.google-analytics.com privacy-policy.truste.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com; img-src 'self' privacy-policy.truste.com; font-src 'self' fonts.gstatic.com fonts.googleapis.com; media-src 'self';
Transfer-Encoding: chunked
P3P: CP="NOI COR NID TAI OUR BUS STA"
Connection: Keep-Alive
Referrer-Policy: same-origin
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript
Permissions-Policy: accelerometer=(), autoplay=*, camera=(), cross-origin-isolated=(), display-capture=(), document-domain=*, encrypted-media=*, fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=*, payment=(), picture-in-picture=(), publickey-credentials-get=*, screen-wake-lock=(), sync-xhr=*, usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), hid=(), idle-detection=(), serial=(), window-placement=()
Accept-Ranges: bytes
Keep-Alive: timeout=1, max=39

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/3300905/domain/winnipegfreepress.com/ 36 B
367 B 116ms
23ms XHR
application/json 2600:9000:21ec:9000:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/3300905/domain/winnipegfreepress.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21ec:9000:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://www.winnipegfreepress.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 20:14:01 GMT
content-encoding: gzip
via: 1.1 bc4b5a0c950f70df08b33cfb9288c098.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK51-C1
age: 2985
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=3600
x-amz-cf-id: 0VRJM3vKyXR1QzsQwFE29IRUbIegfHISow6svN3jAdJtI3jn6z67pQ==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3300905&time=1674853426580&url=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospit...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3300905&time=1674853426580&url=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospit...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3300905%26time%3D1674853426580%26url%3Dhttps%253A%252F%252Fwww.winnipegfreepress....
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3300905&time=1674853426580&url=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospit...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3300905&time=1674853426580&url=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospi...

0
489 B

142ms
100ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3300905&time=1674853426580&url=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&cookiesTest=true&liSync=true&e_ipv6=AQKpSJbmd6D3xAAAAYX1CydJh_t1-_g9Ezg_3_s83ln9tN6keJXZvqujozKp9XMrEM9bFpm-aQ
Requested by: Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/breakingnews/2022/12/06/lower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says?utm_source=Salesforce&utm_medium=Email&utm_campaign=COVIDBriefing
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:46 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: D51651DF3F634E348ACFFA67676D19C3 Ref B: YTO01EDGE0515 Ref C: 2023-01-27T21:03:47Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXzRTOTh45e/A/Wbo8lSg==

Redirect headers

date: Fri, 27 Jan 2023 21:03:46 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 9430B0907B274B1CB0C7A75A9B951CB9 Ref B: YTO01EDGE0511 Ref C: 2023-01-27T21:03:46Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3300905&time=1674853426580&url=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&cookiesTest=true&liSync=true&e_ipv6=AQKpSJbmd6D3xAAAAYX1CydJh_t1-_g9Ezg_3_s83ln9tN6keJXZvqujozKp9XMrEM9bFpm-aQ
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXzRTORXfJwRWFwsa/rlg==

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/3300905/domain/winnipegfreepress.com/ 36 B
368 B 115ms
24ms XHR
application/json 2600:9000:21ec:9000:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/3300905/domain/winnipegfreepress.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21ec:9000:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://www.winnipegfreepress.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 20:14:01 GMT
content-encoding: gzip
via: 1.1 bc4b5a0c950f70df08b33cfb9288c098.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK51-C1
age: 2985
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=3600
x-amz-cf-id: 7-ILv9lKORzT9XHOHUf1YBklL4CdKO0IQCDqLSHeXIRvbJ0Cp4VYMg==

GET
H2 200 dc_pre=CJ3np5zT6PwCFdkKaAgdlbwF8Q;src=10441863;type=traff0;cat=lokno00;ord=6286165176138;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%... Show response
adservice.google.com/ddm/fls/i/ Frame 42F9 695 B
764 B 118ms
50ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CJ3np5zT6PwCFdkKaAgdlbwF8Q;src=10441863;type=traff0;cat=lokno00;ord=6286165176138;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing

Requested by

Host: 10441863.fls.doubleclick.net
URL: https://10441863.fls.doubleclick.net/activityi;dc_pre=CJ3np5zT6PwCFdkKaAgdlbwF8Q;src=10441863;type=traff0;cat=lokno00;ord=6286165176138;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f22b07ba9ffabd454cbf154f2ea05df38f7c8ffc10261ef111e042a059779a4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://10441863.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 389
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 27 Jan 2023 21:03:46 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 31ms
22ms Image
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=524625568278206&ev=PageView&dl=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&rl=&if=false&ts=1674853426637&sw=1600&sh=1200&v=2.9.94&r=stable&a=tmgoogletagmanager&ec=0&o=30&fbp=fb.1.1674853426635.765317382&it=1674853426553&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 27 Jan 2023 21:03:46 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 31ms
23ms Image
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=524625568278206&ev=user-not-loggedin&dl=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&rl=&if=false&ts=1674853426638&sw=1600&sh=1200&v=2.9.94&r=stable&a=tmgoogletagmanager&ec=1&o=30&fbp=fb.1.1674853426635.765317382&it=1674853426553&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 27 Jan 2023 21:03:46 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H/1.1 200
OK button.e7f9415a2e000feaab02c86dd5802747.js Show response
platform.twitter.com/js/ 8 KB
3 KB 19ms
19ms Script
application/javascript 2606:2800:220:de:468:2285:c1:4a3
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.e7f9415a2e000feaab02c86dd5802747.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (nyb/1D0C) /
Resource Hash: ef116c4b154888a36784c143110b264cfe6528a4061c5dcc14e6431ecfbcac56

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 21:03:46 GMT
Content-Encoding: gzip
Age: 256823
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length: 2618
Last-Modified: Tue, 24 Jan 2023 21:41:06 GMT
Server: ECS (nyb/1D0C)
Etag: "506673dbdb9085e7201e137e893cc152+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
x-tw-cdn: VZ
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK tweet_button.2b2d73daf636805223fb11d48f3e94f7.en.html Show response
platform.twitter.com/widgets/ Frame AA46 37 KB
14 KB 20ms
19ms Document
text/html 2606:2800:220:de:468:2285:c1:4a3
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.2b2d73daf636805223fb11d48f3e94f7.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (nyb/1D0C) /
Resource Hash: a7fd41fd349db8949a256323b8d9af1f86fe14bbd84214553ca70cb488a95e7b

Request headers

Referer: https://www.winnipegfreepress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 256824
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 13592
Content-Type: text/html; charset=utf-8
Date: Fri, 27 Jan 2023 21:03:46 GMT
Etag: "28919252629e2fa1d4ed52f48cb66ac0+gzip"
Last-Modified: Tue, 24 Jan 2023 21:41:10 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (nyb/1D0C)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ

GET
H/1.1 200
OK tweet_button.2b2d73daf636805223fb11d48f3e94f7.en.html Show response
platform.twitter.com/widgets/ Frame 4539 37 KB
14 KB 39ms
19ms Document
text/html 2606:2800:220:de:468:2285:c1:4a3
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.2b2d73daf636805223fb11d48f3e94f7.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (nyb/1D0C) /
Resource Hash: a7fd41fd349db8949a256323b8d9af1f86fe14bbd84214553ca70cb488a95e7b

Request headers

Referer: https://www.winnipegfreepress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 256824
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 13592
Content-Type: text/html; charset=utf-8
Date: Fri, 27 Jan 2023 21:03:46 GMT
Etag: "28919252629e2fa1d4ed52f48cb66ac0+gzip"
Last-Modified: Tue, 24 Jan 2023 21:41:10 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (nyb/1D0C)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ

GET
H2 200 embeds
syndication.twitter.com/i/jot/ 43 B
102 B 52ms
52ms Image
image/gif 104.244.42.8
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot/embeds?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%22%2C%22widget_frame%22%3Afalse%2C%22widget_site_screen_name%22%3A%22WinnipegNews%22%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22context%22%3A%22rufous-eol%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1674853426702%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%22aaf4084522e3a%3A1674595607486%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D&session_id=15119dfe8028c55b3339ac89cbb72f49d52cf5b1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.8 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-response-time: 8
date: Fri, 27 Jan 2023 21:03:46 GMT
strict-transport-security: max-age=631138519
last-modified: Fri, 27 Jan 2023 21:03:46 GMT
server: tsa_b
vary: Origin
content-type: image/gif
x-transaction-id: 7fab4122dcc870ef
cache-control: must-revalidate, max-age=600
perf: 7626143928
x-connection-hash: d815160567b557f8f9feae45c98a4053d436be1c759276a825c2fa18f1254c1e
content-length: 43

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 86ms
37ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-126530131-1&cid=197573043.1674853427&jid=973574345&_u=YEDAAUAAAAAAACAEK~&z=579902040

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
408 B 106ms
40ms Image
image/gif 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-126530131-1&cid=197573043.1674853427&jid=973574345&_u=YEDAAUAAAAAAACAEK~&z=579902040

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame AA46 822 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 dc_pre=CJ3np5zT6PwCFdkKaAgdlbwF8Q;src=10441863;type=traff0;cat=lokno00;ord=6286165176138;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%... Show response
adservice.google.ca/ddm/fls/i/ Frame EC98 194 B
515 B 121ms
48ms Document
text/html 2607:f8b0:4006:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/ddm/fls/i/dc_pre=CJ3np5zT6PwCFdkKaAgdlbwF8Q;src=10441863;type=traff0;cat=lokno00;ord=6286165176138;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CJ3np5zT6PwCFdkKaAgdlbwF8Q;src=10441863;type=traff0;cat=lokno00;ord=6286165176138;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 85
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 27 Jan 2023 21:03:46 GMT
expires: Fri, 27 Jan 2023 21:03:46 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 35ms
35ms XHR
text/plain 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=2037910435&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&ul=en-us&de=UTF-8&dt=Lower%20patient%20volumes%20at%20Children%E2%80%99s%20Hospital%20likely%20calm%20before%20expected%20storm%2C%20ER%20director%20says%20%E2%80%93%20Winnipeg%20Free%20Press&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Form%20Submission&ea=track_event&el=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&_u=aEDAAUABAAAAACAEK~&jid=1685002045&gjid=675797448&cid=197573043.1674853427&tid=UA-350959-63&_gid=595358482.1674853427&_r=1&_slc=1&gtm=2wg1p0TK48WJ9&z=1741248331

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.winnipegfreepress.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:47 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.winnipegfreepress.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 3AEB 0
79 B 20ms
19ms Document
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.winnipegfreepress.com
Referer: https://www.winnipegfreepress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.winnipegfreepress.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Fri, 27 Jan 2023 21:03:47 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 34ms
33ms XHR
text/plain 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-350959-63&cid=197573043.1674853427&jid=1685002045&gjid=675797448&_gid=595358482.1674853427&_u=aEDAAUABAAAAACAEK~&z=625887699

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.winnipegfreepress.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Fri, 27 Jan 2023 21:03:47 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.winnipegfreepress.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 share_button.php Show response
www.facebook.com/v5.0/plugins/ Frame D222 44 KB
13 KB 149ms
148ms Document
text/html 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v5.0/plugins/share_button.php?app_id=129054303830226&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df131de819884e1%26domain%3Dwww.winnipegfreepress.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.winnipegfreepress.com%252Ff2df0d1564bf344%26relation%3Dparent.parent&container_width=34&href=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&layout=button_count&locale=en_US&sdk=joey&size=small

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=68a676a13f227f5e7a1e4c4bb19996a1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f061539654f2846e056534dcafbe83aeed3bf1fa672b0e7b944d350dd63ba493

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.winnipegfreepress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: br
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
date: Fri, 27 Jan 2023 21:03:47 GMT
document-policy: force-load-at-top
expires: Sat, 01 Jan 2000 00:00:00 GMT
facebook-api-version: v9.0
origin-agent-cluster: ?0
pragma: no-cache
priority: u=3,i
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-debug: 9Ik1YuwK5uevJUA9zndtFmXGmd03expH9Ii+S2SwQ8xOe/5yuhJ19OOdUWVPtzxNK8E7+F8kXysjgcvFsycxTw==
x-fb-rlafr: 0
x-xss-protection: 0

GET
H3 200 share_button.php Show response
www.facebook.com/v5.0/plugins/ Frame CDB4 44 KB
13 KB 139ms
139ms Document
text/html 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v5.0/plugins/share_button.php?app_id=129054303830226&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df36e3871ea298ec%26domain%3Dwww.winnipegfreepress.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.winnipegfreepress.com%252Ff2df0d1564bf344%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&layout=button_count&locale=en_US&sdk=joey&size=small

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=68a676a13f227f5e7a1e4c4bb19996a1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

20e06326099a0f94387301f38a87174f68f131f6bb1f0224bc121524c6765d0c

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.winnipegfreepress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: br
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
date: Fri, 27 Jan 2023 21:03:47 GMT
document-policy: force-load-at-top
expires: Sat, 01 Jan 2000 00:00:00 GMT
facebook-api-version: v9.0
origin-agent-cluster: ?0
pragma: no-cache
priority: u=3,i
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-debug: UeqA/EGALA/2D0DI7bS508jpoxTK9sULBJv/CcR8FsfLrjsIm49Dmdb27DLJLLvUH1D0M+OR/hlWo1dRzcqdfg==
x-fb-rlafr: 0
x-xss-protection: 0

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 39ms
38ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-350959-63&cid=197573043.1674853427&jid=1685002045&_u=aEDAAUABAAAAACAEK~&z=452839472

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
107 B 39ms
39ms Image
image/gif 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-350959-63&cid=197573043.1674853427&jid=1685002045&_u=aEDAAUABAAAAACAEK~&z=452839472

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 21ms
20ms Image
image/gif 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=2037910435&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&ul=en-us&de=UTF-8&dt=Lower%20patient%20volumes%20at%20Children%E2%80%99s%20Hospital%20likely%20calm%20before%20expected%20storm%2C%20ER%20director%20says%20%E2%80%93%20Winnipeg%20Free%20Press&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Tracking&ea=25%25&el=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&_u=aEDAAUABAAAAACAEK~&jid=&gjid=&cid=197573043.1674853427&tid=UA-350959-63&_gid=595358482.1674853427&gtm=2wg1p0TK48WJ9&z=817948882

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 02:05:56 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68271
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 21ms
20ms Image
image/gif 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=2037910435&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&ul=en-us&de=UTF-8&dt=Lower%20patient%20volumes%20at%20Children%E2%80%99s%20Hospital%20likely%20calm%20before%20expected%20storm%2C%20ER%20director%20says%20%E2%80%93%20Winnipeg%20Free%20Press&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Tracking&ea=50%25&el=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&_u=aEDAAUABAAAAACAEK~&jid=&gjid=&cid=197573043.1674853427&tid=UA-350959-63&_gid=595358482.1674853427&gtm=2wg1p0TK48WJ9&z=33743819

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 02:05:56 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68271
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 22ms
21ms Image
image/gif 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=2037910435&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&ul=en-us&de=UTF-8&dt=Lower%20patient%20volumes%20at%20Children%E2%80%99s%20Hospital%20likely%20calm%20before%20expected%20storm%2C%20ER%20director%20says%20%E2%80%93%20Winnipeg%20Free%20Press&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Tracking&ea=75%25&el=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&_u=aEDAAUABAAAAACAEK~&jid=&gjid=&cid=197573043.1674853427&tid=UA-350959-63&_gid=595358482.1674853427&gtm=2wg1p0TK48WJ9&z=729861115

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 02:05:56 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68271
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 22ms
21ms Image
image/gif 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=2037910435&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&ul=en-us&de=UTF-8&dt=Lower%20patient%20volumes%20at%20Children%E2%80%99s%20Hospital%20likely%20calm%20before%20expected%20storm%2C%20ER%20director%20says%20%E2%80%93%20Winnipeg%20Free%20Press&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Tracking&ea=90%25&el=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&_u=aEDAAUABAAAAACAEK~&jid=&gjid=&cid=197573043.1674853427&tid=UA-350959-63&_gid=595358482.1674853427&gtm=2wg1p0TK48WJ9&z=545361694

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 02:05:56 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68271
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 23ms
22ms Image
image/gif 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=2037910435&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&ul=en-us&de=UTF-8&dt=Lower%20patient%20volumes%20at%20Children%E2%80%99s%20Hospital%20likely%20calm%20before%20expected%20storm%2C%20ER%20director%20says%20%E2%80%93%20Winnipeg%20Free%20Press&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Tracking&ea=100%25&el=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&_u=aEDAAUABAAAAACAEK~&jid=&gjid=&cid=197573043.1674853427&tid=UA-350959-63&_gid=595358482.1674853427&gtm=2wg1p0TK48WJ9&z=1857898332

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 02:05:56 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68271
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 GzgedhmzSQa.png
static.xx.fbcdn.net/rsrc.php/v3/yn/r/ Frame D222 272 B
710 B 63ms
20ms Image
image/png 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yn/r/GzgedhmzSQa.png

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v5.0/plugins/share_button.php?app_id=129054303830226&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df131de819884e1%26domain%3Dwww.winnipegfreepress.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.winnipegfreepress.com%252Ff2df0d1564bf344%26relation%3Dparent.parent&container_width=34&href=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&layout=button_count&locale=en_US&sdk=joey&size=small

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0187fed1f15750c2fa9e427912bb64d209aad8b47ee4fa9576f6666b68188d36

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:47 GMT
x-content-type-options: nosniff
content-md5: lIjeC3eJAboxVqIOEs/Auw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 272
x-fb-rlafr: 0
x-fb-debug: iJBmEoNqm7T26low4Y4DVCpdTwS4jl2MPSFf/NfOvLfdPuKnB+EfT9pg7SfyH1z6O5dzC5cOTb5rnM7XGfpm7A==
x-fb-trip-id: 1512268381
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-type: image/png
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Mon, 22 Jan 2024 11:44:20 GMT

GET
H2 200 GzgedhmzSQa.png
static.xx.fbcdn.net/rsrc.php/v3/yn/r/ Frame CDB4 272 B
418 B 56ms
21ms Image
image/png 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yn/r/GzgedhmzSQa.png

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v5.0/plugins/share_button.php?app_id=129054303830226&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df36e3871ea298ec%26domain%3Dwww.winnipegfreepress.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.winnipegfreepress.com%252Ff2df0d1564bf344%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&layout=button_count&locale=en_US&sdk=joey&size=small

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0187fed1f15750c2fa9e427912bb64d209aad8b47ee4fa9576f6666b68188d36

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:47 GMT
x-content-type-options: nosniff
content-md5: lIjeC3eJAboxVqIOEs/Auw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 272
x-fb-rlafr: 0
x-fb-debug: iJBmEoNqm7T26low4Y4DVCpdTwS4jl2MPSFf/NfOvLfdPuKnB+EfT9pg7SfyH1z6O5dzC5cOTb5rnM7XGfpm7A==
x-fb-trip-id: 1512268381
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-type: image/png
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Mon, 22 Jan 2024 11:44:20 GMT

POST
H/1.1 200
OK identify Show response
account.winnipegfreepress.com/api/v2/auth/ 210 B
1 KB 466ms
251ms XHR
application/json 205.200.191.140
MTS-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://account.winnipegfreepress.com/api/v2/auth/identify

Requested by

Host: www.winnipegfreepress.com
URL: https://www.winnipegfreepress.com/_static/??-eJytkbtuwzAMRX+okmLHeSxFh/xAt86yRDs09Col2Ui/PkqQol0C1EIBARxEHhxeiiUw5V0Cl4QyWAqzmQWTR3RRDHT/0sJgL7S8TJHNDW82/MAtOj7FF/H3+QHdCBQIXWpvmCPfV1DO0mkDvaSi0hWPtSY/899D6JTJGqKYyvvMQJdH+U1+2sQsjiQTrNRYhiBDWLm79RrI4RdV5BYXDECsz7f12XzkW95UYMrxyD8LBq0cIRovNegK9iN1Autn+DhjghikKrKbIrutBypvTBE7yZDQu//CvZsc61jBx1Ta3+xrsz90bdftdu10Be0MTdY=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

205.200.191.140 Winnipeg, Canada, ASN7122 (MTS-ASN, CA),

Reverse DNS

205-200-200-191-140.static.bellmts.net

Software

Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/8.1.14 / PHP/8.1.14

Resource Hash

40390a0095bd5cd1fe6e552bd3083de8a79b4df9c5e47ba8e5fbb44c4b9cbea9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.winnipegfreepress.com;
Strict-Transport-Security	max-age=63072000;
X-Content-Type-Options	nosniff
X-Frame-Options	Allow-From https://winnipegfreepress.com/

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.winnipegfreepress.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Fri, 27 Jan 2023 21:03:47 GMT
Strict-Transport-Security: max-age=63072000;
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://*.winnipegfreepress.com;
X-Powered-By: PHP/8.1.14
Transfer-Encoding: chunked
Connection: Keep-Alive
Referrer-Policy
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/8.1.14
X-Frame-Options: Allow-From https://winnipegfreepress.com/
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: application/json
Access-Control-Allow-Origin: https://www.winnipegfreepress.com
Cache-Control: max-age=0, no-store
Access-Control-Allow-Credentials: true
X-RateLimit-Limit: 60
Keep-Alive: timeout=5, max=100
X-RateLimit-Remaining: 59

GET
H2 200 DMlI5jBPdxv.js Show response
static.xx.fbcdn.net/rsrc.php/v3iEpO4/y6/l/en_US/ Frame D222 526 KB
135 KB 33ms
22ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/y6/l/en_US/DMlI5jBPdxv.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d1bc21a8c525ddf1edc9ef67efe808d3772f3963efe23b88542f37ab5ec37604

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:47 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: e7DxMMz02XycRNB76GGKdQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 138198
x-fb-rlafr: 0
x-fb-debug: UhupM2xXM745OPsrf1jPCPkwzIiWdcZ6ea4AM5u3oUT1G9WU1RpsVjSrRi34nAsLJYfOi3+ciPx+l8rVOSlIOA==
x-fb-trip-id: 1512268381
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Wed, 24 Jan 2024 23:17:45 GMT

GET
H2 200 DMlI5jBPdxv.js Show response
static.xx.fbcdn.net/rsrc.php/v3iEpO4/y6/l/en_US/ Frame CDB4 526 KB
135 KB 72ms
66ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/y6/l/en_US/DMlI5jBPdxv.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v5.0/plugins/share_button.php?app_id=129054303830226&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df36e3871ea298ec%26domain%3Dwww.winnipegfreepress.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.winnipegfreepress.com%252Ff2df0d1564bf344%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&layout=button_count&locale=en_US&sdk=joey&size=small

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d1bc21a8c525ddf1edc9ef67efe808d3772f3963efe23b88542f37ab5ec37604

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:47 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: e7DxMMz02XycRNB76GGKdQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 138198
x-fb-rlafr: 0
x-fb-debug: UhupM2xXM745OPsrf1jPCPkwzIiWdcZ6ea4AM5u3oUT1G9WU1RpsVjSrRi34nAsLJYfOi3+ciPx+l8rVOSlIOA==
x-fb-trip-id: 1512268381
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Wed, 24 Jan 2024 23:17:45 GMT

GET
H3 200 share_button.php Show response
www.facebook.com/v5.0/plugins/ Frame 443C 44 KB
13 KB 91ms
90ms Document
text/html 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v5.0/plugins/share_button.php?app_id=129054303830226&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df38375f52547ce%26domain%3Dwww.winnipegfreepress.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.winnipegfreepress.com%252Ff2df0d1564bf344%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&layout=button_count&locale=en_US&sdk=joey&size=small

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=68a676a13f227f5e7a1e4c4bb19996a1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1218fcd581c61f2eb8e8eebc7e48f4385ccc8ccc6f5f82b3e5ebf49cd363f736

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.winnipegfreepress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: br
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
date: Fri, 27 Jan 2023 21:03:47 GMT
document-policy: force-load-at-top
expires: Sat, 01 Jan 2000 00:00:00 GMT
facebook-api-version: v9.0
origin-agent-cluster: ?0
pragma: no-cache
priority: u=3,i
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-debug: CdQlZsfz2rRT3JlJ6/b+eCkSfH3tC8GJxNIFd/IbvcQk/4OuFA0SPzcLRtBmND53tcNRoxabf603OmLLzihOWg==
x-fb-rlafr: 0
x-xss-protection: 0

GET
H3 200 GzgedhmzSQa.png
static.xx.fbcdn.net/rsrc.php/v3/yn/r/ Frame 443C 272 B
324 B 19ms
19ms Image
image/png 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yn/r/GzgedhmzSQa.png

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v5.0/plugins/share_button.php?app_id=129054303830226&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df38375f52547ce%26domain%3Dwww.winnipegfreepress.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.winnipegfreepress.com%252Ff2df0d1564bf344%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&layout=button_count&locale=en_US&sdk=joey&size=small

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0187fed1f15750c2fa9e427912bb64d209aad8b47ee4fa9576f6666b68188d36

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:47 GMT
x-content-type-options: nosniff
content-md5: lIjeC3eJAboxVqIOEs/Auw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 272
x-fb-rlafr: 0
x-fb-debug: iJBmEoNqm7T26low4Y4DVCpdTwS4jl2MPSFf/NfOvLfdPuKnB+EfT9pg7SfyH1z6O5dzC5cOTb5rnM7XGfpm7A==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-type: image/png
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Mon, 22 Jan 2024 11:44:20 GMT

GET
H3 200 DMlI5jBPdxv.js Show response
static.xx.fbcdn.net/rsrc.php/v3iEpO4/y6/l/en_US/ Frame 443C 526 KB
135 KB 20ms
20ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/y6/l/en_US/DMlI5jBPdxv.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v5.0/plugins/share_button.php?app_id=129054303830226&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df38375f52547ce%26domain%3Dwww.winnipegfreepress.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.winnipegfreepress.com%252Ff2df0d1564bf344%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&layout=button_count&locale=en_US&sdk=joey&size=small

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d1bc21a8c525ddf1edc9ef67efe808d3772f3963efe23b88542f37ab5ec37604

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:47 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: e7DxMMz02XycRNB76GGKdQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 138198
x-fb-rlafr: 0
x-fb-debug: UhupM2xXM745OPsrf1jPCPkwzIiWdcZ6ea4AM5u3oUT1G9WU1RpsVjSrRi34nAsLJYfOi3+ciPx+l8rVOSlIOA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Wed, 24 Jan 2024 23:17:45 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 35ms
34ms XHR
text/plain 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=2037910435&t=event&_s=1&dl=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&ul=en-us&de=UTF-8&dt=Lower%20patient%20volumes%20at%20Children%E2%80%99s%20Hospital%20likely%20calm%20before%20expected%20storm%2C%20ER%20director%20says%20%E2%80%93%20Winnipeg%20Free%20Press&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=displayedEndOfMeterMessage&ea=article-page&_u=aEDAAUABAAAAACAEK~&jid=791876430&gjid=1982002468&cid=197573043.1674853427&tid=UA-350959-63&_gid=595358482.1674853427&_r=1&gtm=2ou1p0&cd2=not-logged-in&cd3=Katie%20May&cd10=WFP%20Story&cd4=666&z=965061402

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.winnipegfreepress.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:47 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.winnipegfreepress.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
261 B 104ms
35ms Ping
text/plain 2001:4860:4802:32::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-770Z3PGDW4&gtm=2oe1p0&_p=2037910435&_gaz=1&cid=197573043.1674853427&ul=en-us&sr=1600x1200&uaW=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1674853427&sct=1&seg=0&dl=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&dt=Lower%20patient%20volumes%20at%20Children%E2%80%99s%20Hospital%20likely%20calm%20before%20expected%20storm%2C%20ER%20director%20says%20%E2%80%93%20Winnipeg%20Free%20Press&en=article-page&_fv=1&_ss=1&_ee=1&ep.action_location=article-page&ep.event_category=displayedEndOfMeterMessage&ep.action_value=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-770Z3PGDW4&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:48 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.winnipegfreepress.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
stats.g.doubleclick.net/g/ 0
17 B 33ms
33ms Ping
text/plain 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-770Z3PGDW4&cid=197573043.1674853427&gtm=2oe1p0&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-770Z3PGDW4&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:47 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.winnipegfreepress.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 42ms
41ms Image
image/gif 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-770Z3PGDW4&cid=197573043.1674853427&gtm=2oe1p0&aip=1&z=757942587

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 20ms
20ms Image
image/gif 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=2037910435&t=event&_s=2&dl=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&ul=en-us&de=UTF-8&dt=Lower%20patient%20volumes%20at%20Children%E2%80%99s%20Hospital%20likely%20calm%20before%20expected%20storm%2C%20ER%20director%20says%20%E2%80%93%20Winnipeg%20Free%20Press&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=NTG%20paywall&ea=paywall%20modal%20impression%201&_u=aEDAAUABAAAAACAEK~&jid=&gjid=&cid=197573043.1674853427&tid=UA-350959-63&_gid=595358482.1674853427&gtm=2ou1p0&cd2=not-logged-in&cd3=Katie%20May&cd10=WFP%20Story&cd4=666&z=1606465926

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 02:05:56 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68271
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK segment Show response
api.cxense.com/profile/user/ 62 B
679 B 27ms
27ms Script
text/javascript 86.109.7.56
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.cxense.com/profile/user/segment?callback=cXJsonpCB4&persisted=38d5e37a13985ceec570aaaacd3a7c2f5defc36d&json=%7B%22identities%22%3A%5B%7B%22id%22%3A%22ldf0hif4f9ck4836%22%2C%22type%22%3A%22cx%22%7D%5D%7D

Requested by

Host: cdn.cxense.com
URL: https://cdn.cxense.com/cx.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

86.109.7.56 Ashburn, United States, ASN54825 (PACKET, US),

Reverse DNS

Software

Jetty(9.4.28.v20200408) /

Resource Hash

16d2282ccdc7581daaae579c54629a373033afe1cbc1384525566922062b680e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:47 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
server: Jetty(9.4.28.v20200408)
content-type: text/javascript;charset=utf-8
p3p: policyref="http://www.cxense.com/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-store, no-cache, must-revalidate
content-length: 62
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
317 B 45ms
42ms Script
application/javascript 2607:f8b0:4006:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=www.winnipegfreepress.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
317 B 42ms
40ms Script
application/javascript 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.winnipegfreepress.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 30 KB
13 KB 96ms
95ms XHR
text/plain 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=641255830815295&correlator=1673290181475288&eid=31071905%2C31071601&output=ldjh&gdfp_req=1&vrg=2023012501&ptt=17&impl=fif&iu_parts=3823844%2Cwinnipegfreepress.com&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=1&adks=48406450&sfv=1-0-40&prev_scp=loc%3Dtop%26pos%3D1%26page%3Dstory%26ut%3Dnot-logged-in%26ck%3Dlocal%2Cweather-cloudy-periods%2Cweather-mainly-clear%2Cweather-30-colder%26imp%3Dlocal%26pr%3Dnews&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1674853428042&lmt=1674853428&dlt=1674853425547&idt=936&adxs=984&adys=333&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&frm=20&vis=1&psz=300x270&msz=300x125&fws=4&ohw=300&ga_vid=197573043.1674853427&ga_sid=1674853428&ga_hid=2037910435&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

620048ecc181d81dc017c2e09d10c3c5a609c60f9bc7947978bf0e1c3fa8baf5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13198
x-xss-protection: 0
google-lineitem-id: 6083404241
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138400963549
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.winnipegfreepress.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 30 KB
13 KB 90ms
89ms XHR
text/plain 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=641255830815295&correlator=631850186407405&eid=31071905%2C31071601&output=ldjh&gdfp_req=1&vrg=2023012501&ptt=17&impl=fif&iu_parts=3823844%2Cwinnipegfreepress.com&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x90%7C970x250&ifi=2&adks=2788323370&sfv=1-0-40&prev_scp=loc%3Dbottom%26pos%3D3%26page%3Dstory%26ut%3Dnot-logged-in%26ck%3Dlocal%2Cweather-cloudy-periods%2Cweather-mainly-clear%2Cweather-30-colder%26imp%3Dlocal%26pr%3Dnews&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1674853428060&lmt=1674853428&dlt=1674853425547&idt=936&adxs=316&adys=1063&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&frm=20&vis=1&psz=968x24&msz=968x0&fws=4&ohw=968&ga_vid=197573043.1674853427&ga_sid=1674853428&ga_hid=2037910435&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd26b03aa46ea621788e313bc2d3ed2cdeb9c94095651a393afcb93b2cfa9a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12925
x-xss-protection: 0
google-lineitem-id: 6191205535
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138418931704
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.winnipegfreepress.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 30 KB
13 KB 176ms
175ms XHR
text/plain 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=641255830815295&correlator=4478519439294640&eid=31071905%2C31071601&output=ldjh&gdfp_req=1&vrg=2023012501&ptt=17&impl=fif&iu_parts=3823844%2Cwinnipegfreepress.com&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x90%7C970x250&ifi=3&adks=658958671&sfv=1-0-40&prev_scp=loc%3Dtop%26pos%3D1%26page%3Dstory%26ut%3Dnot-logged-in%26ck%3Dlocal%2Cweather-cloudy-periods%2Cweather-mainly-clear%2Cweather-30-colder%26imp%3Dlocal%26pr%3Dnews&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1674853428070&lmt=1674853428&dlt=1674853425547&idt=936&adxs=316&adys=144&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&frm=20&vis=1&psz=1000x16&msz=968x0&fws=0&ohw=0&ga_vid=197573043.1674853427&ga_sid=1674853428&ga_hid=2037910435&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9d4f3413fb1730204fc6a30dd953b5dd46ba8f44266a7cf26d8061e3ebb4af5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12904
x-xss-protection: 0
google-lineitem-id: 6191205535
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138418931707
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.winnipegfreepress.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 20 KB
9 KB 101ms
100ms XHR
text/plain 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=641255830815295&correlator=2051395385315249&eid=31071905%2C31071601&output=ldjh&gdfp_req=1&vrg=2023012501&ptt=17&impl=fif&iu_parts=3823844%2Cwinnipegfreepress.com&enc_prev_ius=%2F0%2F1&prev_iu_szs=4x4&ifi=4&adks=3616694195&sfv=1-0-40&prev_scp=loc%3Dtop%26pos%3D1%26page%3Dstory%26ut%3Dnot-logged-in%26ck%3Dlocal%2Cweather-cloudy-periods%2Cweather-mainly-clear%2Cweather-30-colder%26imp%3Dlocal%26pr%3Dnews&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1674853428080&lmt=1674853428&dlt=1674853425547&idt=936&adxs=0&adys=0&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&frm=20&vis=1&psz=4x0&msz=4x0&fws=0&ohw=0&ga_vid=197573043.1674853427&ga_sid=1674853428&ga_hid=2037910435&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d5e8749c179ffe5c9647f8be0f59bf1cb152fe09bc0c65f929ffcb5900c8fab0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9470
x-xss-protection: 0
google-lineitem-id: 4467458844
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 119509455844
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.winnipegfreepress.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 98ms
46ms XHR
application/json 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2023012501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2b6a01e4e71b7b21f890d5ee82e0e27d2ce6faba46d79ac190e201aa4dcd04c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11144
x-xss-protection: 0

GET
H2 200 container.html Show response
06152dbe7ff498f171de46fc2c988bb1.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D504 6 KB
3 KB 115ms
38ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://06152dbe7ff498f171de46fc2c988bb1.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.winnipegfreepress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 27 Jan 2023 21:03:48 GMT
expires: Sat, 27 Jan 2024 21:03:48 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK push Show response
comcluster.cxense.com/dmp/ 108 B
681 B 92ms
25ms Script
text/javascript 145.40.89.32
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://comcluster.cxense.com/dmp/push?callback=cXJsonpCB5&ver=2.8.10&glb=&json=%7B%22events%22%3A%5B%7B%22type%22%3A%22displayedEndOfMeterMessage%22%2C%22rnd%22%3A%22ldf0hk0h8r0zu5pe%22%2C%22siteId%22%3Anull%2C%22prnd%22%3A%22ldf0hif4bosbl6v9%22%2C%22userIds%22%3A%5B%7B%22id%22%3A%22ldf0hif4f9ck4836%22%2C%22type%22%3A%22cx%22%7D%5D%2C%22customParameters%22%3A%5B%7B%22group%22%3A%22isEndOfMeterOffer%22%2C%22item%22%3A%22true%22%2C%22type%22%3A%22string%22%7D%5D%7D%5D%7D

Requested by

Host: cdn.cxense.com
URL: https://cdn.cxense.com/cx.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

145.40.89.32 Ashburn, United States, ASN54825 (PACKET, US),

Reverse DNS

Software

Jetty(9.4.28.v20200408) /

Resource Hash

31f8894ef63c6dea3f1a58ae8fda7e7fb51df78ec054ab134c8a5f966e48501f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:48 GMT
x-content-type-options: nosniff
server: Jetty(9.4.28.v20200408)
p3p: policyref="http://www.cxense.com/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: text/javascript;charset=utf-8
cache-control: no-store, no-cache, must-revalidate
content-length: 108
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK sp1.html Show response
cdn.cxense.com/ Frame 3E49 684 B
749 B 25ms
25ms Document
text/html 2600:1400:d:595::268b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cxense.com/sp1.html
Requested by: Host: cdn.cxense.com
URL: https://cdn.cxense.com/cx.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:595::268b New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 535be4b8bedf82433d210152dfb19dd4eaf5796c4e61c2be1c2ed356827b5580

Request headers

Referer: https://www.winnipegfreepress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Cache-Control: max-age=864000
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 379
Content-Type: text/html
Date: Fri, 27 Jan 2023 21:03:48 GMT
Expires: Mon, 06 Feb 2023 21:03:48 GMT
Last-Modified: Tue, 11 Jan 2022 07:21:04 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

POST
H3 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
25 B 39ms
38ms XHR
text/plain 2607:f8b0:4004:c1b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-350959-63&cid=197573043.1674853427&jid=791876430&gjid=1982002468&_gid=595358482.1674853427&_u=aEDAAUABAAAAACAEK~&z=58397109

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.winnipegfreepress.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Fri, 27 Jan 2023 21:03:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.winnipegfreepress.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 20ms
19ms Image
image/gif 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=2037910435&t=pageview&_s=3&dl=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&ul=en-us&de=UTF-8&dt=Lower%20patient%20volumes%20at%20Children%E2%80%99s%20Hospital%20likely%20calm%20before%20expected%20storm%2C%20ER%20director%20says%20%E2%80%93%20Winnipeg%20Free%20Press&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEDAAUABAAAAACAEK~&jid=&gjid=&cid=197573043.1674853427&tid=UA-350959-63&_gid=595358482.1674853427&gtm=2ou1p0&cd2=not-logged-in&cd3=Katie%20May&cd10=WFP%20Story&cd4=666&z=1429825168

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 02:05:56 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68272
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3

200

activityi;dc_pre=CPmFjp3T6PwCFYitnwodcaUIdQ;src=10441863;type=traff0;cat=lokno006;ord=495237738078;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingne... Show response
10441863.fls.doubleclick.net/ Frame AFF1
Redirect Chain

https://10441863.fls.doubleclick.net/activityi;src=10441863;type=traff0;cat=lokno006;ord=495237738078;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakin...
https://10441863.fls.doubleclick.net/activityi;dc_pre=CPmFjp3T6PwCFYitnwodcaUIdQ;src=10441863;type=traff0;cat=lokno006;ord=495237738078;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fw...

607 B
373 B

97ms
96ms

Document
text/html

142.250.80.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10441863.fls.doubleclick.net/activityi;dc_pre=CPmFjp3T6PwCFYitnwodcaUIdQ;src=10441863;type=traff0;cat=lokno006;ord=495237738078;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TK48WJ9

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.70 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f6.1e100.net

Software

cafe /

Resource Hash

662c8f25d669be9cc623aad275281bebdf8731b6b05bab7ac247fac86a05623f

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.winnipegfreepress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 350
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 27 Jan 2023 21:03:48 GMT
expires: Fri, 27 Jan 2023 21:03:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 27 Jan 2023 21:03:48 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://10441863.fls.doubleclick.net/activityi;dc_pre=CPmFjp3T6PwCFYitnwodcaUIdQ;src=10441863;type=traff0;cat=lokno006;ord=495237738078;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 /
www.facebook.com/tr/ 0
15 B 20ms
19ms Image
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=524625568278206&ev=WFPHitPayWall&dl=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&rl=&if=false&ts=1674853428179&sw=1600&sh=1200&v=2.9.94&r=stable&a=tmgoogletagmanager&ec=3&o=30&fbp=fb.1.1674853426635.765317382&it=1674853426553&coo=false&rqm=GET

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 27 Jan 2023 21:03:48 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H/1.1 200
OK cx.js Show response
cdn.cxense.com/ Frame 3E49 107 KB
34 KB 28ms
27ms Script
application/x-javascript 2600:1400:d:595::268b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cxense.com/cx.js
Requested by: Host: cdn.cxense.com
URL: https://cdn.cxense.com/sp1.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:595::268b New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 06639d033d7cf998bac4c166c2040102efc566e743de92c2d7b932dee909e3c7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cdn.cxense.com/sp1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 21:03:48 GMT
Content-Encoding: gzip
Last-Modified: Fri, 20 Jan 2023 05:10:31 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 34709
Expires: Fri, 27 Jan 2023 22:03:48 GMT

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 41ms
40ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-350959-63&cid=197573043.1674853427&jid=791876430&_u=aEDAAUABAAAAACAEK~&z=869330061

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 43ms
42ms Image
image/gif 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-350959-63&cid=197573043.1674853427&jid=791876430&_u=aEDAAUABAAAAACAEK~&z=869330061

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 56A1 0
0 46ms
45ms Fetch
image/gif 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsseyWnGRzJ4PbF3Xf3SoWJO3K95h9oFaGRo16jcsvd4p2GjbTqySQog0eibxAPy2kau2dJeHnxNYAJY1XBWS9Gyi-4OKkPWSPmxId21Et4hsrccp7gwNUfmSgD_LCIOFiwc_oMR7zrXEWlL0ZaBZluIdFbJd40p-pqE_V8EgMdKkPNJW-nQDZz0RRzrloUNQWA6r-5wTgGrZK3cx1qE9hOh_8RCDMAJT1ymKs50YlYaHZx6Z7IW69pDllaoe-2eShWU_e8o61z0IIghS-ivWfnBSW4soLqoX0prePxYfYvGJ9e_usi_WjA6x3_HBCfjhILm6c8Fdi0mAlmVt8-HIAAN&sai=AMfl-YTlgrAXpM-gLULGwT13WBRr5no0XSAX24oWNoMmJ-vpM6E87xDtpY3kkR1CwSXXoFEMeSwzF_etEjnupOhmETETJrQGjB4DN67l_8tFLpINwaldygvl4zM5kXosa7I0hw&sig=Cg0ArKJSzGAkQVuzOLraEAE&uach_m=[UACH]&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230126/r20110914/client/ Frame 56A1 3 KB
1 KB 24ms
20ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230126/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 20:22:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2449
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 10 Feb 2023 20:22:59 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 56A1 156 KB
48 KB 109ms
49ms Script
text/javascript 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

948dfd7372d70c12a80472d86b4033d93adbb52d02d4585d519416c4f4b4be62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49065
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1674650782302584"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 27 Jan 2023 21:03:48 GMT

GET
H2 200 14674141166690777470
tpc.googlesyndication.com/simgad/ Frame 56A1 87 KB
88 KB 24ms
22ms Image
image/jpeg 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14674141166690777470

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

806cf603c24bdb0509ffe750c54bdef884190fbc3841ed962d2a39e4a3751774

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 26 Jan 2023 14:00:37 GMT
x-content-type-options: nosniff
age: 111791
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 89368
x-xss-protection: 0
last-modified: Thu, 19 May 2022 21:05:14 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 26 Jan 2024 14:00:37 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 56A1 0
0 38ms
37ms Image
text/html 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS8bq10yms58pqYnxGFdFuEyW19RqsEjeqezxqmPDCpZH_ekAfyleg3RgLtmEYIiB2iQaVkhXm1MNSzqkT-4sdZj81t0Q
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame C517 0
0 53ms
51ms Fetch
image/gif 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssl8cJ-5O6oKU8KD3B_UoJ0RdltN7hTQDYJyMMgWTVAT0gPdkCnF-PUl4yjdd4h2fhKzdAxOlkZDM1IN2V3a_PUO6fSXQZ4s3u7LUZrIOyp_teFEVh_OV-M8ewTmX6MNRf1_8ZDYWvOoHbGcWKRNA4r5c8XQ_xe1UQl2Su0VYlpyQrO0gItq2ws1Nh4fU8xJobrn7D1YaW_UERzGQd1lKfxEf7l8NMuDbpUpzj2OOSdpFaa-wg7NfCcm8synvHn26IeWUsJYmDz-vec9vmoEnjeZ9qggQHlc6QiBvZhLLiJxp9HM15pyoMY-RAML1PUg19xXMmnJQv4-c1wZwMIYh8R&sai=AMfl-YSNWx1H0q3_OjzJGHg9zTTw1Or9n0UIhOQCFeIcHUCz2-_nt8kUvY5O-73tb8kbMIPXZm3sjf6qkBiIDmPZmqSEXQutnGAGfNRvRT38Uq5WRLYZeaMEVRHUnZCGRxDN&sig=Cg0ArKJSzO2v2tyktfpNEAE&uach_m=[UACH]&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230126/r20110914/client/ Frame C517 3 KB
1 KB 23ms
19ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230126/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 20:22:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2449
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 10 Feb 2023 20:22:59 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C517 156 KB
48 KB 95ms
77ms Script
text/javascript 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

948dfd7372d70c12a80472d86b4033d93adbb52d02d4585d519416c4f4b4be62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49065
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1674650782302584"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 27 Jan 2023 21:03:48 GMT

GET
H2 200 1912450958726392398
tpc.googlesyndication.com/simgad/ Frame C517 32 KB
32 KB 45ms
43ms Image
image/jpeg 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1912450958726392398

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fb8866ed3486fe5104bf6fa4cd8ad892e1092fdfba07ef4a63f721b8a438f529

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 15:21:57 GMT
x-content-type-options: nosniff
age: 20511
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32857
x-xss-protection: 0
last-modified: Fri, 05 Aug 2022 16:19:58 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 27 Jan 2024 15:21:57 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame C517 0
0 47ms
45ms Image
text/html 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR6g7T0-No092lePImOr3s1z20r5dyzg_Y7vYBFfzVD-J-rOqAbDX6lq507xTVSeDhxN99qL4zG914JNwLDo9wu5AjvvA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 55ms
53ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 27 Jan 2023 21:03:48 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 9BCC 0
0 57ms
47ms Fetch
image/gif 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstlHF81JmfWVuZtXcRgiLoP-I2GQpzYy-K5JiQ0StMUOgcdZigVKBqFGJLdFFZFvi_oYMeIsO0ECj2fhhoTwc-mkjZo_Y4dS-DAqLkNMKTTkASW23b4kVSsycJpRw0kLHQ6nS7mo10P2boGq3-r5883YUc_EH1ScXgjSU85_-uuIIoJbKCqIpI_xpm25M-ewESrW3Sof2AGePp9406gb5us_r8MdUYGJQffzNenKVP2WN4RlcKkJ21vP2o8BmZRFnj1wnBwDGqtEAVdsXww4UU-5jAhFeUg5H9bEpG8PeyFtyqllCOivLDaTe8GZswGwoycy7hsxk4pn77iJ0gAJ1SI3gk3&sai=AMfl-YT6axha5DypFCv0pmYB3DWN2gJURfWlaML69SA2rU316mD6GVBnVcnZ4kxhq91UFwlRfHxk5MSwBQ4iBj4K7TEMrecc_T_MTHJCNH_qhtDOCmnlEZ4yB5ai5R3L65HPlg&sig=Cg0ArKJSzCLMZEwqyoT1EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET skin.js
cdn.districtm.ca/ Frame 9BCC 0
0

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9BCC 156 KB
48 KB 67ms
57ms Script
text/javascript 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

948dfd7372d70c12a80472d86b4033d93adbb52d02d4585d519416c4f4b4be62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49065
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1674650782302584"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 27 Jan 2023 21:03:48 GMT

GET
DATA 200
OK truncated
/ Frame 56A1 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 07c9f1c8e7ec36c55c237850f07390ab293e9a53fae26b1bdc9b480888dda40c

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame C517 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a8fbccabbbc5d86dd3ef60074da4c240017b4237d94be9887de79fbc268d1959

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 /
www.facebook.com/tr/ 0
15 B 20ms
20ms Image
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=524625568278206&ev=displayedEndOfMeterMessage&dl=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&rl=&if=false&ts=1674853428359&cd[action_source]=website&cd[client_user_agent]=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F109.0.5414.119%20Safari%2F537.36&cd[event_source_url]=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&sw=1600&sh=1200&v=2.9.94&r=stable&a=tmgoogletagmanager&ec=4&o=30&fbp=fb.1.1674853426635.765317382&it=1674853426553&coo=false&rqm=GET

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 27 Jan 2023 21:03:48 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame A1BA 0
0 55ms
49ms Fetch
image/gif 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvvOWJXXmXOstI34hhXuUmCpAKvjkvnkIEh5yqdzgn4xJL0NxETFn2JNilAaflDpeBqM4LHGPO8ohlgQhZ_ZzqhabH-J0u8ZBRjgE2-9rRi8pnSq48uMyhFFop4i-MkzBprKKZIq73vgeXEI5avCl795wTkWwjHqU9SMQ9ngBSVklh-SlF4I7_vSSu0QWCP9ZXAYEY_vVgj5S96HT7miiVNvZLrvJF5FHHrqcLqAbzIuHP-vV3G59CvUbyE3HlyS_M_bfPmBRWnUullGnGg-5QJLt-Y5bIaN3EkWik3ynB442RslBHgKiwj_sjdG7q0L9u82mVDgUWwFd9OF9L9_47V&sai=AMfl-YTnY-uPwLGGcrmsxb0xG1239KAuKcO7MeaMWqR-rhfa1k2aRy5jI1ptFSMITvWDUJU1KhvocgQOR4-ba6VEhpTcrmNorOwdAsAxwJ3CMg_3nP59emEOdYm6eLuts3A6&sig=Cg0ArKJSzOm9Ir-nsLZSEAE&uach_m=[UACH]&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230126/r20110914/client/ Frame A1BA 3 KB
1 KB 26ms
20ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230126/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 20:22:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2449
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 10 Feb 2023 20:22:59 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A1BA 156 KB
48 KB 69ms
61ms Script
text/javascript 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

948dfd7372d70c12a80472d86b4033d93adbb52d02d4585d519416c4f4b4be62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49065
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1674650782302584"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 27 Jan 2023 21:03:48 GMT

GET
H3 200 12765759685933499065
tpc.googlesyndication.com/simgad/ Frame A1BA 85 KB
85 KB 29ms
23ms Image
image/jpeg 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12765759685933499065

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e97d9bac40937105200e03567886a051d7c7d516c331d82712015ed38388dffd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 02:36:17 GMT
x-content-type-options: nosniff
age: 66451
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86565
x-xss-protection: 0
last-modified: Thu, 19 May 2022 21:06:47 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 27 Jan 2024 02:36:17 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame A1BA 0
0 59ms
53ms Image
text/html 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT5mrp0fTxGnvPwOpCzltx0J8wABCLMlKGoMmboCphe_5Uwbzf7_5WW1hBWeQ2PKp6QkXvjEo-WG-iFzgjE7RC_RjXgnw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012501.js?cb=31071905
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame A1BA 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 27231f45a01acd6825233d21061ff6f4bbdde5e00512b04578d29d3a487fd578

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 dc_pre=CPmFjp3T6PwCFYitnwodcaUIdQ;src=10441863;type=traff0;cat=lokno006;ord=495237738078;gtm=2wg1p0;auiddc=*;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-pa...
adservice.google.com/ddm/fls/z/ Frame AFF1 42 B
63 B 51ms
48ms Image
image/gif 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CPmFjp3T6PwCFYitnwodcaUIdQ;src=10441863;type=traff0;cat=lokno006;ord=495237738078;gtm=2wg1p0;auiddc=*;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing

Requested by

Host: 10441863.fls.doubleclick.net
URL: https://10441863.fls.doubleclick.net/activityi;dc_pre=CPmFjp3T6PwCFYitnwodcaUIdQ;src=10441863;type=traff0;cat=lokno006;ord=495237738078;gtm=2wg1p0;auiddc=1441656575.1674853426;~oref=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing?

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://10441863.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK p1.js Show response
p1cluster.cxense.com/ Frame 3E49 46 B
636 B 74ms
23ms Script
text/javascript 145.40.89.32
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://p1cluster.cxense.com/p1.js
Requested by: Host: cdn.cxense.com
URL: https://cdn.cxense.com/sp1.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 145.40.89.32 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: Jetty(9.4.28.v20200408) /
Resource Hash: 0a9e06277e440d8dc43d7b98998abe9de23db023bdd4ba6b8d9145272c06bf62

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cdn.cxense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
last-modified: Wed, 27 Jul 2022 21:03:48 GMT
server: Jetty(9.4.28.v20200408)
etag: 2lzw5tysmjad2s8xl92r9npbj
p3p: policyref="http://www.cxense.com/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: text/javascript;charset=utf-8
cache-control: private, proxy-revalidate
content-length: 46
expires: Sat, 27 Jan 2024 21:03:48 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame AD59 13 KB
5 KB 24ms
20ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.winnipegfreepress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 4062
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 27 Jan 2023 19:56:06 GMT
expires: Sat, 27 Jan 2024 19:56:06 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 767F 783 B
535 B 42ms
40ms Document
text/html 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

923bd5da2db7490a64a3000bad351db74e67f15301db3027404c05ecd5ec86f8

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-JaEehV_7GNx5DQlOMccIVg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.winnipegfreepress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-JaEehV_7GNx5DQlOMccIVg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 27 Jan 2023 21:03:48 GMT
expires: Fri, 27 Jan 2023 21:03:48 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 56A1 0
0 49ms
49ms Fetch
image/gif 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu9HM42tGPzNF3tNdFUqf09PrHRvaO8UmkAM7Z3VWnqRCQzap-ExOYfbeFR-07fR1IP8HyRMTqYKaKDSkdb0jE_cNllzYBYwOa7L4RqeRFbU_Fo-QlgSp4fp0YNH_M6HtPQGPDtCLLfkNLcBJbdoR-TNTgyuQi8wgZCjwjczndn9gdzn_8oVVhXYAA_sCqfI8rgkBSWZDAN-Ei_JoarxSSwkdQht2psdEiMAQdC7Q4vRSU4nnhmHK3GIX8m8JUi5OroRS6jeH-hUoq-1LRpd8O_gF0S4H6A3uGCu88V_g4eROAUjSWb7J3sEIRmxjAYteD90XPEamjMNlo1_3jOiXDVM_w&sai=AMfl-YTv2CQ5B-ulGClz3bdbU8dLWi9cZytwEMjzM26_n3qmjF1yx311QGYPwITAZjgSEB6ljaY5-MHdGrF_NomN-PQvRv3yAJa8DKiGMrt3xRC5Rk9FopfK6GANQikohoY-nA&sig=Cg0ArKJSzHOkUCFks2mCEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 27 Jan 2023 21:03:48 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame C517 0
0 45ms
45ms Fetch
image/gif 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvx9Gsm2UEiKOJLyXvuRDZmMoVJjGt34wTZyOBPpHrowDIZbdFU4sQN-Nu7wjHSsICQ0Q_xNNdHFssmOF6u7XcfXx6nMVFczBmmAABgOgArO7Z6__Fg2keD0lAyFnZ1knvFZ5S-AbnkiLHmozhqbeV74rGmVFBhHbC3JLAbDzXbdU8QCljCzhcjNiSjfyiHXRgkdqTIcNWnCEaavxB2SD-OrSzrjkQvxujs-5Q6w0hsykaWx5cgzZplBh-NkO7jSG8OpEiFrw872FS605PO5jjLMYQFNWl_KGTPK0acIJlMgQQLQ8tteGITH6kdd6D9Cub4BUI5AZowkT8dBh_rD3fxJ88&sai=AMfl-YQgfrXFzbCBEY7i674V1FH8UFmZy9upz_BVz9xus5TZVHujFplhbw0IiSxoHtAxDb67PKJVZwX8bGTU0PFv89cnUIBrHAOXO4pZxFobgpgncC0lQZjsHF8fkGzIqZ3J&sig=Cg0ArKJSzCMl3U8YB_xwEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 27 Jan 2023 21:03:48 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame A1BA 0
0 44ms
44ms Fetch
image/gif 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstKE_b5wM4QJ0TSXRVMi47gwfiQuDP5EKa7Tb17iRwf-mjbIK2OXoYGUhQ4Q9sKenxKchtpwLIpswY1Pb9RFLZV3Q-JiXbgh4j99iLm9N6xDwK4zL9cGVh6F1MrTBk5JvlG7kHU829dF6bT401iXrwB67LWBTc_DUKfgz5kgiuhpLABw-3PaVFy2KW0hP1IjRWZ_TSPTd84fl1O1KbgQCLruVp2k2VvEr6DOQIRLe6t8UBx6c10PSu-rGIbElFawcYvkmgTQDX6iV_aK4tlaQ_EUABtIv2h3VLGIRFeUHRL0atnsJzuV9c4XslWpypJ5cBKuHlE9NNb3MsXt8FpRJLkbAE&sai=AMfl-YTUULcNoIasPp380OLYJMLA3HmDn06PKHH4gviGPWHBiisxJWOfVINBo3uUI9amr9b-jR9IRNXMiwGIUL1oM3zC65Cs-3hSbEzrUpddJuh93rZj7YFrVvdyCAKnzIjY&sig=Cg0ArKJSzDewsxl3TVHLEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 27 Jan 2023 21:03:48 GMT

GET
H/1.1 200
OK rep.gif
comcluster.cxense.com/Repo/ Frame 3E49 43 B
468 B 25ms
25ms Image
image/gif 145.40.89.32
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://comcluster.cxense.com/Repo/rep.gif?ver=2.8.10&typ=pgv&rnd=ldf0hif4bosbl6v9&sid=9222350621649330874&loc=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&new=1&arf=0&ltm=1674853426053&ref=&tzo=0&wsz=1600x1200&res=1600x1200&dpr=1&col=24&bln=en-US&chs=UTF-8&cks=ldf0hk0kayc152hf&ckp=ldf0hif4f9ck4836&glb=&amo=1670373200&cp_userState=anon&cp_visibility=top&cst=2lzw5tysmjad2s8xl92r9npbj
Requested by: Host: cdn.cxense.com
URL: https://cdn.cxense.com/sp1.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 145.40.89.32 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: Jetty(9.4.28.v20200408) /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cdn.cxense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

p3p: policyref="http://www.cxense.com/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
date: Fri, 27 Jan 2023 21:03:48 GMT
server: Jetty(9.4.28.v20200408)
content-length: 43
content-type: image/gif

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 767F 0
0 40ms
40ms Image
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2023012501&jk=641255830815295&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

GET
H/1.1 200
OK id Show response
id.cxense.com/public/user/ 102 B
675 B 79ms
24ms Script
text/javascript 145.40.89.32
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://id.cxense.com/public/user/id?json=%7B%22identities%22%3A%5B%7B%22type%22%3A%22ckp%22%2C%22id%22%3A%22ldf0hif4f9ck4836%22%7D%2C%7B%22type%22%3A%22lst%22%2C%22id%22%3A%222lzw5tysmjad2s8xl92r9npbj%22%7D%2C%7B%22type%22%3A%22cst%22%2C%22id%22%3A%222lzw5tysmjad2s8xl92r9npbj%22%7D%5D%2C%22siteId%22%3A%229222350621649330874%22%2C%22location%22%3A%22https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing%22%7D&callback=cXJsonpCB6

Requested by

Host: cdn.cxense.com
URL: https://cdn.cxense.com/cx.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

145.40.89.32 Ashburn, United States, ASN54825 (PACKET, US),

Reverse DNS

Software

Jetty(9.4.28.v20200408) /

Resource Hash

c2e6871bf9cc27002d5dc3a4392758b604e19e110ff3cc641d3a5dc200c63f07

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:48 GMT
x-content-type-options: nosniff
server: Jetty(9.4.28.v20200408)
content-type: text/javascript;charset=utf-8
p3p: policyref="http://www.cxense.com/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-store, no-cache, must-revalidate
content-length: 102
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 Eaz0IHujFkGwgw1wSqWcFoa2qhkXFFq07gGSCwbjNLA.js Show response
pagead2.googlesyndication.com/bg/ Frame AD59 36 KB
14 KB 20ms
20ms Script
text/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Eaz0IHujFkGwgw1wSqWcFoa2qhkXFFq07gGSCwbjNLA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

11acf4207ba31641b0830d704aa59c1686b6aa1917145ab4ee01920b06e334b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 20:22:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 175302
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14222
x-xss-protection: 0
last-modified: Tue, 24 Jan 2023 13:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jan 2024 20:22:06 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame AD59 0
10 B 20ms
20ms Image
text/plain 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?c76ruQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:817::2001 Nutley, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 21:03:48 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 44ms
44ms Image
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2023012501&jk=641255830815295&bg=!YmGlYSXNAAbFy4Ck5cs7ACkAdvg8WvqsICHWk6wiVTtTnTJlrQTLjmzjaKHXGW_77C-L6Cz34RlmfgIAAACLUgAAAARoAQeZAsLwuFTj75vZypr8KcshuLEtHeQgJYRCN9SKf_Yf9YZEqsj90h_20kz0oJPRrf1Sw7bqTrtqT4S_w-a7rLX7vLnG7v_2yEvWdxRHEde8vUnUxN4tAFpfX3HUOYtBeXIIMtfmx8n93W3Cfk514WTwMpm-CN6WJvf-WbVt_-2sVFEnNrd7VegpWsIE2oFAB8eXYD4xvS1i2Q3CGRuC7bWDfa_8RDJ4QfAOFiDAWFAEcUGdo5dpqW_z9-d8FzcJ1vewt7iqgyGJCJCRvy7kbkzz21aJI3g9efPtlTeInBFLWBs12_Yf9uEZaH5M5Ehf4khsfrRxzK2kF5uMYSKUFXnKYY98TGg0xk5BN95dv6w0JMvlHoY2CrpcEU_5pD5kKJ-MLdyWyt5zB0Pa2mzjs1pK4MIStEiWEKPGwxu_UNqKr6Upq2-m0OdV7F-Qmwtk7B2RUpreImyD7HLJII5ktg1CMX7ywsBCJCVY7yaRsHyEmdAsiWWIclc4bTCPiu--9P5Gha-zkn4IE_W5S8jDR_8nkJMkhz_5UmjMefPD_tgq5I0LscoafQXsLDNLqTWdjWmPWDTueh7j6sGzIbeaZWj3waPLofpVUjUdi5fJMbg0p3Rht6FouX5jGt8dQbut5tsnRmF5a81NLCg7gMh-Db2WsryeTZvHZ7G5J7EOg7NMOi9MnNENpnmJ9jcTQvvXwcAY0hfigM_d_zpnTFKkS3thSxBcG5HAL4LW78BIPQSemfWtt_zmxVKIHCLIQiq4tLYcmrIOt1FayU2aGYVBbJKW_39FhGz-q0KW3MGc-PKtWoRBJG-PNxNQJdHJBIqF4SOV5sIGs7htlua588twT9Re_HrEBofvQVfKpuZWmSs91_9t2R3dfGQnlj-1nbJvU7uzCmHbBNMfNUet6x8jO1SGT6j__IJEJ6HiTIOEaLXnNR-8ofdS
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A1BA 42 B
64 B 41ms
41ms Fetch
image/gif 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu9fcIdHJm0rC2T6kMBkaW8lMLbQUlkaUTl6F26rjl299KKoFY-srhoYpEucWf9ssVnOIkdHatpD7dj2Cp21GRnYfRgOa0-GdXlQUta2cu0hBS-2aqw&sig=Cg0ArKJSzHu362LhRVuFEAE&id=lidar2&mcvt=1000&p=144,316,394,1286&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230125&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=658958671&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1674853428376&rpt=315&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C517 42 B
64 B 41ms
41ms Fetch
image/gif 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsutIzlrj35_ABhF27cO_NhvqGWcFh4qrEXbGOSwYGFho_Oea90Car_Vyia7YVjzEb88Z-hwVHGQTtH7hYyjI3I4E39JlJKzR-hN0IgJyeEr7t9rlnLu&sig=Cg0ArKJSzBPZun9rhIc6EAE&id=lidar2&mcvt=1002&p=458,984,708,1284&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20230125&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=48406450&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1674853428264&rpt=341&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.winnipegfreepress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
45 B 43ms
42ms Ping
text/plain 2001:4860:4802:32::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-770Z3PGDW4&gtm=2oe1p0&_p=2037910435&cid=197573043.1674853427&ul=en-us&sr=1600x1200&uaW=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sid=1674853427&sct=1&seg=0&dl=https%3A%2F%2Fwww.winnipegfreepress.com%2Fbreakingnews%2F2022%2F12%2F06%2Flower-patient-volumes-at-childrens-hospital-likely-calm-before-expected-storm-er-director-says%3Futm_source%3DSalesforce%26utm_medium%3DEmail%26utm_campaign%3DCOVIDBriefing&dt=Lower%20patient%20volumes%20at%20Children%E2%80%99s%20Hospital%20likely%20calm%20before%20expected%20storm%2C%20ER%20director%20says%20%E2%80%93%20Winnipeg%20Free%20Press&_s=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-770Z3PGDW4&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.winnipegfreepress.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 27 Jan 2023 21:03:52 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.winnipegfreepress.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cdn.districtm.ca
URL: https://cdn.districtm.ca/skin.js

Verdicts & Comments Add Verdict or Comment

299 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

30 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.winnipegfreepress.com/breakingnews/2022/12/06	1969-12-31 23:59:59	Name: fingerprint_hash Value: 15df4a113093b93b4ce7bd7af6f22f87
www.winnipegfreepress.com/breakingnews/2022/12/06	1969-12-31 23:59:59	Name: googtrans Value: null
.winnipegfreepress.com/	1970-01-20 18:43:01	Name: _pcid Value: %7B%22browserId%22%3A%22ldf0hif4f9ck4836%22%7D
.winnipegfreepress.com/	1970-01-20 18:43:01	Name: cX_P Value: ldf0hif4f9ck4836
.winnipegfreepress.com/	1970-01-20 11:23:49	Name: _gcl_au Value: 1.1.1441656575.1674853426
.www.winnipegfreepress.com/	1970-01-20 18:50:13	Name: is_from_eu Value: no
.winnipegfreepress.com/	1970-01-20 09:15:39	Name: _gid Value: GA1.2.595358482.1674853427
.winnipegfreepress.com/	1970-01-20 09:14:13	Name: _gat_UA-126530131-1 Value: 1
.winnipegfreepress.com/	1970-01-20 11:23:49	Name: _fbp Value: fb.1.1674853426635.765317382
www.winnipegfreepress.com/	1970-01-20 09:15:39	Name: ln_or Value: eyIzMzAwOTA1IjoiZCJ9
.linkedin.com/	1970-01-20 11:23:49	Name: li_sugr Value: cc2fac43-9f49-4456-95ec-1adb1fbb9057
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 17:59:49	Name: bcookie Value: "v=2&35276961-2eb1-4f69-8771-c8e7659c81d0"
.linkedin.com/	1970-01-20 09:15:39	Name: lidc Value: "b=OGST06:s=O:r=O:a=O:p=O:g=2565:u=1:x=1:i=1674853426:t=1674939826:v=2:sig=AQFGahXbO0LkAnsmwU4KYw8I_rHlQZYw"
.linkedin.com/	1970-01-20 09:57:25	Name: UserMatchHistory Value: AQKVtHK9OI8VlgAAAYX1CyaEFQjZV9-zjouq3fApRkPZDd7Z7mLO1AGPv9X6Kc8ZoqTQ-5NCbSTYIA
.linkedin.com/	1970-01-20 09:57:25	Name: AnalyticsSyncHistory Value: AQJRPyMgSHP2mAAAAYX1CyaEa8q74xp_0K1WN7srKh8XsOqM7az5tnHgFrD_rTR1UYm8Am1VGrpgPOPw5zRfSA
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.www.linkedin.com/	1970-01-20 17:59:49	Name: bscookie Value: "v=1&202301272103465c34fd63-136c-445e-8b5d-fda055e2d874AQH5SUzkB4rxHZdzYJSonpLMoI_bSAFO"
.winnipegfreepress.com/	1970-01-20 09:14:13	Name: _gat_UA-350959-63 Value: 1
account.winnipegfreepress.com/	1970-01-20 09:14:20	Name: fpnewsplatform_session Value: Rqe3z5Gc8th0NeowoFXzxVyGrlUN2fI7aUXW3oHl
.winnipegfreepress.com/	1970-01-20 09:14:13	Name: _gat_gtag_UA_350959_63 Value: 1
.winnipegfreepress.com/	1970-01-20 18:50:13	Name: _ga Value: GA1.1.197573043.1674853427
.winnipegfreepress.com/	1970-01-20 18:43:01	Name: _pctx Value: %7Bu%7DN4IgrgzgpgThIC4B2YA2qA05owMoBcBDfSREQpAeyRCwgEt8oBJAEzIE4AmHgZgFYADADYuARmEAWDr16CAHAHZJIAL5A
.winnipegfreepress.com/	1969-12-31 23:59:59	Name: cX_S Value: ldf0hk0kayc152hf
.winnipegfreepress.com/	1970-01-20 18:50:13	Name: _ga_770Z3PGDW4 Value: GS1.1.1674853427.1.1.1674853428.59.0.0
.doubleclick.net/	1970-01-20 18:50:13	Name: IDE Value: AHWqTUnnyVrF29xN0goWnQrpk090nvUbujxhUe7m6EluQSF649SiqPpmN8LnqZ0awxc
.winnipegfreepress.com/	1970-01-20 18:35:49	Name: __gads Value: ID=4e8d11c7a385c346:T=1674853428:S=ALNI_MYRp9CmO7lCyeEMa_uoJT9uTXPcyQ
.winnipegfreepress.com/	1970-01-20 18:35:49	Name: __gpi Value: UID=0000099412badfd2:T=1674853428:RT=1674853428:S=ALNI_MYlpzBKDobJfayGAFafEKnNc5Xnag
.cxense.com/	1970-01-20 17:59:49	Name: gckp Value: 12t8o5xjd15wv1qvkeudpzlyry
.winnipegfreepress.com/	1970-01-20 18:43:01	Name: cX_G Value: cx%3A15ilswrfvlinc3c3si6vj8hkw9%3Aq204qcyjzkvh

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

06152dbe7ff498f171de46fc2c988bb1.safeframe.googlesyndication.com
10441863.fls.doubleclick.net
account.winnipegfreepress.com
accounts.google.com
adservice.google.ca
adservice.google.com
analytics.google.com
api.cxense.com
cdn.cxense.com
cdn.districtm.ca
cdn.linkedin.oribi.io
click.email.winnipegfreepress.com
comcluster.cxense.com
connect.facebook.net
fonts.googleapis.com
fonts.gstatic.com
id.cxense.com
news.google.com
p1cluster.cxense.com
pagead2.googlesyndication.com
pixel.wp.com
platform.twitter.com
px.ads.linkedin.com
px4.ads.linkedin.com
rw1.marchex.io
scdn.cxense.com
securepubads.g.doubleclick.net
snap.licdn.com
ssl.geoplugin.net
static.xx.fbcdn.net
stats.g.doubleclick.net
stats.wp.com
syndication.twitter.com
tpc.googlesyndication.com
translate.google.com
translate.googleapis.com
winnipeg-free-press-snowplow-collector.localnewslab.io
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googleoptimize.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.linkedin.com
www.winnipegfreepress.com
cdn.districtm.ca
104.244.42.8
13.107.42.14
13.111.168.112
142.250.80.70
145.40.89.32
174.137.122.128
178.237.33.51
192.0.76.3
2001:4860:4802:32::181
205.200.191.140
2600:1400:d:595::268b
2600:141b:13::17d7:8252
2600:9000:21ec:9000:2:53b2:240:93a1
2606:2800:220:de:468:2285:c1:4a3
2607:f8b0:4004:c1b::9b
2607:f8b0:4006:809::2002
2607:f8b0:4006:809::200e
2607:f8b0:4006:80c::200e
2607:f8b0:4006:80f::200a
2607:f8b0:4006:80f::200e
2607:f8b0:4006:817::2001
2607:f8b0:4006:81c::2002
2607:f8b0:4006:81c::2004
2607:f8b0:4006:81c::200a
2607:f8b0:4006:81d::200d
2607:f8b0:4006:820::2003
2607:f8b0:4006:820::2008
2607:f8b0:4006:821::2002
2607:f8b0:4006:822::2003
2607:f8b0:4006:824::2002
2607:f8b0:4006:824::2003
2607:f8b0:4006:824::200e
2620:1ec:21::14
2a03:2880:f012:10c:face:b00c:0:3
2a03:2880:f112:182:face:b00c:0:25de
2a04:fa87:fffd::c000:4221
52.205.39.100
86.109.7.56
0187fed1f15750c2fa9e427912bb64d209aad8b47ee4fa9576f6666b68188d36
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
06639d033d7cf998bac4c166c2040102efc566e743de92c2d7b932dee909e3c7
07c9f1c8e7ec36c55c237850f07390ab293e9a53fae26b1bdc9b480888dda40c
0a9e06277e440d8dc43d7b98998abe9de23db023bdd4ba6b8d9145272c06bf62
0aa6a7045a55ddcb25bbee4d1edcb864081cf59f7fc9bdc1ada22a32ed4ad3ad
0e6809406e07c770b85da35a4faf706f8750b5db94cdc475aa4dfa79033f80eb
11443cdc514a219abae49161635dc8d1dcff6723863702099ae81e3697f9ce3d
11acf4207ba31641b0830d704aa59c1686b6aa1917145ab4ee01920b06e334b0
1218fcd581c61f2eb8e8eebc7e48f4385ccc8ccc6f5f82b3e5ebf49cd363f736
16d2282ccdc7581daaae579c54629a373033afe1cbc1384525566922062b680e
16f6dd146600a27dfd2add863d1d961ec0ff8a7e0d493ba923768a3654e1947e
1936d94a7cc2ffa181c260469cd7fd27c8b96fc9c255ef3e954b1ac445b7a26a
197ba9e1cadc36e22bd62725373b75f14a1b50946ef4e49b226d1134b3a85ff8
1b7aed5738e8fce4e20cc96c3350fecf58573f4346208f1a3a4de6cc82cdc1e7
1d21b5b9239def983562bd5751372e2b2449b03b23653bf8b66f0d47cd5ec80a
20e06326099a0f94387301f38a87174f68f131f6bb1f0224bc121524c6765d0c
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
27231f45a01acd6825233d21061ff6f4bbdde5e00512b04578d29d3a487fd578
2a0af7dab8ad90d175d40b187c661a55a4fde95dd9ec543e3d96704bd21bf793
2f294402fe8d6fe148cffa9ca444ec933eb0e354fc4d8a97202f141cf7fc6f40
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
31f8894ef63c6dea3f1a58ae8fda7e7fb51df78ec054ab134c8a5f966e48501f
340060d270e292d9c066576ab7f4011753de5d735a72b36056c79586b5e351bc
34034863fb912fd50d587fb4439bb883dabecc04c8e5fbbb5978d2e98c6b4ed9
392c9fa9cd1273a2a89d1a83a69cd1f63f21d1d55e7be21e1d8f51f25145668b
3b461509de6adf272cd83823068db4ddbf4622882fe8962b8fd73e473d212828
3f370de109f0ae310d0b3cc8ab1bbfef67fcb50203b4a4aaf18321c51b14ea2b
4002d65e95f94dc87ae8ad170eb8dbc3644921032ac76dcb376537d9304a6fbf
40390a0095bd5cd1fe6e552bd3083de8a79b4df9c5e47ba8e5fbb44c4b9cbea9
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
4841d6bb17662095feb86857d8bb59df81a6af8f7bbda7cce3e4e5bab8d0c68c
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
535be4b8bedf82433d210152dfb19dd4eaf5796c4e61c2be1c2ed356827b5580
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
55b01fdd073fb0f9699d813ca88566575d37c6dc50256577a1d8de0726a516f8
5664fd4ace6b6125bf33de99937dd0398fa35f40fcfd1ce3159f3362d19205b8
58e308d9b970616ecc6e1fecd78c73de072bce5d42b21c97bdf21223fe74188c
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5a861509b658aa24fc3aed2867ac3c061e7d818d90b9990959afc6d1b5d4ff99
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
5b4c012c740d120a384871f05af3184799f6e2b607767a5d6229e2a82aac103b
5e8477f1df102403db7db7ac08208d458e2cb2fc4f6681a83b77b389d3546b66
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
620048ecc181d81dc017c2e09d10c3c5a609c60f9bc7947978bf0e1c3fa8baf5
6493ebe5a8bb3751f00d3c4e48d0c8a8c7dc46be0b79e78d8831f3a2f3f45526
662c8f25d669be9cc623aad275281bebdf8731b6b05bab7ac247fac86a05623f
677e13931343c9c296edbe034e6ce78a815ebfd4de447675838f2b833efb69ca
69df19aa714c324e70896cd5cc834d9dcc1080b58b2e771e86df18ab10b20859
6b0b111ca14c2147a0f0cb51f1317290eb5ec19b4a9bea595a5ad7ffb7d9661a
6bf0fd8a77f97f792a50bab40d986b1c19b286e0329a7d705652fd35064a7fbf
6f368aa8ed1ff20a7f45f67285eb393b6b164a71826955217eaac1aa54c31980
74d22fe95c00677f82c878401c5b0670e17d8ef28221b9522d238ab43bc1a172
7928369a406440002cb4b79ce79e2374bb580a6f189a16db2e400cdfa80e3130
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
806cf603c24bdb0509ffe750c54bdef884190fbc3841ed962d2a39e4a3751774
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
8953492dba77df435e5fbcd568b638fe049279d04fa0403f859d33e72fea74e8
8b82448e5551693ea90c222fc2eb8df69f5cbb2f03e75587d1f206e3b35adc03
8d86c424887cf759c3f4707859f44ccded82148df23defb93d10e7cbe461b886
8ea8791754915a898a3100e63e32978a6d1763be6df8e73a39d3a90d691cdeef
90470325739d0af5dfda30c340794d0b7b36d631c24f64f83a3e7c7519d0eca9
923bd5da2db7490a64a3000bad351db74e67f15301db3027404c05ecd5ec86f8
948dfd7372d70c12a80472d86b4033d93adbb52d02d4585d519416c4f4b4be62
9834b82ad26e2a37583d22676a12dd2eb0fe7c80356a2114d0db1aa8b3899537
9d4f3413fb1730204fc6a30dd953b5dd46ba8f44266a7cf26d8061e3ebb4af5a
9e5147eec2439e9e5dcd6df658a82a4d76b078fcabc9902b35276cbd40886ab9
a1bbd21a4992182e76a30f66098bfb85d7435dda13f39a79ace6215a286474fa
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5103dc30d2fd81858efc150e8b8b4547823a322a2efa2cb49d9fbf330ec3ad0
a7fd41fd349db8949a256323b8d9af1f86fe14bbd84214553ca70cb488a95e7b
a8fbccabbbc5d86dd3ef60074da4c240017b4237d94be9887de79fbc268d1959
a9934b98dff0f90f68a3d07944cd938528ea277225fee38fd63db1db3dae5dd2
a9f23ce14e86d87ad7ef141e4e891d8553a6c51fda3be05b8018719f726e2814
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b2b6a01e4e71b7b21f890d5ee82e0e27d2ce6faba46d79ac190e201aa4dcd04c
b395a9adbc18174a906ebe2c585487fc17c24c5a6976b8f4e1b67cc7cb0ba804
bd26b03aa46ea621788e313bc2d3ed2cdeb9c94095651a393afcb93b2cfa9a50
bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4
c2936776401410192729e2b7d68b6b6f6e824cb6e53df78c87735f255a42b461
c2e6871bf9cc27002d5dc3a4392758b604e19e110ff3cc641d3a5dc200c63f07
c429b056c18833dd3d7fe28ab8ba904526ad1375398ffac0a0e4f2d278e1ac43
c5ce035dca06b1c179cc4ca71de026bb6bf0ce9e13c31a6d1c0141bca2b35b69
c693665e6f6348a3338c00719c4c7dc5f957b6c48f266e3a097d071d1c93c8b2
c913ae5f51f7618953f1657260b3c1c074da6c567b3f794f52d0d147113b7c61
cb3e03878337b209e27f3752ab8b2f0ba3864dd6b6d71d1d6dc5d3a869e7489b
d1bc21a8c525ddf1edc9ef67efe808d3772f3963efe23b88542f37ab5ec37604
d31fd2b62ba0b51cc44964170e2374b0ed22b61fc82ab34d14634cac7dc92056
d4da6245d7658bbd25924859544c251ed40714b2c3e6b2e146065671755e9364
d5e8749c179ffe5c9647f8be0f59bf1cb152fe09bc0c65f929ffcb5900c8fab0
da99004a3dd3736a976dbff7dfe56ebf70076475ba4e60d67506dead66e38ee4
dbc13e868fc37e5decb688b506ac4dea2da1690396694b7289530600e15f0816
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e51c34133d034c6e711296d7f94369af2dbf385978319a0b95fe96cd8d281fa6
e97d9bac40937105200e03567886a051d7c7d516c331d82712015ed38388dffd
ef116c4b154888a36784c143110b264cfe6528a4061c5dcc14e6431ecfbcac56
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef8f067f829af7c95936a36f38e54c98ab090f937f5557e4c78829ed8fcf5ffd
f061539654f2846e056534dcafbe83aeed3bf1fa672b0e7b944d350dd63ba493
f114e062db8d6e28b27679e95a074ca452faeb799cc6c04b4189fd04f5dcbe9f
f22b07ba9ffabd454cbf154f2ea05df38f7c8ffc10261ef111e042a059779a4c
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
f7883efa3124b96e5095cddcc1b8c8cb232e0d0c84b277f657ca0e9ce5acee34
f794ca085ef660ac32c0f77ac6f598c07faec676c8e67b554e5e8eb9e1197eae
fb8866ed3486fe5104bf6fa4cd8ad892e1092fdfba07ef4a63f721b8a438f529

www.winnipegfreepress.com Open in urlscan Pro 2a04:fa87:fffd::c000:4221 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

162 Requests

99 %HTTPS

71 %IPv6

24 Domains

47 Subdomains

38 IPs

4 Countries

2842 kBTransfer

8210 kBSize

30 Cookies

40 Outgoing links

Page URL History

Redirected requests

162 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.winnipegfreepress.com Open in urlscan Pro
2a04:fa87:fffd::c000:4221 Public Scan

Screenshot
Live screenshot

Full Image

162
Requests

99 %
HTTPS

71 %
IPv6

24
Domains

47
Subdomains

38
IPs

4
Countries

2842 kB
Transfer

8210 kB
Size

30
Cookies

162 HTTP transactions
5 data transactions