secure.winred.com Open in urlscan Pro
2606:4700::6813:d459 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://a-delivery.rmbl.ws/c?tid=56bc5941-6c11-422a-bc0d-e1be6c200c71&t=11&fb=aHR0cHM6Ly9zZWN1cmUud2lucmVkLmNvbS9zYXZlLWFtZ...
Effective URL:
https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b...
Submission: On January 18 via manual (January 18th 2024, 7:40:19 am UTC) from US — Scanned from CA

Summary HTTP 174 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 31 IPs in 3 countries across 21 domains to perform 174 HTTP transactions. The main IP is 2606:4700::6813:d459, located in United States and belongs to CLOUDFLARENET, US. The main domain is secure.winred.com. The Cisco Umbrella rank of the primary domain is 134965.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on February 21st 2023. Valid for: a year.

This is the only time secure.winred.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	172.98.56.41 172.98.56.41	399647 (RUMBLE) (RUMBLE)
1 11	2606:4700::68... 2606:4700::6813:d459	13335 (CLOUDFLAR...) (CLOUDFLARENET)
43	13.35.93.43 13.35.93.43	16509 (AMAZON-02) (AMAZON-02)
4	2607:f8b0:400... 2607:f8b0:4004:c09::5f	15169 (GOOGLE) (GOOGLE)
3	2600:9000:26f... 2600:9000:26fa:c00:0:7d26:ee00:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:303... 2606:4700:3037::ac43:8758	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2607:f8b0:400... 2607:f8b0:4004:c08::61	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:3865	13335 (CLOUDFLAR...) (CLOUDFLARENET)
33	54.187.119.242 54.187.119.242	16509 (AMAZON-02) (AMAZON-02)
4	2607:f8b0:400... 2607:f8b0:4004:c08::5c	15169 (GOOGLE) (GOOGLE)
1 2	142.251.16.149 142.251.16.149	15169 (GOOGLE) (GOOGLE)
5	2607:f8b0:400... 2607:f8b0:4004:c06::71	15169 (GOOGLE) (GOOGLE)
1	146.75.28.157 146.75.28.157	54113 (FASTLY) (FASTLY)
2	2a03:2880:f00... 2a03:2880:f003:c0e:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	38.70.189.71 38.70.189.71	399647 (RUMBLE) (RUMBLE)
2	151.101.64.176 151.101.64.176	54113 (FASTLY) (FASTLY)
2	2606:4700::68... 2606:4700::6810:fa45	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2607:f8b0:400... 2607:f8b0:4004:c08::9a	15169 (GOOGLE) (GOOGLE)
2	198.137.150.201 198.137.150.201	16509 (AMAZON-02) (AMAZON-02)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
1	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
4	2607:f8b0:400... 2607:f8b0:4004:c09::5e	15169 (GOOGLE) (GOOGLE)
4	2607:f8b0:400... 2607:f8b0:4004:c09::9a	15169 (GOOGLE) (GOOGLE)
4	2607:f8b0:400... 2607:f8b0:4004:c07::93	15169 (GOOGLE) (GOOGLE)
7	2607:f8b0:400... 2607:f8b0:4004:c08::5e	15169 (GOOGLE) (GOOGLE)
3	2001:4860:480... 2001:4860:4802:32::181	15169 (GOOGLE) (GOOGLE)
3	34.211.13.104 34.211.13.104	16509 (AMAZON-02) (AMAZON-02)
1	2a03:2880:f10... 2a03:2880:f103:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3	2600:9000:21d... 2600:9000:21da:3600:b:1d09:f200:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4004:c17::9d	15169 (GOOGLE) (GOOGLE)
12	2607:f8b0:400... 2607:f8b0:4004:c09::8a	15169 (GOOGLE) (GOOGLE)
6	104.19.219.90 104.19.219.90	13335 (CLOUDFLAR...) (CLOUDFLARENET)
174	31

1 172.98.56.41 (Canada) 1 redirects

ASN399647 (RUMBLE, CA)

a-delivery.rmbl.ws	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700::6813:d459 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

secure.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

43 13.35.93.43 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-93-43.jfk50.r.cloudfront.net

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c09::5f (Ashburn, United States)

ASN15169 (GOOGLE, US)

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:26fa:c00:0:7d26:ee00:93a1 (United States)

ASN16509 (AMAZON-02, US)

d35ligi1n5bgzc.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3037::ac43:8758 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.nucleusfiles.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:4004:c08::61 (Ashburn, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:3865 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 54.187.119.242 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ip-54-187-119-242.stripe.com

q.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c08::5c (Ashburn, United States)

ASN15169 (GOOGLE, US)

pay.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.16.149 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: bl-in-f149.1e100.net

9381094.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4004:c06::71 (Washington, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.28.157 (Ashburn, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f003:c0e:face:b00c:0:3 (Ashburn, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 38.70.189.71 (Toronto, Canada)

ASN399647 (RUMBLE, CA)

a.ads.rmbl.ws	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.64.176 (United States)

ASN54113 (FASTLY, US)

m.stripe.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:fa45 (United States)

ASN13335 (CLOUDFLARENET, US)

gtm.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4004:c08::9a (Ashburn, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 198.137.150.201 (United States)

ASN16509 (AMAZON-02, US)

merchant-ui-api.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c09::5e (Ashburn, United States)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c09::9a (Ashburn, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c07::93 (Washington, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2607:f8b0:4004:c08::5e (Ashburn, United States)

ASN15169 (GOOGLE, US)

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4860:4802:32::181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.211.13.104 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-211-13-104.us-west-2.compute.amazonaws.com

m.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f103:83:face:b00c:0:25de (Ashburn, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:21da:3600:b:1d09:f200:93a1 (United States)

ASN16509 (AMAZON-02, US)

b.stripecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c17::9d (Washington, United States)

ASN15169 (GOOGLE, US)

adservice.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2607:f8b0:4004:c09::8a (Ashburn, United States)

ASN15169 (GOOGLE, US)

play.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.19.219.90 (None, )

ASN13335 (CLOUDFLARENET, US)

hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
newassets.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api2.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
81	stripe.com js.stripe.com — Cisco Umbrella Rank: 1227 q.stripe.com — Cisco Umbrella Rank: 7010 merchant-ui-api.stripe.com — Cisco Umbrella Rank: 5083 r.stripe.com — Cisco Umbrella Rank: 3369 m.stripe.com — Cisco Umbrella Rank: 1188	2 MB
24	google.com pay.google.com — Cisco Umbrella Rank: 2630 www.google.com — Cisco Umbrella Rank: 2 analytics.google.com — Cisco Umbrella Rank: 154 adservice.google.com — Cisco Umbrella Rank: 98 play.google.com — Cisco Umbrella Rank: 31	425 KB
13	winred.com 1 redirects secure.winred.com — Cisco Umbrella Rank: 134965 app.winred.com — Cisco Umbrella Rank: 205414 gtm.winred.com — Cisco Umbrella Rank: 179407	212 KB
8	google.ca www.google.ca — Cisco Umbrella Rank: 9185 adservice.google.ca — Cisco Umbrella Rank: 20318	2 KB
8	doubleclick.net 1 redirects 9381094.fls.doubleclick.net — Cisco Umbrella Rank: 626954 googleads.g.doubleclick.net — Cisco Umbrella Rank: 38 stats.g.doubleclick.net — Cisco Umbrella Rank: 79	5 KB
6	hcaptcha.com hcaptcha.com — Cisco Umbrella Rank: 5797 newassets.hcaptcha.com — Cisco Umbrella Rank: 7041 api2.hcaptcha.com — Cisco Umbrella Rank: 14986 api.hcaptcha.com — Cisco Umbrella Rank: 7252	408 KB
6	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 37	556 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	21 KB
4	gstatic.com www.gstatic.com	102 KB
4	googleapis.com maps.googleapis.com — Cisco Umbrella Rank: 362	181 KB
3	stripecdn.com b.stripecdn.com — Cisco Umbrella Rank: 12411	43 KB
3	cloudfront.net d35ligi1n5bgzc.cloudfront.net	627 KB
2	stripe.network m.stripe.network — Cisco Umbrella Rank: 1315	16 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 174	93 KB
2	rmbl.ws 1 redirects a-delivery.rmbl.ws — Cisco Umbrella Rank: 53489 a.ads.rmbl.ws — Cisco Umbrella Rank: 181018	2 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	185 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 789	726 B
1	t.co t.co — Cisco Umbrella Rank: 656	377 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 745	15 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 811	7 KB
1	nucleusfiles.com cdn.nucleusfiles.com — Cisco Umbrella Rank: 122797	4 KB
174	21

	Domain	Requested by
43	js.stripe.com	secure.winred.com js.stripe.com
17	q.stripe.com	secure.winred.com
16	r.stripe.com	js.stripe.com
12	play.google.com	www.gstatic.com
10	secure.winred.com	1 redirects secure.winred.com static.cloudflareinsights.com
7	www.google.ca	secure.winred.com
6	www.googletagmanager.com	secure.winred.com www.googletagmanager.com www.google-analytics.com
5	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com secure.winred.com
4	www.google.com	secure.winred.com
4	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
4	www.gstatic.com	pay.google.com www.gstatic.com
4	pay.google.com	js.stripe.com pay.google.com secure.winred.com www.gstatic.com
4	maps.googleapis.com	secure.winred.com maps.googleapis.com
3	newassets.hcaptcha.com	hcaptcha.com newassets.hcaptcha.com
3	b.stripecdn.com	js.stripe.com b.stripecdn.com
3	m.stripe.com	m.stripe.network
3	analytics.google.com	www.googletagmanager.com
3	d35ligi1n5bgzc.cloudfront.net	secure.winred.com
2	merchant-ui-api.stripe.com	js.stripe.com
2	googleads.g.doubleclick.net	www.googletagmanager.com
2	gtm.winred.com	www.googletagmanager.com
2	m.stripe.network	js.stripe.com m.stripe.network
2	connect.facebook.net	secure.winred.com connect.facebook.net
2	9381094.fls.doubleclick.net	1 redirects www.googletagmanager.com
1	api.hcaptcha.com	newassets.hcaptcha.com
1	api2.hcaptcha.com	newassets.hcaptcha.com
1	hcaptcha.com	b.stripecdn.com
1	adservice.google.ca	adservice.google.com
1	www.facebook.com	secure.winred.com
1	adservice.google.com	9381094.fls.doubleclick.net
1	analytics.twitter.com	secure.winred.com
1	t.co	secure.winred.com
1	a.ads.rmbl.ws	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	app.winred.com	secure.winred.com
1	static.cloudflareinsights.com	secure.winred.com
1	cdn.nucleusfiles.com	secure.winred.com
1	a-delivery.rmbl.ws	1 redirects
174	38

This site contains links to these domains. Also see Links.

Domain
txtterms.co
winred.com
www.donaldjtrump.com
cdn.donaldjtrump.com
donaldjtrump.com

Subject Issuer	Validity	Valid
secure.winred.com Cloudflare Inc ECC CA-3	`2023-02-21` - `2024-02-21`	a year	crt.sh
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA	`2024-01-02` - `2024-04-04`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
nucleusfiles.com GTS CA 1P5	`2023-11-29` - `2024-02-27`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-10` - `2024-04-09`	a year	crt.sh
*.stripe.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-12-20` - `2024-03-21`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-10-27` - `2024-01-25`	3 months	crt.sh
a.ads.rmbl.ws R3	`2023-12-16` - `2024-03-15`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-04` - `2025-01-02`	a year	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-07` - `2024-11-05`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
*.google.ca GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
m.stripe.com DigiCert TLS RSA SHA256 2020 CA1	`2023-12-22` - `2024-03-21`	3 months	crt.sh

This page contains 18 frames:

Primary Page: https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth
Frame ID: F2ABE3A89CD0E649A0E1D1B6B7C53C66
Requests: 60 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html
Frame ID: 8729F6619893996A2D2EF6647B0DA020
Requests: 4 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-f0f547bcbe2357cfda0bfc327460e63d.html
Frame ID: 4457BC08BF8D88C13CB10B045A772434
Requests: 15 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-card-c2e208bab766f024106c5ddb80e13838.html
Frame ID: 2EA3A27C2B3CF5A125004154054D128A
Requests: 12 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-f0f547bcbe2357cfda0bfc327460e63d.html
Frame ID: DC879F71D45A8D7EE05C09BF7F68A434
Requests: 14 HTTP requests in this frame

Frame: https://js.stripe.com/v3/payment-request-inner-google-pay-ff0fe8103f298d1aef02a6b58d602ec0.html
Frame ID: 60A3276DB1642D2A2E115B01EF9EEC1F
Requests: 6 HTTP requests in this frame

Frame: https://js.stripe.com/v3/payment-request-inner-browser-d431684c374277aa98cc24ad55065359.html
Frame ID: D466C1982F1CD62AB52FA371D60CCC7C
Requests: 5 HTTP requests in this frame

Frame: https://secure.winred.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/c8377512/main.js
Frame ID: 46A57F142512BBB0E18885DDD70D817E
Requests: 2 HTTP requests in this frame

Frame: https://9381094.fls.doubleclick.net/activityi;dc_pre=CPjLvMi35oMDFZMiTwgd9z0Lsw;src=9381094;type=pagev0;cat=djt_p0;ord=7348262461396;auiddc=1012720694.1705563608;gtm=45He41a0v72350723;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth
Frame ID: 4C3938C3415DD16C294B03F18D475DE3
Requests: 1 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: 77FDFA327C617DBCF6543384B4759BE8
Requests: 6 HTTP requests in this frame

Frame: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=
Frame ID: F8BB92423C6767784F26B0F0EB643E8E
Requests: 13 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CPjLvMi35oMDFZMiTwgd9z0Lsw;src=9381094;type=pagev0;cat=djt_p0;ord=7348262461396;auiddc=1012720694.1705563608;gtm=45He41a0v72350723;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth
Frame ID: AF7CA110A373DD0DDAE303D24B07D299
Requests: 1 HTTP requests in this frame

Frame: https://js.stripe.com/v3/hcaptcha-invisible-1d4f51566d1cd027565953e076bcc868.html
Frame ID: 055198E62FA2B36A13AA6793FEBC1CD4
Requests: 3 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-link-button-for-card-46e08b0617e3ea8e195ab83eeec06ee7.html
Frame ID: 85407B7065BFC6A8090FEB8F42DB0AC7
Requests: 6 HTTP requests in this frame

Frame: https://b.stripecdn.com/stripethirdparty-srv/assets/v20.6/HCaptchaInvisible.html?id=3a43367c-c866-4544-afec-5870b0ffcea8&origin=https%3A%2F%2Fjs.stripe.com
Frame ID: 3949F3955C51A6767F69302E1695D657
Requests: 5 HTTP requests in this frame

Frame: https://adservice.google.ca/ddm/fls/i/dc_pre=CPjLvMi35oMDFZMiTwgd9z0Lsw;src=9381094;type=pagev0;cat=djt_p0;ord=7348262461396;auiddc=1012720694.1705563608;gtm=45He41a0v72350723;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth
Frame ID: 37E5B9B2B4EFD1933D1226626A884E60
Requests: 1 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-payment-request-9873cb4068dc5095000e64458624ac3f.html
Frame ID: 7FD9485DF533FABC14E8196C4C1DEB1A
Requests: 9 HTTP requests in this frame

Frame: https://newassets.hcaptcha.com/captcha/v1/2a00369/static/hcaptcha.html?_v=lqlnua4kcjd
Frame ID: 278F774AA4044DC33A3B6D20D9BED7A1
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Trump 2024

Page URL History Show full URLs

https://a-delivery.rmbl.ws/c?tid=56bc5941-6c11-422a-bc0d-e1be6c200c71&t=11&fb=aHR0cHM6Ly9zZWN1cmUud2luc... HTTP 302
https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e... Page URL

Detected technologies

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

Google Pay (Payment processors) Expand

Overall confidence: 100%
Detected patterns

pay\.google\.com/([a-z/]+)/pay\.js

Stripe (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.stripe\.com

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

hCaptcha (Security) Expand

Overall confidence: 100%
Detected patterns

https://hcaptcha.com/([\d]+?)/api.js

Page Statistics

174
Requests

99 %
HTTPS

63 %
IPv6

21
Domains

38
Subdomains

31
IPs

3
Countries

4440 kB
Transfer

14634 kB
Size

32
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://txtterms.co/88022-2/
Title: txtterms.co/88022

Search URL Search Domain Scan URL

URL: https://winred.com/terms/donor-terms/
Title: terms of use

Search URL Search Domain Scan URL

URL: https://winred.com/privacy
Title: privacy policy

Search URL Search Domain Scan URL

URL: https://www.donaldjtrump.com/join
Title: Interested in volunteering? Click here to sign up today.

Search URL Search Domain Scan URL

URL: https://cdn.donaldjtrump.com/djtweb24/general/TSA_JFC_Contributor_Form_230217.pdf
Title: Want to donate by mail? Click here to print out a donation form that you can send to our address.

Search URL Search Domain Scan URL

URL: https://www.donaldjtrump.com/2024-mar-a-lago-reception-contest
Title: here

Search URL Search Domain Scan URL

URL: http://donaldjtrump.com/
Title: donaldjtrump.com

Search URL Search Domain Scan URL

URL: https://winred.com/
Title: Powered by

Search URL Search Domain Scan URL

URL: https://winred.com/about-our-ads/
Title: About Our Ads

Search URL Search Domain Scan URL

URL: https://winred.com/support/
Title: Questions about your charge? Go to our Support Center

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://a-delivery.rmbl.ws/c?tid=56bc5941-6c11-422a-bc0d-e1be6c200c71&t=11&fb=aHR0cHM6Ly9zZWN1cmUud2lucmVkLmNvbS9zYXZlLWFtZXJpY2Etam9pbnQtZnVuZHJhaXNpbmctY29tbWl0dGVlL21hcmFsYWdvdHJ1dGgxMjE5MjMvP3V0bV9tZWRpdW09YWQmdXRtX3NvdXJjZT1jaV9kX3RydXRoJnV0bV9jb250ZW50PXN0MTg4&_s=ZfQEHSVq+i0EoL6gCeD2qg== HTTP 302
https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 21

https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://secure.winred.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/c8377512/main.js

Request Chain 49

https://9381094.fls.doubleclick.net/activityi;src=9381094;type=pagev0;cat=djt_p0;ord=7348262461396;auiddc=1012720694.1705563608;gtm=45He41a0v72350723;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth HTTP 302
https://9381094.fls.doubleclick.net/activityi;dc_pre=CPjLvMi35oMDFZMiTwgd9z0Lsw;src=9381094;type=pagev0;cat=djt_p0;ord=7348262461396;auiddc=1012720694.1705563608;gtm=45He41a0v72350723;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth

174 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/
Redirect Chain

https://a-delivery.rmbl.ws/c?tid=56bc5941-6c11-422a-bc0d-e1be6c200c71&t=11&fb=aHR0cHM6Ly9zZWN1cmUud2lucmVkLmNvbS9zYXZlLWFtZXJpY2Etam9pbnQtZnVuZHJhaXNpbmctY29tbWl0dGVlL21hcmFsYWdvdHJ1dGgxMjE5MjMvP3V...
https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth

59 KB
15 KB

612ms
247ms

Document
text/html

2606:4700::6813:d459
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

decb67735d60421da8f1a0d1e91f7eadcf501ebb8d8058992ad2c85bb2dd7f36

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, private, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 8475301d398336a0-YYZ
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 07:40:06 GMT
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-rack-cors: miss; no-origin
x-request-id: e8b07f2b-cddb-4d49-8a61-41203727c62b
x-revv-cache: Hit from Revv
x-runtime: 0.060771
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Thu, 18 Jan 2024 07:40:06 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
location: https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth
server: nginx

GET
H2 200 / Show response
js.stripe.com/v3/ 585 KB
144 KB 382ms
98ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

ab5896c4f28152942b089d685fefcb1ab59c91c345b73a44da1d416119124ab9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:39:59 GMT
content-encoding: br
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 12
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Thu, 18 Jan 2024 05:59:09 GMT
server: Cloudfront
etag: W/"7186d200916e5464e2e931eb575481e8"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
timing-allow-origin: *
x-amz-cf-id: rVR4bWcVPmHH-jxbfsikCRbHtn24DuswoGFUjmfZCu-KowwKWXEO0Q==

GET
H2 200 landing_page-b5085350195c50801834c19cd56b1cabc8b9ea2b81e3a74f8486f6b3e2ae2898.css
secure.winred.com/assets/ 219 KB
34 KB 114ms
112ms Stylesheet
text/css 2606:4700::6813:d459
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/landing_page-b5085350195c50801834c19cd56b1cabc8b9ea2b81e3a74f8486f6b3e2ae2898.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

961951e588ed2cbd0dadda321becf5c4d27451bb0896262f86e7d922da5794ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:06 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
x-amz-version-id: 4RBMbG_c3G5laVKEwPaykYWu8oOdV56f
cf-cache-status: HIT
x-amz-request-id: 0Z26WMQFTGHEKTED
age: 2205
cf-polished: origSize=227667
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-amz-id-2: r0/UTxL8qZyTC6ZcIO5LMh1VKAf9Q31snLmODVo95huGeLn104T3cy2lJGe3kvBvr+ph76puqDI=
cf-bgj: minify
last-modified: Tue, 28 Nov 2023 01:42:36 GMT
server: cloudflare
etag: W/"57df3b6cebff9962c43c29347b45123f"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 8475301ecaa236a0-YYZ
expires: Thu, 18 Jan 2024 11:40:06 GMT

GET
H2 200 1703015676.css
secure.winred.com/stylesheets/rv_page_01hj1t86ranzbapgz1mt2b04zb/ 8 KB
2 KB 252ms
250ms Stylesheet
text/css 2606:4700::6813:d459
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/stylesheets/rv_page_01hj1t86ranzbapgz1mt2b04zb/1703015676.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e3de16d530f4634a1ad26ed8151bbea4d2c48c3b5e942d711caa37668060099

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-rack-cors: miss; no-origin
date: Thu, 18 Jan 2024 07:40:06 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 7b95a492-3f19-4234-b873-2ab04c22d893
x-runtime: 0.038287
last-modified: Thu, 18 Jan 2024 07:40:06 GMT
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
cache-control: public, max-age=31556952
cf-ray: 8475301edaa536a0-YYZ
expires: Fri, 17 Jan 2025 13:29:18 GMT

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 211 KB
71 KB 564ms
170ms Script
text/javascript 2607:f8b0:4004:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5f Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

706a130e25def3f112db1bf34d2ff316d5c1336e196842d19382532afc568e94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 71976
x-xss-protection: 0

GET
H2 200 application-landing-page-7ea440a608ae6761bd5abd3174137469ab09ceae7c9b01ceba0ceddb65802b52.js Show response
secure.winred.com/assets/ 486 KB
136 KB 168ms
167ms Script
application/javascript 2606:4700::6813:d459
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/application-landing-page-7ea440a608ae6761bd5abd3174137469ab09ceae7c9b01ceba0ceddb65802b52.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bf15413499b81555136c08dd340efaf4b00a8eb7ac1067d558e70bf6fbbfb07f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:06 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
x-amz-version-id: dbzxATFmqrrik1B4lI2.BR2h86hlZo0z
cf-cache-status: HIT
x-amz-request-id: G0GPEXXFV144ZHXX
age: 2205
cf-polished: origSize=497469
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-amz-id-2: t/s249WK2qPEm5EXmbShnQ9zshbcnQfD2R2IbMGJFq9dld7pV7IHaEE/MtUAOpj3hFZgJg/+s8o=
cf-bgj: minify
last-modified: Tue, 28 Nov 2023 01:42:31 GMT
server: cloudflare
etag: W/"c9a1d576fe79597fb8399634c6208524"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 8475301edaa636a0-YYZ
expires: Thu, 18 Jan 2024 11:40:06 GMT

GET
H2 200 DJT_-_New_MAL_Contest_Graphic_banner.jpeg
d35ligi1n5bgzc.cloudfront.net/logos/logo_assets/000/807/569/large/ 405 KB
406 KB 526ms
135ms Image
image/jpeg 2600:9000:26fa:c00:0:7d26:ee00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/logos/logo_assets/000/807/569/large/DJT_-_New_MAL_Contest_Graphic_banner.jpeg
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26fa:c00:0:7d26:ee00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5632bd20dacf65fbd2510d0c97c4312a163ed00a7654d7111655752a05b426a6

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 04:54:39 GMT
x-amz-version-id: 73lApkVi6hOkt_1LJ.0ljUfHHn1450Yu
via: 1.1 9072caf3ec2d91f3dd159b88ae86e822.cloudfront.net (CloudFront)
last-modified: Sun, 17 Dec 2023 20:57:05 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P1
age: 9929
etag: "c99398221303cefca5d18cdca1cf8763"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 415163
x-amz-cf-id: wnJWBDSzvnO16bXQmmWtKKLe5fLOAg_OhhDCYAgK6_9tVA6yJdhQuw==

GET
H2 200 djt_sig.png
cdn.nucleusfiles.com/65/6589c163-dee5-46aa-8505-b6e3d2f2d8e2/ 3 KB
4 KB 563ms
159ms Image
image/png 2606:4700:3037::ac43:8758
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.nucleusfiles.com/65/6589c163-dee5-46aa-8505-b6e3d2f2d8e2/djt_sig.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:8758 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a90492ff833ba2c9260fb83307882241e32afa818d4cc865a90b0442050dd92a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:07 GMT
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: GP07R2DJ21N446Q2
x-amz-meta-file_id: 26120
alt-svc: h3=":443"; ma=86400
content-length: 3280
x-amz-id-2: 3+eHT8IaHY8IUpW6/tEI+wly612GgU0CoSuw0dszMD+M4ow4FKiYyqooJK+AKuihOMQkn2vSxqg=
last-modified: Mon, 12 Jun 2023 20:10:36 GMT
server: cloudflare
etag: "fe7a79489ab482710d22931f6d2580c8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wka1hfyfCgxYAI5YEAOb6YzNOPceSCh%2BLiN8A%2FhcXqiStaOoicU9V2GGz53Y0SqDcsJ4xLqocoqU8v9yppvloPcKE2eE4GKKO9v6wfE2jUPttHFU8BtuoIjSG5kQOHq%2FyLzkppJ1w3%2BYyXiqxytCMsakwQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 847530215fb936d5-YYZ

GET
H2 200 potus_headshot.png
d35ligi1n5bgzc.cloudfront.net/profiles/images/000/068/512/square/ 22 KB
22 KB 208ms
205ms Image
image/png 2600:9000:26fa:c00:0:7d26:ee00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/profiles/images/000/068/512/square/potus_headshot.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26fa:c00:0:7d26:ee00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4ec0827f796bdadb833f52dd7ea841e12158d9f488554ecb73479cc2ea6f6d8e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-amz-version-id: 6HYtNhcBxi6F_uJ2AY87Rc_xOq3TeHoz
date: Thu, 18 Jan 2024 02:09:14 GMT
via: 1.1 9072caf3ec2d91f3dd159b88ae86e822.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P1
age: 19854
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 22449
last-modified: Sat, 17 Jul 2021 20:11:51 GMT
server: AmazonS3
etag: "e595f679c10699fedef3c779e864cdd9"
vary: Accept-Encoding
content-type: image/png
accept-ranges: bytes
x-amz-cf-id: qqzORtqtjm51vLCYPMLdN3zD4Lm4PIL5LaYYDoResPPo1889T3SkGQ==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 448 KB
100 KB 666ms
271ms Script
application/javascript 2607:f8b0:4004:c08::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::61 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cd6490f733f584b4e012708c33830a3ad79c2efac2e310af491cd38b74ffbd26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 102313
x-xss-protection: 0
last-modified: Thu, 18 Jan 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Jan 2024 07:40:07 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 305 KB
102 KB 549ms
155ms Script
application/javascript 2607:f8b0:4004:c08::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::61 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ad1ba8a0bf7fd330eaea3ed9824a33f41a1104812188f3bcff5b388b66537799

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 104411
x-xss-protection: 0
last-modified: Thu, 18 Jan 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Jan 2024 07:40:07 GMT

GET
H3 200 win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.png
secure.winred.com/assets/ 9 KB
9 KB 202ms
200ms Image
image/webp 2606:4700::6813:d459
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36f0bf882a876b13aeb20cf7a495421a43f336da5422072a58f58ce303fb6284

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:07 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
x-amz-version-id: DDMKcAncJdvrdjtlB83KVVtmSTuzy8eN
cf-cache-status: REVALIDATED
x-amz-request-id: T7YY8HSEZ7196RWR
cf-polished: origFmt=png, origSize=11635
content-disposition: inline; filename="win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.webp"
alt-svc: h3=":443"; ma=86400
content-length: 8708
x-amz-id-2: snhR/TTO0VFpx/pWe4+Z0yP5t/IX6vQEdZS4Z7CgCmASMSE9kF66zRDzLO/4KXnhkMnyJ4N+Pi8=
cf-bgj: imgq:85,h2pri
last-modified: Tue, 28 Nov 2023 01:42:37 GMT
server: cloudflare
etag: "972c0cca8d1e490484e89513f902e847"
vary: Accept
content-type: image/webp
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 847530225ca036fd-YYZ
expires: Thu, 18 Jan 2024 11:40:07 GMT

GET
H3 200 win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg
secure.winred.com/assets/ 19 KB
8 KB 182ms
181ms Image
image/svg+xml 2606:4700::6813:d459
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:07 GMT
x-amz-version-id: f1JFLNaL.a2v3vTaKefRH3mKI0iL1aS2
x-content-type-options: nosniff
strict-transport-security: max-age=0; includeSubDomains
cf-cache-status: REVALIDATED
x-amz-request-id: DR221M7BV09V5M4K
content-security-policy-report-only: script-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=hWWCRSv0E7JT7Igz7v.86RqSTHxQZJehk59hS_19mYI-1705563607-1-AeWtAbLVFKNoxMu2AtSPZqqjghZYlwEbARl3xH-FL5DVZ8DjaXEZdYPhI-Eo8HLcy6-OOm9aK4A4U5kdMMVUNM_dS2kBuiLrVxI7bMb9DOy_C_3qQgc4iCIA70knadat9WXm2HnxNgDezJKwiKhrVwg3--F81A6b04C4P__o8YmB; report-to cf-csp-endpoint
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-amz-id-2: o3mwkPmqaNRV7lmkKby0loB41Op/Qye+l92VE5ENqVVaInfkxBejRsvNGOTW7eq4u/uhUH6RRT8=
last-modified: Tue, 28 Nov 2023 01:42:37 GMT
server: cloudflare
etag: W/"d31530d4186af669daf4f47099614593"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=hWWCRSv0E7JT7Igz7v.86RqSTHxQZJehk59hS_19mYI-1705563607-1-AeWtAbLVFKNoxMu2AtSPZqqjghZYlwEbARl3xH-FL5DVZ8DjaXEZdYPhI-Eo8HLcy6-OOm9aK4A4U5kdMMVUNM_dS2kBuiLrVxI7bMb9DOy_C_3qQgc4iCIA70knadat9WXm2HnxNgDezJKwiKhrVwg3--F81A6b04C4P__o8YmB"}],"group":"cf-csp-endpoint","max_age":86400}
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 847530225ca236fd-YYZ
expires: Thu, 18 Jan 2024 11:40:07 GMT

GET
H2 200 v84a3a4012de94ce1a686ba8c167c359c1696973893317 Show response
static.cloudflareinsights.com/beacon.min.js/ 20 KB
7 KB 489ms
129ms Script
text/javascript 2606:4700::6810:3865
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:3865 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

Request headers

Referer: https://secure.winred.com/
Origin: https://secure.winred.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:07 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 21:38:13 GMT
server: cloudflare
etag: W/"2023.10.0"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 847530249e8c36b0-YYZ

GET
H2 200 20210604_save-america_winred-backgrounds_winred-desktop_v2.jpg
d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/092/966/large/ 197 KB
198 KB 207ms
207ms Image
image/jpeg 2600:9000:26fa:c00:0:7d26:ee00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/092/966/large/20210604_save-america_winred-backgrounds_winred-desktop_v2.jpg
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/stylesheets/rv_page_01hj1t86ranzbapgz1mt2b04zb/1703015676.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26fa:c00:0:7d26:ee00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 81a6832550bd52d1c44e1e63c2d9137a441dd53d31302c3070000403d032b012

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-amz-version-id: NXb6H3gY_kurDwSBNPY4Z260kpd_Eays
date: Thu, 18 Jan 2024 00:17:14 GMT
via: 1.1 9072caf3ec2d91f3dd159b88ae86e822.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P1
age: 26574
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 202127
last-modified: Sun, 18 Jul 2021 21:49:32 GMT
server: AmazonS3
etag: "4652598428898ad578aa5424f8463865"
vary: Accept-Encoding
content-type: image/jpeg
accept-ranges: bytes
x-amz-cf-id: QP4pyi9C2DQgvsmCUoI86b5enRkl7fLF3GfBOoj1RTQ5KNBmS76B-A==

GET
H2 200 m-outer-3437aaddcdf6922d623e172c2d6f9278.html Show response
js.stripe.com/v3/ Frame 8729 200 B
1 KB 88ms
87ms Document
text/html 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

35dcc382eb69d00369d708708cdc545f3968b68fa5bbe3e728d11fedd04f93bb

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 2314
cache-control: max-age=31536000
content-length: 200
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 07:01:35 GMT
etag: "3437aaddcdf6922d623e172c2d6f9278"
last-modified: Thu, 04 Jan 2024 21:10:00 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
x-amz-cf-id: l12NaLSXsySzm62Qv6b0z5Hs6-BogBMLzYIfqePTgpTCRaKUKGubeQ==
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 controller-f0f547bcbe2357cfda0bfc327460e63d.html Show response
js.stripe.com/v3/ Frame 4457 325 B
1 KB 108ms
107ms Document
text/html 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/controller-f0f547bcbe2357cfda0bfc327460e63d.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

4ea3ccf90fbeb832933a644e78bbcab350b1e7d7601be53af4626242aee8ef73

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 10
cache-control: max-age=60
content-length: 325
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 07:40:07 GMT
etag: "f0f547bcbe2357cfda0bfc327460e63d"
last-modified: Thu, 18 Jan 2024 05:24:17 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
x-amz-cf-id: cMIEi41nbYQWXDxsbMjTEYoKyDZ1Yt5Mxr99Rq3NOxZQNYNTEFS4qw==
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 elements-inner-card-c2e208bab766f024106c5ddb80e13838.html Show response
js.stripe.com/v3/ Frame 2EA3 798 B
2 KB 105ms
105ms Document
text/html 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-card-c2e208bab766f024106c5ddb80e13838.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

9cb95be59a1f120f8246937993d18e8f52ac97673a7f2eab174f7b89d657415d

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 26
cache-control: max-age=31536000
content-length: 798
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 07:40:07 GMT
etag: "c2e208bab766f024106c5ddb80e13838"
last-modified: Thu, 18 Jan 2024 05:24:17 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
x-amz-cf-id: xPG9KWrGIy5gqS-kuSMb6DaR26KRQ7rMAOFpUDKJgUnd5gA_VpY-8Q==
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 current_with_info Show response
app.winred.com/api/v3/users/ 162 B
1 KB 525ms
182ms XHR
application/vnd.api+json 2606:4700::6813:d459
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.winred.com/api/v3/users/current_with_info?organization_token=rv_org_6KNvU36Z2qWJ2gfUBWqGZGoc&redirect=https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-7ea440a608ae6761bd5abd3174137469ab09ceae7c9b01ceba0ceddb65802b52.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d2720171709824c6e0a9f8756ab5ecc53c8427980a68255a51daa59c401512ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-rack-cors-original-access-control-allow-origin: https://secure.winred.com
x-rack-cors: hit
date: Thu, 18 Jan 2024 07:40:08 GMT
x-rack-cors-original-access-control-max-age: 0
x-rack-cors-original-access-control-allow-credentials: true
strict-transport-security: max-age=0; includeSubDomains
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
content-encoding: br
x-rack-cors-original-access-control-allow-methods: GET, POST, OPTIONS
x-rack-cors-original-access-control-expose-headers
alt-svc: h3=":443"; ma=86400
x-request-id: f14587f7-4672-4a03-b789-38b44e49a36d
x-runtime: 0.009405
server: cloudflare
etag: W/"d2720171709824c6e0a9f8756ab5ecc5"
access-control-max-age: 0
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/vnd.api+json
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
vary: Origin
cf-ray: 84753027fed05443-YYZ

GET
H2 200 controller-f0f547bcbe2357cfda0bfc327460e63d.html Show response
js.stripe.com/v3/ Frame DC87 325 B
1 KB 93ms
92ms Document
text/html 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/controller-f0f547bcbe2357cfda0bfc327460e63d.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

4ea3ccf90fbeb832933a644e78bbcab350b1e7d7601be53af4626242aee8ef73

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 10
cache-control: max-age=60
content-length: 325
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 07:40:07 GMT
etag: "f0f547bcbe2357cfda0bfc327460e63d"
last-modified: Thu, 18 Jan 2024 05:24:17 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
x-amz-cf-id: WtSM-lIVs2ykon8WYuHppPxdzH6A2x-ImzjtqzxwI_2LWmHbzdIaww==
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 payment-request-inner-google-pay-ff0fe8103f298d1aef02a6b58d602ec0.html Show response
js.stripe.com/v3/ Frame 60A3 408 B
1 KB 89ms
89ms Document
text/html 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/payment-request-inner-google-pay-ff0fe8103f298d1aef02a6b58d602ec0.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

ad4c6f0dd9bd0f97380702191b82e786d3eb9f552f2650c15d73e390d3557403

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'none'; form-action 'none'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; script-src 'self' https://pay.google.com; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 1641
cache-control: max-age=31536000
content-length: 408
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'none'; form-action 'none'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; script-src 'self' https://pay.google.com; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'none'; form-action 'none'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; script-src 'self' https://pay.google.com; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 07:40:07 GMT
etag: "ff0fe8103f298d1aef02a6b58d602ec0"
last-modified: Thu, 18 Jan 2024 05:24:33 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
x-amz-cf-id: AYi3E-HX7BvS4H3zaknG7v1KDCeOHKRGSJTVKkz69KGPPcF4lZ1ZBw==
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 payment-request-inner-browser-d431684c374277aa98cc24ad55065359.html Show response
js.stripe.com/v3/ Frame D466 344 B
2 KB 109ms
109ms Document
text/html 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/payment-request-inner-browser-d431684c374277aa98cc24ad55065359.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

6abd8c4f912b4d2c7eeda9cc264ee88a8295593cffa9a10d4892415c8085b6e8

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 30
cache-control: max-age=60
content-length: 344
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 07:40:08 GMT
etag: "d431684c374277aa98cc24ad55065359"
last-modified: Thu, 18 Jan 2024 05:24:33 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
x-amz-cf-id: _Px46Kd17ZC9KZss4FPMzn5jJL5uMiU9FNJdD8grVs90fA2qb2EAeA==
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H3

200

main.js Show response
secure.winred.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/c8377512/ Frame 46A5
Redirect Chain

https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://secure.winred.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/c8377512/main.js

7 KB
3 KB

98ms
97ms

Script
application/javascript

2606:4700::6813:d459
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/c8377512/main.js

Requested by

Protocol

Server

2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

82ac8af55974ba6e08e9c87df6570ee2eed15b1225514a72c32ebe561a51a6bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:08 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
vary: accept-encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 84753026bf7236fd-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Thu, 18 Jan 2024 07:40:08 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
vary: accept-encoding
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/c8377512/main.js
access-control-allow-origin: *
cache-control: max-age=300, public
cf-ray: 847530261f1636fd-YYZ
alt-svc: h3=":443"; ma=86400

GET
H2 200 m-outer-15a2b40a058ddff1cffdb63779fe3de1.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 8729 526 B
1 KB 161ms
160ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/m-outer-15a2b40a058ddff1cffdb63779fe3de1.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

ba2338aa6670580269c762f51c4291daef913201aa8f4d4fd166c1a878262652

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 06:56:24 GMT
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 2626
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
content-length: 526
last-modified: Mon, 08 Jan 2024 21:41:57 GMT
server: Cloudfront
etag: "d96c709017743c0759cf3853d1806ba5"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 2kOW6FyxPNdpqY2DBLUSHMaMothpE4VwKemtzYoWZBMdNE65QUmR5g==

POST
H2 200 csp-report
q.stripe.com/ Frame 8729 0
717 B 523ms
160ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jan 2024 07:40:08 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563608445033
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: blue
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1705563608444560
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 8729 0
716 B 525ms
162ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jan 2024 07:40:08 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563608445310
x-envoy-upstream-service-time: 2
content-length: 0
x-stripe-bg-intended-route-color: blue
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 1
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1705563608444800
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

GET
H2 200 shared-6dd1441cf37f4a0448e75338cca8c002.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 4457 533 KB
117 KB 138ms
137ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-f0f547bcbe2357cfda0bfc327460e63d.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

207f8c2a000504f9d1bf6b7021ea01252684ad378ac34a6b905e03e1fcd94a4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-f0f547bcbe2357cfda0bfc327460e63d.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:26:52 GMT
content-encoding: br
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 822
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Thu, 18 Jan 2024 05:24:32 GMT
server: Cloudfront
etag: W/"faf6ca6e9d17a91adace5b6a322c6484"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: zXDoWvCXkQ65I1TEQrz3XXRlmZyQ4YJsdrYU1reiSx9DARiFItWLbQ==

GET
H2 200 controller-ec4a2f867581d0ba73872fc286ae7e37.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 4457 689 KB
159 KB 175ms
174ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/controller-ec4a2f867581d0ba73872fc286ae7e37.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-f0f547bcbe2357cfda0bfc327460e63d.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

134abba498d6db213aa8db194004f1be5b17ce68bbed4f51ffbd63bcb637dbe2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-f0f547bcbe2357cfda0bfc327460e63d.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:26:52 GMT
content-encoding: br
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 822
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Thu, 18 Jan 2024 05:24:30 GMT
server: Cloudfront
etag: W/"a777dcfc6a4dc3d04a21cecebf266f27"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: PbT2Mz9uPFpZrxKuKN4lS7e_Y0lbf5LS_9SbTS23WLK3_Jgo3dJCPA==

POST
H2 200 csp-report
q.stripe.com/ Frame 4457 0
716 B 492ms
161ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jan 2024 07:40:08 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563608445117
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: blue
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1705563608444810
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

GET
H2 200 shared-6dd1441cf37f4a0448e75338cca8c002.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 2EA3 533 KB
117 KB 191ms
189ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-c2e208bab766f024106c5ddb80e13838.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

207f8c2a000504f9d1bf6b7021ea01252684ad378ac34a6b905e03e1fcd94a4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-c2e208bab766f024106c5ddb80e13838.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:26:52 GMT
content-encoding: br
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 822
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Thu, 18 Jan 2024 05:24:32 GMT
server: Cloudfront
etag: W/"faf6ca6e9d17a91adace5b6a322c6484"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: n0DbDA_Ntke6WoEK3W98UM6R7y71v0fghyDgDCDZEHCJRxnTwmVZ0A==

GET
H2 200 ui-shared-5e70bb60bbe35da7bfb390bf6f668194.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 2EA3 405 KB
103 KB 208ms
207ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/ui-shared-5e70bb60bbe35da7bfb390bf6f668194.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-c2e208bab766f024106c5ddb80e13838.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

a3ba43aa269ba38b1b1053f8835d26ac13e5d648d75179b5edff178837abd8f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-c2e208bab766f024106c5ddb80e13838.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:31:20 GMT
content-encoding: br
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 591
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Thu, 18 Jan 2024 05:24:33 GMT
server: Cloudfront
etag: W/"c5e33e67d528594a232161ccfd925d2e"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: 4PLVoggrieBNdH2CiT3hO7LHj-VOrq1tXtNGE9iM6Mr9TUnYVk8CGg==

GET
H2 200 elements-inner-card-bca2af1c075f408256967d302110c6ad.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 2EA3 53 KB
13 KB 213ms
213ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-card-bca2af1c075f408256967d302110c6ad.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-c2e208bab766f024106c5ddb80e13838.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

3cef5d81369ac39c8da814762cdcf2fb00d65bb98baa70776223ddd289c6c014

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-c2e208bab766f024106c5ddb80e13838.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:21:48 GMT
content-encoding: br
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 1151
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Thu, 18 Jan 2024 03:15:56 GMT
server: Cloudfront
etag: W/"afa7d5792867908f67b7272e8fd0803c"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: 0a_G7jXjDLUQ_LRx5YGrG_Q-HaWic8sC1Ol51KLOeCpcNh5Ktfgg7w==

GET
H2 200 ui-shared-1d27f4e2b314637ba4bb9d7ff79c23c7.css
js.stripe.com/v3/fingerprinted/css/ Frame 2EA3 20 KB
4 KB 206ms
205ms Stylesheet
text/css 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/ui-shared-1d27f4e2b314637ba4bb9d7ff79c23c7.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-c2e208bab766f024106c5ddb80e13838.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

394724ca0118829643c12fb5a033cb66680e51327ba157677d18dec209278a3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-c2e208bab766f024106c5ddb80e13838.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 06:48:07 GMT
content-encoding: gzip
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 3127
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Thu, 04 Jan 2024 21:09:46 GMT
server: Cloudfront
etag: W/"b361d7109e9925ca18e32c9da528520f"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: 9dgi8gJKLEN-94l-AUPgWNduXC3RSWomu5VtIZHroKWhPlptHgbRvQ==

GET
H2 200 elements-inner-card-b79a095030fa6973133c91d98bd626d2.css
js.stripe.com/v3/fingerprinted/css/ Frame 2EA3 14 KB
2 KB 187ms
187ms Stylesheet
text/css 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/elements-inner-card-b79a095030fa6973133c91d98bd626d2.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-c2e208bab766f024106c5ddb80e13838.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

1bb8affc0ad0f6449490148a0ec45435d64f1494b92ad385f266b9b86d7aa076

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-c2e208bab766f024106c5ddb80e13838.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:09:41 GMT
content-encoding: gzip
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 1833
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Thu, 04 Jan 2024 21:09:46 GMT
server: Cloudfront
etag: W/"81af9199f83c2489a35a5a81327a87b6"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: xNvrrJaaUnMyLfzu7HkuJ8UsAXY6ZMf1EfaK3TkgQrXTewQ8GyVRqA==

POST
H2 200 csp-report
q.stripe.com/ Frame 2EA3 0
716 B 491ms
166ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jan 2024 07:40:08 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563608447820
x-envoy-upstream-service-time: 2
content-length: 0
x-stripe-bg-intended-route-color: blue
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 1
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1705563608447492
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 2EA3 0
716 B 486ms
161ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jan 2024 07:40:08 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563608445169
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: blue
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1705563608444846
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

GET
H2 200 shared-6dd1441cf37f4a0448e75338cca8c002.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame DC87 533 KB
117 KB 207ms
207ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-f0f547bcbe2357cfda0bfc327460e63d.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

207f8c2a000504f9d1bf6b7021ea01252684ad378ac34a6b905e03e1fcd94a4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-f0f547bcbe2357cfda0bfc327460e63d.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:26:52 GMT
content-encoding: br
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 822
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Thu, 18 Jan 2024 05:24:32 GMT
server: Cloudfront
etag: W/"faf6ca6e9d17a91adace5b6a322c6484"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: eiyQD7gBmexUgxk9l5W6bOzM_1Ac7_MWjICjU7tpp5ees8MIgAkW2g==

GET
H2 200 controller-ec4a2f867581d0ba73872fc286ae7e37.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame DC87 689 KB
159 KB 194ms
194ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/controller-ec4a2f867581d0ba73872fc286ae7e37.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-f0f547bcbe2357cfda0bfc327460e63d.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

134abba498d6db213aa8db194004f1be5b17ce68bbed4f51ffbd63bcb637dbe2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-f0f547bcbe2357cfda0bfc327460e63d.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:26:52 GMT
content-encoding: br
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 822
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Thu, 18 Jan 2024 05:24:30 GMT
server: Cloudfront
etag: W/"a777dcfc6a4dc3d04a21cecebf266f27"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: hs-_ujgrZ_tBh_zQ7DGiv5RqHyw4M62VF0nEhIf4cRikxG__-XuxXw==

GET
H2 200 pay.js Show response
pay.google.com/gp/p/js/ Frame 60A3 119 KB
36 KB 522ms
141ms Script
application/javascript 2607:f8b0:4004:c08::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/js/pay.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-ff0fe8103f298d1aef02a6b58d602ec0.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5c Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b13ac5db06aaef364bbea670ddcd08f23abd89018ced6134df333c0b35251afc

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-EgOdGloRRGJw-5r4Bgd8iw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:08 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-EgOdGloRRGJw-5r4Bgd8iw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=600
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Thu, 18 Jan 2024 07:40:08 GMT

GET
H2 200 shared-6dd1441cf37f4a0448e75338cca8c002.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 60A3 533 KB
117 KB 214ms
214ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-ff0fe8103f298d1aef02a6b58d602ec0.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

207f8c2a000504f9d1bf6b7021ea01252684ad378ac34a6b905e03e1fcd94a4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-google-pay-ff0fe8103f298d1aef02a6b58d602ec0.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:26:52 GMT
content-encoding: br
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 822
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Thu, 18 Jan 2024 05:24:32 GMT
server: Cloudfront
etag: W/"faf6ca6e9d17a91adace5b6a322c6484"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: RcdWeuRT4F3N4X4Yey_LlNag0-vQ_3U0D9jbpjbKoPdCuVjOlv1zeA==

GET
H2 200 payment-request-inner-google-pay-d432dd3294f1501fc61a2463928f5b86.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 60A3 12 KB
5 KB 88ms
88ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/payment-request-inner-google-pay-d432dd3294f1501fc61a2463928f5b86.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-ff0fe8103f298d1aef02a6b58d602ec0.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

42fa6c755c6427833572147096b10125f7dd9f965e0bbc45763625e08f80f016

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-google-pay-ff0fe8103f298d1aef02a6b58d602ec0.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 06:40:16 GMT
content-encoding: br
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 3597
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Mon, 08 Jan 2024 21:41:57 GMT
server: Cloudfront
etag: W/"a535e80a392a5f530d16d7eeee51483d"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: IhCcCU4kFDvWw-Wf3LBC1aqiuBhYMKPC5iRd6CugDbTza6M65P4z1A==

POST
H2 200 csp-report
q.stripe.com/ Frame DC87 0
716 B 468ms
166ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jan 2024 07:40:08 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563608448637
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: blue
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1705563608448128
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 60A3 0
716 B 465ms
165ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jan 2024 07:40:08 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563608448563
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: blue
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1705563608448111
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 60A3 0
716 B 492ms
192ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jan 2024 07:40:08 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563608448954
x-envoy-upstream-service-time: 2
content-length: 0
x-stripe-bg-intended-route-color: blue
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 1
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1705563608448058
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 537ms
122ms XHR
application/json 2607:f8b0:4004:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::5f Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H2 200 shared-6dd1441cf37f4a0448e75338cca8c002.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame D466 533 KB
117 KB 191ms
189ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-browser-d431684c374277aa98cc24ad55065359.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

207f8c2a000504f9d1bf6b7021ea01252684ad378ac34a6b905e03e1fcd94a4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-browser-d431684c374277aa98cc24ad55065359.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:26:52 GMT
content-encoding: br
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 822
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Thu, 18 Jan 2024 05:24:32 GMT
server: Cloudfront
etag: W/"faf6ca6e9d17a91adace5b6a322c6484"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: _QT_51Te8Ny_0syBU8KZUR3pPc-bP9nyQngQ-3YQdXVAUnvbe1tRFA==

GET
H2 200 payment-request-inner-browser-cfd09fde482546e2c8879bce0010f91c.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame D466 13 KB
6 KB 194ms
193ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/payment-request-inner-browser-cfd09fde482546e2c8879bce0010f91c.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-browser-d431684c374277aa98cc24ad55065359.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

1df19255b4b07c13647377049a5d3d4b23519c012b91e923ee22cf18c4e8d2b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-browser-d431684c374277aa98cc24ad55065359.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:11:28 GMT
content-encoding: gzip
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 1720
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Tue, 16 Jan 2024 21:04:38 GMT
server: Cloudfront
etag: W/"9d64070358354c97251ee8d4e282ba7b"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: eB_GTwWQY9eYTk7Ied2GvvhAQ3cOpqYVsMuErNp8IAIx1CRwNujWaA==

POST
H2 200 csp-report
q.stripe.com/ Frame D466 0
716 B 433ms
164ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jan 2024 07:40:08 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563608448288
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: blue
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1705563608447540
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame D466 0
716 B 432ms
163ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jan 2024 07:40:08 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563608447885
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: blue
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1705563608447532
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 303 KB
101 KB 133ms
132ms Script
application/javascript 2607:f8b0:4004:c08::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-0YWKLMCX4D&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::61 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4478451f5d1bee368021a4e0473c1ba6bdc1818449dd0f0e14600ecb4482431e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:08 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 102892
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 18 Jan 2024 07:40:08 GMT

GET
H2

200

activityi;dc_pre=CPjLvMi35oMDFZMiTwgd9z0Lsw;src=9381094;type=pagev0;cat=djt_p0;ord=7348262461396;auiddc=1012720694.1705563608;gtm=45He41a0v72350723;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=... Show response
9381094.fls.doubleclick.net/ Frame 4C39
Redirect Chain

https://9381094.fls.doubleclick.net/activityi;src=9381094;type=pagev0;cat=djt_p0;ord=7348262461396;auiddc=1012720694.1705563608;gtm=45He41a0v72350723;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;ua...
https://9381094.fls.doubleclick.net/activityi;dc_pre=CPjLvMi35oMDFZMiTwgd9z0Lsw;src=9381094;type=pagev0;cat=djt_p0;ord=7348262461396;auiddc=1012720694.1705563608;gtm=45He41a0v72350723;gcd=11l1l1l1l...

748 B
606 B

142ms
141ms

Document
text/html

142.251.16.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9381094.fls.doubleclick.net/activityi;dc_pre=CPjLvMi35oMDFZMiTwgd9z0Lsw;src=9381094;type=pagev0;cat=djt_p0;ord=7348262461396;auiddc=1012720694.1705563608;gtm=45He41a0v72350723;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f149.1e100.net

Software

cafe /

Resource Hash

f4d2decc94ce07732aad41b68bf98f9baa81591bb7584f75d6ec20831440b2ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 430
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 18 Jan 2024 07:40:09 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 18 Jan 2024 07:40:09 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://9381094.fls.doubleclick.net/activityi;dc_pre=CPjLvMi35oMDFZMiTwgd9z0Lsw;src=9381094;type=pagev0;cat=djt_p0;ord=7348262461396;auiddc=1012720694.1705563608;gtm=45He41a0v72350723;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 964ms
128ms Script
text/javascript 2607:f8b0:4004:c06::71
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::71 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 18 Jan 2024 07:02:18 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 2271
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 18 Jan 2024 09:02:18 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 970ms
137ms Script
application/javascript 146.75.28.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.28.157 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:09 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 15:55:14 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kiad7000155-IAD

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 212 KB
57 KB 957ms
131ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0c9cc88c27618b01e95063377382195b9062bdbef5eb1687e5881d3f318dbe63

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 18 Jan 2024 07:40:09 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 56915
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: FISxlsUBU2kSEDfovZCxD4yoa9JoLUaYc7wW7ADGeeNvkcQiK5fnhrPYDCgRFSrsq5KFW1RdocYeAN7GB+nKbw==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
x-fb-optimizer: 0
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 ratag Show response
a.ads.rmbl.ws/ 3 KB
2 KB 993ms
168ms Script
application/javascript 38.70.189.71
RUMBLE

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ads.rmbl.ws/ratag?id=AV-6622
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.70.189.71 Toronto, Canada, ASN399647 (RUMBLE, CA),
Reverse DNS
Software: nginx /
Resource Hash: 6037734d0ad3dd7b2f31955aeeb4b34e2316f726e1bd884d7dbc979649570049

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:09 GMT
content-encoding: gzip
server: nginx
etag: W/"788ed2f782eb45b57dff78c742214a69"
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=900
access-control-allow-credentials: true

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 261 KB
88 KB 129ms
129ms Script
application/javascript 2607:f8b0:4004:c08::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::61 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9f17a2750b4df3a97edb460c44c84ac73606e96aa2d96e5cdc18505ff8a526b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:08 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 90308
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 18 Jan 2024 07:40:08 GMT

GET
H2 200 inner.html Show response
m.stripe.network/ Frame 77FD 930 B
1 KB 911ms
140ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/inner.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-15a2b40a058ddff1cffdb63779fe3de1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 50
cache-control: max-age=300, public
content-encoding: br
content-length: 540
content-security-policy: base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 07:40:08 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: Accept-Encoding, Origin
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 10
x-content-type-options: nosniff
x-request-id: e8b87d58-3bd2-4b7b-9cba-a885fded36cf
x-served-by: cache-yyz4578-YYZ
x-timer: S1705563609.999639,VS0,VE0

POST
H3 200 8475301d398336a0 Show response
secure.winred.com/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 46A5 0
341 B 117ms
106ms XHR
text/plain 2606:4700::6813:d459
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/challenge-platform/h/b/jsd/r/8475301d398336a0

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 18 Jan 2024 07:40:08 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
content-type: text/plain; charset=UTF-8
cf-ray: 8475302848a336fd-YYZ
alt-svc: h3=":443"; ma=86400

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 4457 474 B
865 B 370ms
103ms Fetch
application/json 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.stripe.com/v3/.deploy_status_henson.json
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.93.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-93-43.jfk50.r.cloudfront.net
Software: Cloudfront /
Resource Hash: f0aed7241eba2494db2bb05093be566589b0a9a6dcd5846446db8f078d556356

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/controller-f0f547bcbe2357cfda0bfc327460e63d.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 18 Jan 2024 07:39:40 GMT
via: 1.1 2da1a465458d2c4bd692e693d75f0780.cloudfront.net (CloudFront)
last-modified: Thu, 18 Jan 2024 05:59:09 GMT
server: Cloudfront
age: 32
x-amz-cf-pop: JFK50-P8
etag: "cae7b1f731ebdbac50cef4b3b72b0b4e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
content-length: 474
x-amz-cf-id: wFoiN9Q28QG4Kf8Iya3HVFENSWlYeox3K6nmLZXUUoaRfwJ-o7sVzw==

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 4457 474 B
865 B 359ms
104ms Fetch
application/json 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.stripe.com/v3/.deploy_status_henson.json
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.93.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-93-43.jfk50.r.cloudfront.net
Software: Cloudfront /
Resource Hash: f0aed7241eba2494db2bb05093be566589b0a9a6dcd5846446db8f078d556356

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/controller-f0f547bcbe2357cfda0bfc327460e63d.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 18 Jan 2024 07:39:40 GMT
via: 1.1 2da1a465458d2c4bd692e693d75f0780.cloudfront.net (CloudFront)
last-modified: Thu, 18 Jan 2024 05:59:09 GMT
server: Cloudfront
age: 32
x-amz-cf-pop: JFK50-P8
etag: "cae7b1f731ebdbac50cef4b3b72b0b4e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
content-length: 474
x-amz-cf-id: 6dnmBlfvaWS0kFUwKv29XwdcXJ_qTZ548x7NjkqOvj1Upzq82uW1dA==

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 2EA3 474 B
864 B 338ms
155ms Fetch
application/json 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.stripe.com/v3/.deploy_status_henson.json
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.93.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-93-43.jfk50.r.cloudfront.net
Software: Cloudfront /
Resource Hash: f0aed7241eba2494db2bb05093be566589b0a9a6dcd5846446db8f078d556356

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-card-c2e208bab766f024106c5ddb80e13838.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 18 Jan 2024 07:39:40 GMT
via: 1.1 2da1a465458d2c4bd692e693d75f0780.cloudfront.net (CloudFront)
last-modified: Thu, 18 Jan 2024 05:59:09 GMT
server: Cloudfront
age: 32
x-amz-cf-pop: JFK50-P8
etag: "cae7b1f731ebdbac50cef4b3b72b0b4e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
content-length: 474
x-amz-cf-id: RkPOrCe1C54iDBC_b9EiZIa72r4UYVRGZskGFIjdzSGaxT3kygf_0Q==

GET
H2 200 countryRanges-9ffc15b92962ca316164b9a5ff4c1917.json Show response
js.stripe.com/v3/fingerprinted/data/ Frame 2EA3 145 KB
37 KB 292ms
136ms Fetch
application/json 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/data/countryRanges-9ffc15b92962ca316164b9a5ff4c1917.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

007b4be1404b0f21a158fa83a2ae9375393b2d932a17e9745aa392fcadc7cf2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-card-c2e208bab766f024106c5ddb80e13838.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 18 Jan 2024 06:57:15 GMT
content-encoding: br
via: 1.1 2da1a465458d2c4bd692e693d75f0780.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 2573
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Fri, 12 Jan 2024 21:06:28 GMT
server: Cloudfront
etag: W/"9ffc15b92962ca316164b9a5ff4c1917"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: 0meodmIRBuGdWHwMu2YiGoMeXRl8l59A572bqSaDM-5lCHGdvG559Q==

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame DC87 474 B
864 B 239ms
104ms Fetch
application/json 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.stripe.com/v3/.deploy_status_henson.json
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.93.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-93-43.jfk50.r.cloudfront.net
Software: Cloudfront /
Resource Hash: f0aed7241eba2494db2bb05093be566589b0a9a6dcd5846446db8f078d556356

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/controller-f0f547bcbe2357cfda0bfc327460e63d.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 18 Jan 2024 07:39:40 GMT
via: 1.1 2da1a465458d2c4bd692e693d75f0780.cloudfront.net (CloudFront)
last-modified: Thu, 18 Jan 2024 05:59:09 GMT
server: Cloudfront
age: 32
x-amz-cf-pop: JFK50-P8
etag: "cae7b1f731ebdbac50cef4b3b72b0b4e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
content-length: 474
x-amz-cf-id: 3X8Y5_tgVKcUmrlGnONAd9EQh7pK2uQT7U3uRXzUR6mBn-ADhmOkVw==

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame DC87 474 B
864 B 235ms
105ms Fetch
application/json 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.stripe.com/v3/.deploy_status_henson.json
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.93.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-93-43.jfk50.r.cloudfront.net
Software: Cloudfront /
Resource Hash: f0aed7241eba2494db2bb05093be566589b0a9a6dcd5846446db8f078d556356

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/controller-f0f547bcbe2357cfda0bfc327460e63d.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 18 Jan 2024 07:39:40 GMT
via: 1.1 2da1a465458d2c4bd692e693d75f0780.cloudfront.net (CloudFront)
last-modified: Thu, 18 Jan 2024 05:59:09 GMT
server: Cloudfront
age: 32
x-amz-cf-pop: JFK50-P8
etag: "cae7b1f731ebdbac50cef4b3b72b0b4e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
content-length: 474
x-amz-cf-id: W4tBuIbrdgOd_NCMebXArZaOp5fi3Gye24JXtx53-SNhDLwPvpis7w==

GET
H2 200 collect Show response
gtm.winred.com/g/ 722 B
971 B 719ms
300ms XHR
text/plain 2606:4700::6810:fa45
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je41a0v867905447z872410129&_p=1705563606829&gcd=11l1l1l1l1&dma=0&cid=1232550333.1705563609&ul=en-us&sr=1600x1200&_fplc=0&ur=CA-ON&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sst.uc=CA&sst.gse=1&sst.etld=google.ca&sst.gcd=11l1l1l1l1&sst.tft=1705563606829&_s=1&sid=1705563608&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth&dt=Trump%202024&en=page_view&_fv=1&_nsi=1&_ss=1&ep.pagepath=%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F&ep.pagehostname=secure.winred.com&ep.parsedurl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923&epn.load_time_sec=-1705563605.7&epn.event_fire_time=1705563608161&ep.event_uuid=0a2fa2d7-0dfc-4a42-9599-76bbd9b3283f&ep.isVideoPage=f&ep.referrer=&tfd=2849&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:fa45 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b2c9879acadc56c88c28bd34bcb37273b87a0f3724d61385d596c5cef7e9f822

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:09 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 8475302c4df0a1fc-YYZ
alt-svc: h3=":443"; ma=86400

POST
H2 204 collect
www.google-analytics.com/g/ 0
172 B 567ms
182ms Ping
text/plain 2607:f8b0:4004:c06::71
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-0YWKLMCX4D&gtm=45je41a0v9102512289z872350723&_p=1705563606829&gcd=11l1l1l1l1&dma=0&cid=1232550333.1705563609&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1705563608&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth&dt=Trump%202024&en=page_view&_fv=1&_ss=1&ep.cookieDomain=auto&tfd=2883
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-0YWKLMCX4D&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c06::71 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:09 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11091438865/ 3 KB
2 KB 559ms
148ms Script
text/javascript 2607:f8b0:4004:c08::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11091438865/?random=1705563608583&cv=11&fst=1705563608583&bg=ffffff&guid=ON&async=1&gtm=45je41a0v9102512289z872350723&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth&hn=www.googleadservices.com&frm=0&tiba=Trump%202024&auid=1012720694.1705563608&uamb=0&uaw=0&data=event%3Dgtag.config%3BcookieDomain%3Dauto&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-0YWKLMCX4D&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

06f2b08df8287c36897c409e0776bc5cc13d0e78fb5d6f927cf1c54069ceae02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1398
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 wallet-config Show response
merchant-ui-api.stripe.com/elements/ Frame DC87 2 KB
3 KB 605ms
249ms Fetch
application/json 198.137.150.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://merchant-ui-api.stripe.com/elements/wallet-config

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

198.137.150.201 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

46ec86e0d317a4ca8f66eae2f92e3477c7c5d1e77bceaa714e8722280a8ca051

Security Headers

Name	Value
Content-Security-Policy	report-uri https://q.stripe.com/csp-report?p=elements%2Fwallet-config; block-all-mixed-content; default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 18 Jan 2024 07:40:09 GMT
content-security-policy: report-uri https://q.stripe.com/csp-report?p=elements%2Fwallet-config; block-all-mixed-content; default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'
strict-transport-security: max-age=63072000; includeSubDomains; preload
cross-origin-resource-policy: same-site
content-length: 2457
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
access-control-max-age: 300
access-control-allow-methods: GET, POST
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://js.stripe.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin
access-control-allow-headers: x-stripe-csrf-token
cross-origin-opener-policy-report-only: same-origin; report-to=https://q.stripe.com/coop-report
expires: 0

POST
H2 200 wallet-config Show response
merchant-ui-api.stripe.com/elements/ Frame 4457 2 KB
3 KB 598ms
247ms Fetch
application/json 198.137.150.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://merchant-ui-api.stripe.com/elements/wallet-config

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

198.137.150.201 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

18afce2482e80c281355f73655f8b8ef61eba649c06277dae589291145e43662

Security Headers

Name	Value
Content-Security-Policy	report-uri https://q.stripe.com/csp-report?p=elements%2Fwallet-config; block-all-mixed-content; default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 18 Jan 2024 07:40:09 GMT
content-security-policy: report-uri https://q.stripe.com/csp-report?p=elements%2Fwallet-config; block-all-mixed-content; default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'
strict-transport-security: max-age=63072000; includeSubDomains; preload
cross-origin-resource-policy: same-site
content-length: 2457
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
access-control-max-age: 300
access-control-allow-methods: GET, POST
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://js.stripe.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin
access-control-allow-headers: x-stripe-csrf-token
cross-origin-opener-policy-report-only: same-origin; report-to=https://q.stripe.com/coop-report
expires: 0

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 2EA3 474 B
865 B 165ms
156ms Fetch
application/json 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.stripe.com/v3/.deploy_status_henson.json
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.93.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-93-43.jfk50.r.cloudfront.net
Software: Cloudfront /
Resource Hash: f0aed7241eba2494db2bb05093be566589b0a9a6dcd5846446db8f078d556356

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-card-c2e208bab766f024106c5ddb80e13838.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 18 Jan 2024 07:39:40 GMT
via: 1.1 2da1a465458d2c4bd692e693d75f0780.cloudfront.net (CloudFront)
last-modified: Thu, 18 Jan 2024 05:59:09 GMT
server: Cloudfront
age: 32
x-amz-cf-pop: JFK50-P8
etag: "cae7b1f731ebdbac50cef4b3b72b0b4e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
content-length: 474
x-amz-cf-id: yku-qBKrEmdD0nuvba83QVNHGPqWi2QTR9LZHBJ5hENbYplA376NKQ==

POST
H2 200 b Show response
r.stripe.com/ Frame 4457 0
273 B 162ms
161ms Fetch
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:08 GMT
x-stripe-server-envoy-start-time-us: 1705563608814236
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 5
x-stripe-client-envoy-start-time-us: 1705563608813687
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 4457 0
273 B 160ms
160ms Fetch
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:08 GMT
x-stripe-server-envoy-start-time-us: 1705563608817879
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 5
x-stripe-client-envoy-start-time-us: 1705563608817611
access-control-allow-credentials: true
content-length: 0

GET
H2 200 payframe Show response
pay.google.com/gp/p/ui/ Frame F8BB 19 KB
8 KB 147ms
145ms Document
text/html 2607:f8b0:4004:c08::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=

Requested by

Host: pay.google.com
URL: https://pay.google.com/gp/p/js/pay.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5c Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

23537e4949904f154a942db3bd14074fa1f5e98f9bb824209e24d2e04862f0c7

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-XF8_c4A0wSvYvjRnhnLpdw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport/allowlist require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://js.stripe.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=3600
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-XF8_c4A0wSvYvjRnhnLpdw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport/allowlist require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport
content-type: text/html; charset=utf-8
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-site
date: Thu, 18 Jan 2024 07:40:09 GMT
expires: Thu, 18 Jan 2024 07:40:09 GMT
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-content-type-options: nosniff
x-ua-compatible: IE=edge
x-xss-protection: 0

POST
H2 200 b Show response
r.stripe.com/ Frame DC87 0
273 B 163ms
163ms Fetch
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:09 GMT
x-stripe-server-envoy-start-time-us: 1705563609051932
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 5
x-stripe-client-envoy-start-time-us: 1705563609051366
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame DC87 0
273 B 161ms
161ms Fetch
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:09 GMT
x-stripe-server-envoy-start-time-us: 1705563609055601
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 4
x-stripe-client-envoy-start-time-us: 1705563609054994
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame DC87 0
272 B 224ms
224ms Fetch
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:09 GMT
x-stripe-server-envoy-start-time-us: 1705563609108779
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 4
x-stripe-client-envoy-start-time-us: 1705563609108021
access-control-allow-credentials: true
content-length: 0

GET
H2 200 collect Show response
gtm.winred.com/g/ 491 B
625 B 312ms
312ms XHR
text/plain 2606:4700::6810:fa45
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je41a0v867905447z872410129&_p=1705563606829&gcd=11l1l1l1l1&dma=0&cid=1232550333.1705563609&ul=en-us&sr=1600x1200&_fplc=0&ur=CA-ON&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sst.uc=CA&sst.gse=1&sst.etld=google.ca&sst.gcd=11l1l1l1l1&sst.tft=1705563606829&_s=2&sid=1705563608&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth&dt=Trump%202024&en=user%20session%20start&ep.pagepath=%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F&ep.pagehostname=secure.winred.com&ep.parsedurl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923&epn.load_time_sec=-1705563605.7&epn.event_fire_time=1705563608182&ep.event_uuid=dddffdd9-cb21-40ca-ac5e-2f6af3a57ff0&ep.isVideoPage=f&ep.referrer=&ep.category=donation%20landing%20page&ep.action=user%20session%20start&ep.label=landing%20page%20settings&ep.customCSS=f&ep.usercategory=anonymous&_et=4&tfd=3355&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:fa45 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

81565c8e33a496d37dc653c1984dbd43cb4b685b0d098ada183c9d963b081fee

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:09 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 8475302d1ecaa1fc-YYZ
alt-svc: h3=":443"; ma=86400

POST
H2 200 csp-report
q.stripe.com/ Frame 77FD 0
490 B 175ms
175ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jan 2024 07:40:09 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563609174690
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: blue
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
x-stripe-server-envoy-upstream-service-time-ms: 0
x-stripe-client-envoy-start-time-us: 1705563609174174
cache-control: max-age=0, no-cache, no-store, must-revalidate
x-robots-tag: none
expires: 0

GET
H2 200 out-4.5.43.js Show response
m.stripe.network/ Frame 77FD 87 KB
15 KB 72ms
71ms Script
text/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/out-4.5.43.js

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/inner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://m.stripe.network/inner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
date: Thu, 18 Jan 2024 07:40:09 GMT
x-content-type-options: nosniff
content-encoding: br
via: 1.1 varnish
age: 46
x-cache: HIT
content-length: 15509
x-request-id: 858eb5c1-0c67-4c92-906e-3134657a813f
x-served-by: cache-yyz4578-YYZ
server: Fastly
x-timer: S1705563609.144861,VS0,VE0
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=300, public
accept-ranges: bytes
x-cache-hits: 10

POST
H2 404 cspreport
pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/ Frame F8BB 2 KB
2 KB 209ms
208ms Other
text/html 2607:f8b0:4004:c08::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/cspreport
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c08::5c Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: d6ff339ddb4525268c21fa26ded66b0703f177e742281dc9bcd558288f8e1101

Request headers

Referer: https://pay.google.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jan 2024 07:40:09 GMT
referrer-policy: no-referrer
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1608
content-type: text/html; charset=UTF-8

GET
H2 200 adsct
t.co/1/i/ 43 B
377 B 542ms
224ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=f455c614-d7eb-43a3-9bcb-eee273fb7a06&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=c8bf40b2-a407-46c6-ab39-9ddffc97dca7&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth&tw_iframe_status=0&txn_id=of93e&type=javascript&version=2.3.29

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-response-time: 80
date: Thu, 18 Jan 2024 07:40:09 GMT
strict-transport-security: max-age=0
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: 12f24e1f31ac6496
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: e9c4eb91037a3f8baba6770d88da48e3eda400b5233e1842b5cdfab5443867d6
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
726 B 525ms
189ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=f455c614-d7eb-43a3-9bcb-eee273fb7a06&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=c8bf40b2-a407-46c6-ab39-9ddffc97dca7&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth&tw_iframe_status=0&txn_id=of93e&type=javascript&version=2.3.29

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-response-time: 80
date: Thu, 18 Jan 2024 07:40:08 GMT
strict-transport-security: max-age=631138519
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: 4fdd0e0898032395
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: 22bf57fed721077bead8c98f750c22d44f57977c59457f8bc9c2fc6bd0a53300
content-length: 43

GET
H2 200 m=_b,_tp Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.gTtm5z5Y9_Q.es5.O/am=gEEw/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/ujg=1/rs=AMi... Frame F8BB 158 KB
57 KB 558ms
130ms Script
text/javascript 2607:f8b0:4004:c09::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.gTtm5z5Y9_Q.es5.O/am=gEEw/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/ujg=1/rs=AMitfrggAlHXTMAMwAXrIiPmM0COlolzyA/m=_b,_tp

Requested by

Host: pay.google.com
URL: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce16b2489366f391f28ea29c8a8cbd56b90985c6db5e1b69ab6772b07b2161af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 17:14:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138367
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57338
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 06:44:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Wed, 15 Jan 2025 17:14:02 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 16 B
84 B 221ms
220ms XHR
text/plain 2607:f8b0:4004:c06::71
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=950154501&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth&ul=en-us&de=UTF-8&dt=Trump%202024&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACEABBAAAACAAI~&jid=1219863035&gjid=291928771&cid=1232550333.1705563609&tid=UA-60901920-1&_gid=156899792.1705563609&_r=1&_slc=1&gtm=45He41a0n71M27JCGv72350723&gcd=11l1l1l1l1&dma=0&z=1308361743

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::71 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

641defe78e044cbd72e13110f131016fc26c1e8b00ef29ad142e177a0e54bfe1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:09 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
93 B 120ms
119ms XHR
text/plain 2607:f8b0:4004:c06::71
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=950154501&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth&ul=en-us&de=UTF-8&dt=Trump%202024&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDAiEABBAAAACAEK~&jid=1153946457&gjid=1520259611&cid=1232550333.1705563609&tid=UA-73658561-7&_gid=156899792.1705563609&_slc=1&gtm=45He41a0n71NTQZ9Nv72410129&gcd=11l1l1l1l1&dma=0&cd61=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth&z=743106469

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::71 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:09 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
350 B 589ms
198ms XHR
text/plain 2607:f8b0:4004:c09::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-73658561-7&cid=1232550333.1705563609&jid=1153946457&gjid=1520259611&_gid=156899792.1705563609&_u=YCDAiEABBAAAAGAEK~&z=1852291808

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 18 Jan 2024 07:40:09 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
133 B 211ms
211ms Image
image/gif 2607:f8b0:4004:c06::71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=950154501&t=event&ni=0&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth&ul=en-us&de=UTF-8&dt=Trump%202024&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=donation%20landing%20page&ea=user%20session%20start&el=landing%20page%20settings&_u=YCDAiEABBAAAAGAEK~&jid=&gjid=&cid=1232550333.1705563609&tid=UA-73658561-7&_gid=156899792.1705563609&gtm=45He41a0n71NTQZ9Nv72410129&gcd=11l1l1l1l1&dma=0&cd41=anonymous&cd58=f&cd61=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth&z=663115379

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::71 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 04:33:38 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 11191
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/11091438865/ 42 B
455 B 595ms
219ms Image
image/gif 2607:f8b0:4004:c07::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11091438865/?random=1705563608583&cv=11&fst=1705561200000&bg=ffffff&guid=ON&async=1&gtm=45je41a0v9102512289z872350723&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth&frm=0&tiba=Trump%202024&data=event%3Dgtag.config%3BcookieDomain%3Dauto&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_5G3XtAsrwddntH5qmiMifxFpiYJ8Tw&random=4138428430&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::93 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:09 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.ca/pagead/1p-user-list/11091438865/ 42 B
154 B 641ms
234ms Image
image/gif 2607:f8b0:4004:c08::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/11091438865/?random=1705563608583&cv=11&fst=1705561200000&bg=ffffff&guid=ON&async=1&gtm=45je41a0v9102512289z872350723&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth&frm=0&tiba=Trump%202024&data=event%3Dgtag.config%3BcookieDomain%3Dauto&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_5G3XtAsrwddntH5qmiMifxFpiYJ8Tw&random=4138428430&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:09 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
analytics.google.com/g/s/ 0
54 B 634ms
264ms Ping
text/plain 2001:4860:4802:32::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/s/collect?dma=0&gtm=45j91e41b1h1v867905447z872410129z9867900975&_gsid=X6H0114PDFuU2C19LJhJbSmci5wA8cYg
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:09 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
56 B 444ms
199ms Ping
text/plain 2607:f8b0:4004:c09::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&dma=0&tid=G-X6H0114PDF&cid=trSxgVntKDjQbOF7RCbvsrbnaQY4gxA8gDaLedFfiwE%3D.1705563609&gtm=45j91e41b1h1v867905447z872410129z9867900975&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c09::9a Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:09 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
107 B 505ms
235ms Image
image/gif 2607:f8b0:4004:c08::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=0&tid=G-X6H0114PDF&cid=trSxgVntKDjQbOF7RCbvsrbnaQY4gxA8gDaLedFfiwE%3D.1705563609&gtm=45j91e41b1h1v867905447z872410129z9867900975&aip=1&z=107526465

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1599889267195467 Show response
connect.facebook.net/signals/config/ 139 KB
36 KB 112ms
111ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1599889267195467?v=2.9.140&r=stable&domain=secure.winred.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

cd4c2cce4e42a2c7aefa661b49a52512335d33d54996bbf70b656db25d540ec1

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 18 Jan 2024 07:40:09 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 36839
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: wL0ixrKli/BlonuK26crDhrkCVHaeTy9l7kKGjldlC+Cp76mhqShRuDaqhzSrdjMnUhBZr+vAVfoJWF9tMRdeA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 6 Show response
m.stripe.com/ Frame 77FD 156 B
668 B 546ms
191ms XHR
application/json 34.211.13.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.43.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.211.13.104 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-211-13-104.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

0205063075c34d68e5ed29db53ce37570b3369cd91b5c4e5ab15bfaae0fd9412

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:09 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563609760647
server: nginx
content-type: application/json;charset=utf-8
x-stripe-server-envoy-upstream-service-time-ms: 1
access-control-allow-origin: https://m.stripe.network
x-stripe-client-envoy-start-time-us: 1705563609760430
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

POST
H2 200 b Show response
r.stripe.com/ Frame 4457 0
273 B 161ms
160ms Fetch
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:09 GMT
x-stripe-server-envoy-start-time-us: 1705563609436675
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 6
x-stripe-client-envoy-start-time-us: 1705563609436347
access-control-allow-credentials: true
content-length: 0

GET
H2 200 dc_pre=CPjLvMi35oMDFZMiTwgd9z0Lsw;src=9381094;type=pagev0;cat=djt_p0;ord=7348262461396;auiddc=1012720694.1705563608;gtm=45He41a0v72350723;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv... Show response
adservice.google.com/ddm/fls/i/ Frame AF7C 747 B
807 B 594ms
199ms Document
text/html 2607:f8b0:4004:c08::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CPjLvMi35oMDFZMiTwgd9z0Lsw;src=9381094;type=pagev0;cat=djt_p0;ord=7348262461396;auiddc=1012720694.1705563608;gtm=45He41a0v72350723;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth

Requested by

Host: 9381094.fls.doubleclick.net
URL: https://9381094.fls.doubleclick.net/activityi;dc_pre=CPjLvMi35oMDFZMiTwgd9z0Lsw;src=9381094;type=pagev0;cat=djt_p0;ord=7348262461396;auiddc=1012720694.1705563608;gtm=45He41a0v72350723;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

56c275580c205b0eb6b834258881ae4d17c21541c559fb2e217e2e2d43f921b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9381094.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 432
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 18 Jan 2024 07:40:09 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 hcaptcha-invisible-1d4f51566d1cd027565953e076bcc868.html Show response
js.stripe.com/v3/ Frame 0551 71 KB
23 KB 90ms
90ms Document
text/html 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/hcaptcha-invisible-1d4f51566d1cd027565953e076bcc868.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

195286a33cabaa8f3b0c747f0df4b0805c26a81719f1c5e1fa56d177eac8688d

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://errors.stripe.com https://r.stripe.com; default-src 'self'; form-action 'none'; frame-src 'self' https://b.stripecdn.com; img-src 'self' https://q.stripe.com; script-src 'self' 'sha256-BmGFXgJSzm18YVANxCTldL/Rs4FmAL3xZL/wtzTfzbU='; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-origin: *
age: 34
cache-control: max-age=60
content-encoding: br
content-security-policy: base-uri 'none'; connect-src 'self' https://errors.stripe.com https://r.stripe.com; default-src 'self'; form-action 'none'; frame-src 'self' https://b.stripecdn.com; img-src 'self' https://q.stripe.com; script-src 'self' 'sha256-BmGFXgJSzm18YVANxCTldL/Rs4FmAL3xZL/wtzTfzbU='; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 07:40:09 GMT
etag: W/"1d4f51566d1cd027565953e076bcc868"
last-modified: Thu, 18 Jan 2024 05:24:33 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
x-amz-cf-id: -yabKD9yd9OwbfskCeYd-3HBx0PixwlM-5IQSOsVXIgD0zDqPNgOqg==
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
x-content-type-options: nosniff

POST
H2 200 b Show response
r.stripe.com/ Frame 4457 0
273 B 200ms
200ms Fetch
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:09 GMT
x-stripe-server-envoy-start-time-us: 1705563609474011
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 5
x-stripe-client-envoy-start-time-us: 1705563609473544
access-control-allow-credentials: true
content-length: 0

GET
H2 200 phone-numbers-lib-5113174565c377315fd5b8d695d8b541.js Show response
js.stripe.com/v3/fingerprinted/js/ 148 KB
37 KB 106ms
106ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/phone-numbers-lib-5113174565c377315fd5b8d695d8b541.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

621661fe1c7a59420c624f7a421c566ebfb38cfbc7edd98ee0462c44d15971f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:03:55 GMT
content-encoding: gzip
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 2200
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Thu, 04 Jan 2024 21:09:58 GMT
server: Cloudfront
etag: W/"f7a3e754fa2fa9117506f69f618b5778"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: andE0QjEXyvY6nK4_dY8aDoTWQyesy-k6dVnC99GWyZTW04EOrXIQQ==

GET
H2 200 elements-inner-link-button-for-card-46e08b0617e3ea8e195ab83eeec06ee7.html Show response
js.stripe.com/v3/ Frame 8540 77 KB
16 KB 105ms
105ms Document
text/html 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-link-button-for-card-46e08b0617e3ea8e195ab83eeec06ee7.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

d92d1e4f2fc616480eb4e1df82c44cac0ca401ae0adad5b3b69f05d0cf33f5f3

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-origin: *
age: 589
cache-control: max-age=31536000
content-encoding: br
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 07:32:42 GMT
etag: W/"46e08b0617e3ea8e195ab83eeec06ee7"
last-modified: Thu, 18 Jan 2024 05:24:18 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
x-amz-cf-id: TJr5jB2tlvTqdLZ2lEkRWG7Li9tAKI0mRW2luoJbWT22eDKkB2jr1w==
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
x-content-type-options: nosniff

POST
H2 204 collect
analytics.google.com/g/s/ 0
54 B 571ms
264ms Ping
text/plain 2001:4860:4802:32::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/s/collect?dma=0&gtm=45j91e41b1v867905447z872410129z9867900975&_gsid=X6H0114PDFAkTW4SCo9mtdEIIAI8LM4g
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:09 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
408 B 442ms
234ms Image
image/gif 2607:f8b0:4004:c08::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 375ms
200ms XHR
text/plain 2607:f8b0:4004:c09::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-60901920-1&cid=1232550333.1705563609&jid=1219863035&gjid=291928771&_gid=156899792.1705563609&_u=YCDACEAABAAAACAAI~&z=208068267

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 18 Jan 2024 07:40:09 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 250 KB
85 KB 131ms
131ms Script
application/javascript 2607:f8b0:4004:c08::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-HNR33QTX08&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::61 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

34da31ab5500ec421e5ce0f484140984a62f91334934c0f3a5160304c7c48db6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:09 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 86674
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 18 Jan 2024 07:40:09 GMT

POST
H2 200 csp-report
q.stripe.com/ Frame 0551 0
716 B 175ms
174ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jan 2024 07:40:09 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563609540623
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: blue
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1705563609540262
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 577ms
206ms Image
text/plain 2a03:2880:f103:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1599889267195467&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth&rl=&if=false&ts=1705563609473&sw=1600&sh=1200&v=2.9.140&r=stable&ec=0&o=4126&fbp=fb.1.1705563609471.667709939&cs_est=true&ler=empty&it=1705563609329&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 18 Jan 2024 07:40:09 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 0551 474 B
866 B 85ms
85ms Fetch
application/json 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.stripe.com/v3/.deploy_status_henson.json
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/hcaptcha-invisible-1d4f51566d1cd027565953e076bcc868.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.93.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-93-43.jfk50.r.cloudfront.net
Software: Cloudfront /
Resource Hash: f0aed7241eba2494db2bb05093be566589b0a9a6dcd5846446db8f078d556356

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/hcaptcha-invisible-1d4f51566d1cd027565953e076bcc868.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 18 Jan 2024 07:39:40 GMT
via: 1.1 2da1a465458d2c4bd692e693d75f0780.cloudfront.net (CloudFront)
last-modified: Thu, 18 Jan 2024 05:59:09 GMT
server: Cloudfront
age: 33
x-amz-cf-pop: JFK50-P8
etag: "cae7b1f731ebdbac50cef4b3b72b0b4e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
content-length: 474
x-amz-cf-id: VeqATDKu4PqDZlCJTuDFDHnyqv_zzMzelhqdZjSgFzJNf94R41xBkA==

GET
H2 200 HCaptchaInvisible.html Show response
b.stripecdn.com/stripethirdparty-srv/assets/v20.6/ Frame 3949 419 B
1 KB 654ms
194ms Document
text/html 2600:9000:21da:3600:b:1d09:f200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://b.stripecdn.com/stripethirdparty-srv/assets/v20.6/HCaptchaInvisible.html?id=3a43367c-c866-4544-afec-5870b0ffcea8&origin=https%3A%2F%2Fjs.stripe.com

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/hcaptcha-invisible-1d4f51566d1cd027565953e076bcc868.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21da:3600:b:1d09:f200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudfront /

Resource Hash

63293d7cb7e2db4b24a51f81bcf1946d5a9a516051a274997fcef446b9b7b7bd

Security Headers

Name	Value
Content-Security-Policy	base-uri 'self'; connect-src 'self' https://hcaptcha.com https://.hcaptcha.com https://errors.stripe.com; default-src 'self'; form-action 'none'; frame-src https://hcaptcha.com https://.hcaptcha.com; img-src 'self'; script-src 'self' https://hcaptcha.com https://.hcaptcha.com; style-src 'self' https://hcaptcha.com https://.hcaptcha.com; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 58
cache-control: max-age=60
content-length: 419
content-security-policy: base-uri 'self'; connect-src 'self' https://hcaptcha.com https://*.hcaptcha.com https://errors.stripe.com; default-src 'self'; form-action 'none'; frame-src https://hcaptcha.com https://*.hcaptcha.com; img-src 'self'; script-src 'self' https://hcaptcha.com https://*.hcaptcha.com; style-src 'self' https://hcaptcha.com https://*.hcaptcha.com; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 07:39:12 GMT
etag: "e1e6961f0053784aeaf3902bdbd51398"
last-modified: Wed, 17 Jan 2024 17:35:51 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding, Origin
via: 1.1 1ffe498380a643d1bb2efaa624b761a6.cloudfront.net (CloudFront)
x-amz-cf-id: jP0kgWOiUhzg5mlaFAUi36be6R6-E3Fo-eZaojYTpSPPZhuf5_Aolg==
x-amz-cf-pop: EWR53-C1
x-cache: Hit from cloudfront
x-content-type-options: nosniff

POST
H2 200 csp-report
q.stripe.com/ Frame 8540 0
716 B 145ms
143ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jan 2024 07:40:09 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563609571589
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: blue
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1705563609571293
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 8540 0
716 B 132ms
130ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jan 2024 07:40:09 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563609571610
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: blue
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1705563609571318
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

GET
H2 200 shared-6dd1441cf37f4a0448e75338cca8c002.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 8540 533 KB
117 KB 91ms
90ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-link-button-for-card-46e08b0617e3ea8e195ab83eeec06ee7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

207f8c2a000504f9d1bf6b7021ea01252684ad378ac34a6b905e03e1fcd94a4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-link-button-for-card-46e08b0617e3ea8e195ab83eeec06ee7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:26:52 GMT
content-encoding: br
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 823
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Thu, 18 Jan 2024 05:24:32 GMT
server: Cloudfront
etag: W/"faf6ca6e9d17a91adace5b6a322c6484"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: sN904vfvSJ1xtrKB1AZBk2jx9oPygqsT3wP75x19uelkltBKRgv4Sw==

GET
H2 200 elements-inner-link-button-for-card-8a7b6f6354c282b6a4fac964ea39980a.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 8540 24 KB
9 KB 120ms
119ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-link-button-for-card-8a7b6f6354c282b6a4fac964ea39980a.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-link-button-for-card-46e08b0617e3ea8e195ab83eeec06ee7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

71cb66aea504951c7d2499622f35a263da91af2fd72b6efd2889657da0e8b817

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-link-button-for-card-46e08b0617e3ea8e195ab83eeec06ee7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:37:38 GMT
content-encoding: br
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 316
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Fri, 05 Jan 2024 18:04:25 GMT
server: Cloudfront
etag: W/"ce0bb5b197c6330c3e2d69a66d1f828d"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: YTuTlrGFayfbNBXn-epgB8w6ftk1Lw4DwV2hTsGVnPCfYNKsTjYGmg==

GET
H2 200 elements-inner-link-button-for-card-5eea9779eabe486a801d5564f8c44131.css
js.stripe.com/v3/fingerprinted/css/ Frame 8540 25 KB
4 KB 89ms
88ms Stylesheet
text/css 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/elements-inner-link-button-for-card-5eea9779eabe486a801d5564f8c44131.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-link-button-for-card-46e08b0617e3ea8e195ab83eeec06ee7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

042e2de0cb5720f25c17d0c9d40fbf5d1a5711c3e5e275ca939a36298e69117a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-link-button-for-card-46e08b0617e3ea8e195ab83eeec06ee7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:30:06 GMT
content-encoding: br
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 665
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Fri, 05 Jan 2024 18:04:14 GMT
server: Cloudfront
etag: W/"292bfff48a65329a3b7ce317998188f4"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: pfIP0iSk_sVghqB8tte_9osRd26DfbK1S6OyYvU0p1V3CcvXfW4yBA==

POST
H2 204 collect
analytics.google.com/g/ 0
255 B 184ms
183ms Ping
text/plain 2001:4860:4802:32::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-HNR33QTX08&_ono=1&gtm=45je41a0v9164375506&_p=1705563606829&_gaz=1&gcd=11l1l1l1l2&dma=0&ul=en-us&sr=1600x1200&cid=1232550333.1705563609&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EBAI&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth&dt=Trump%202024&sid=1705563609&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=4065
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-HNR33QTX08&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:09 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
45 B 141ms
140ms Ping
text/plain 2607:f8b0:4004:c09::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&_ono=1&tid=G-HNR33QTX08&cid=1232550333.1705563609&gtm=45je41a0v9164375506&aip=1&dma=0&gcd=11l1l1l1l2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-HNR33QTX08&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c09::9a Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:09 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
107 B 147ms
147ms Image
image/gif 2607:f8b0:4004:c08::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&_ono=1&tid=G-HNR33QTX08&cid=1232550333.1705563609&gtm=45je41a0v9164375506&aip=1&dma=0&gcd=11l1l1l1l2&z=26836550

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 121ms
121ms Image
image/gif 2607:f8b0:4004:c07::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-73658561-7&cid=1232550333.1705563609&jid=1153946457&_u=YCDAiEABBAAAAGAEK~&z=1513834973

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::93 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
107 B 246ms
246ms Image
image/gif 2607:f8b0:4004:c08::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-73658561-7&cid=1232550333.1705563609&jid=1153946457&_u=YCDAiEABBAAAAGAEK~&z=1513834973

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 215ms
214ms Image
image/gif 2607:f8b0:4004:c07::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-60901920-1&cid=1232550333.1705563609&jid=1219863035&_u=YCDACEAABAAAACAAI~&z=2000418004

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::93 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
107 B 246ms
246ms Image
image/gif 2607:f8b0:4004:c08::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-60901920-1&cid=1232550333.1705563609&jid=1219863035&_u=YCDACEAABAAAACAAI~&z=2000418004

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 b Show response
r.stripe.com/ Frame 4457 0
273 B 160ms
160ms Fetch
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:09 GMT
x-stripe-server-envoy-start-time-us: 1705563609841586
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 4
x-stripe-client-envoy-start-time-us: 1705563609839305
access-control-allow-credentials: true
content-length: 0

GET
H2 200 m=Das5Le Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.gTtm5z5Y9_Q.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.JhA... Frame F8BB 74 KB
27 KB 112ms
111ms Script
text/javascript 2607:f8b0:4004:c09::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.gTtm5z5Y9_Q.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.JhAI_Bj2nZs.L.B1.O/am=gEEw/d=1/exm=_b,_tp/excm=_b,_tp,payframeview/ed=1/wt=2/ujg=1/rs=AMitfrjBBu86Cr76Ppa42BFZXSF8hysA8w/ee=EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;oGtAuc:sOXFj;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:siKnQd;yEQyxe:p8L0ob;yxTchf:KUM7Z/m=Das5Le

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.gTtm5z5Y9_Q.es5.O/am=gEEw/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/ujg=1/rs=AMitfrggAlHXTMAMwAXrIiPmM0COlolzyA/m=_b,_tp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

247a74c5584350ea1cac5af52c1bfca8b6d4730d019610086c076c6993d05413

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 17:36:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 137008
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27691
x-xss-protection: 0
last-modified: Sat, 13 Jan 2024 06:44:37 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Wed, 15 Jan 2025 17:36:41 GMT

POST
H2 200 6 Show response
m.stripe.com/ Frame 77FD 156 B
667 B 159ms
159ms XHR
application/json 34.211.13.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.43.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.211.13.104 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-211-13-104.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

0205063075c34d68e5ed29db53ce37570b3369cd91b5c4e5ab15bfaae0fd9412

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:09 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563609966728
server: nginx
content-type: application/json;charset=utf-8
x-stripe-server-envoy-upstream-service-time-ms: 3
access-control-allow-origin: https://m.stripe.network
x-stripe-client-envoy-start-time-us: 1705563609966448
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

POST
H2 200 6 Show response
m.stripe.com/ Frame 77FD 156 B
666 B 189ms
188ms XHR
application/json 34.211.13.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.43.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.211.13.104 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-211-13-104.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

0205063075c34d68e5ed29db53ce37570b3369cd91b5c4e5ab15bfaae0fd9412

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:10 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563610015141
server: nginx
content-type: application/json;charset=utf-8
x-stripe-server-envoy-upstream-service-time-ms: 1
access-control-allow-origin: https://m.stripe.network
x-stripe-client-envoy-start-time-us: 1705563610014831
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

GET
H2 200 dc_pre=CPjLvMi35oMDFZMiTwgd9z0Lsw;src=9381094;type=pagev0;cat=djt_p0;ord=7348262461396;auiddc=1012720694.1705563608;gtm=45He41a0v72350723;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv... Show response
adservice.google.ca/ddm/fls/i/ Frame 37E5 194 B
515 B 1029ms
201ms Document
text/html 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/ddm/fls/i/dc_pre=CPjLvMi35oMDFZMiTwgd9z0Lsw;src=9381094;type=pagev0;cat=djt_p0;ord=7348262461396;auiddc=1012720694.1705563608;gtm=45He41a0v72350723;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CPjLvMi35oMDFZMiTwgd9z0Lsw;src=9381094;type=pagev0;cat=djt_p0;ord=7348262461396;auiddc=1012720694.1705563608;gtm=45He41a0v72350723;gcd=11l1l1l1l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 85
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 18 Jan 2024 07:40:10 GMT
expires: Thu, 18 Jan 2024 07:40:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pay Show response
pay.google.com/gp/p/ui/ Frame F8BB 1 MB
376 KB 158ms
157ms XHR
text/html 2607:f8b0:4004:c08::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/ui/pay

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::5c Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2abc1b2af4ad732ef26f0a7f5f6bb8db1a4ec821dfafc07c0613de05d6d5ccad

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport, script-src 'report-sample' 'nonce-q0Zb28Ew001cHO7JWmsx3w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://payments.sandbox.google.com https://pay.google.com https://pay.sandbox.google.com;report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport/allowlist
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:10 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport, script-src 'report-sample' 'nonce-q0Zb28Ew001cHO7JWmsx3w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://payments.sandbox.google.com https://pay.google.com https://pay.sandbox.google.com;report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport/allowlist
x-content-type-options: nosniff
cross-origin-resource-policy: same-site
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
x-ua-compatible: IE=edge
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: unsafe-none
server: ESF
x-frame-options: DENY
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
cache-control: private, max-age=3600
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Thu, 18 Jan 2024 07:40:10 GMT

POST
H2 200 b Show response
r.stripe.com/ Frame 2EA3 0
271 B 197ms
197ms Fetch
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:10 GMT
x-stripe-server-envoy-start-time-us: 1705563610102284
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 4
x-stripe-client-envoy-start-time-us: 1705563610101729
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame DC87 0
271 B 195ms
195ms Fetch
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:10 GMT
x-stripe-server-envoy-start-time-us: 1705563610102292
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 4
x-stripe-client-envoy-start-time-us: 1705563610101801
access-control-allow-credentials: true
content-length: 0

GET
H2 200 m=Wt6vjf,hhhU8,FCpbqb,WhJNk Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.gTtm5z5Y9_Q.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.JhA... Frame F8BB 9 KB
4 KB 114ms
114ms Script
text/javascript 2607:f8b0:4004:c09::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.gTtm5z5Y9_Q.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.JhAI_Bj2nZs.L.B1.O/am=gEEw/d=1/exm=Das5Le,_b,_tp/excm=_b,_tp,payframeview/ed=1/wt=2/ujg=1/rs=AMitfrjBBu86Cr76Ppa42BFZXSF8hysA8w/ee=EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;oGtAuc:sOXFj;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:siKnQd;yEQyxe:p8L0ob;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e76ee05d1cbc130b3ad2dcf446fc445dbe1f59f16c00533ffa91eb2dd4966567

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 17:36:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 137009
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3746
x-xss-protection: 0
last-modified: Sat, 13 Jan 2024 06:44:37 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Wed, 15 Jan 2025 17:36:41 GMT

GET
H2 200 m=byfTOb,lsjVmc,LEikZe,lwddkf,EFQ78c Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.gTtm5z5Y9_Q.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.JhA... Frame F8BB 37 KB
14 KB 124ms
124ms Script
text/javascript 2607:f8b0:4004:c09::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.gTtm5z5Y9_Q.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.JhAI_Bj2nZs.L.B1.O/am=gEEw/d=1/exm=Das5Le,FCpbqb,WhJNk,Wt6vjf,_b,_tp,hhhU8/excm=_b,_tp,payframeview/ed=1/wt=2/ujg=1/rs=AMitfrjBBu86Cr76Ppa42BFZXSF8hysA8w/ee=EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;oGtAuc:sOXFj;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:siKnQd;yEQyxe:p8L0ob;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe,lwddkf,EFQ78c

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f0af8590adca51f917493212d5f1c2cb6041751c2b21d387eb3d36f0065e7a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 17:36:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 137009
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14297
x-xss-protection: 0
last-modified: Sat, 13 Jan 2024 06:44:37 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Wed, 15 Jan 2025 17:36:41 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 948ms
192ms Preflight
text/plain 2607:f8b0:4004:c09::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::8a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Thu, 18 Jan 2024 07:40:10 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame F8BB 131 B
155 B 582ms
174ms XHR
text/plain 2607:f8b0:4004:c09::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::8a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Thu, 18 Jan 2024 07:40:11 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 18 Jan 2024 07:40:11 GMT

POST
H3 200 log Show response
play.google.com/ Frame F8BB 131 B
155 B 581ms
173ms XHR
text/plain 2607:f8b0:4004:c09::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::8a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Thu, 18 Jan 2024 07:40:11 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 18 Jan 2024 07:40:11 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 945ms
193ms Preflight
text/plain 2607:f8b0:4004:c09::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::8a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Thu, 18 Jan 2024 07:40:10 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 944ms
193ms Preflight
text/plain 2607:f8b0:4004:c09::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::8a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Thu, 18 Jan 2024 07:40:10 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame F8BB 131 B
155 B 582ms
174ms XHR
text/plain 2607:f8b0:4004:c09::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::8a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Thu, 18 Jan 2024 07:40:11 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 18 Jan 2024 07:40:11 GMT

POST
H3 200 log Show response
play.google.com/ Frame F8BB 131 B
155 B 581ms
173ms XHR
text/plain 2607:f8b0:4004:c09::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::8a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Thu, 18 Jan 2024 07:40:11 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 18 Jan 2024 07:40:11 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 942ms
193ms Preflight
text/plain 2607:f8b0:4004:c09::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::8a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Thu, 18 Jan 2024 07:40:10 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 942ms
194ms Preflight
text/plain 2607:f8b0:4004:c09::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::8a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Thu, 18 Jan 2024 07:40:10 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame F8BB 131 B
155 B 576ms
170ms XHR
text/plain 2607:f8b0:4004:c09::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::8a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Thu, 18 Jan 2024 07:40:11 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 18 Jan 2024 07:40:11 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 939ms
194ms Preflight
text/plain 2607:f8b0:4004:c09::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::8a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Thu, 18 Jan 2024 07:40:10 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame F8BB 131 B
155 B 575ms
168ms XHR
text/plain 2607:f8b0:4004:c09::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::8a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Thu, 18 Jan 2024 07:40:11 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 18 Jan 2024 07:40:11 GMT

POST
H2 200 b Show response
r.stripe.com/ Frame DC87 0
272 B 163ms
162ms Fetch
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:10 GMT
x-stripe-server-envoy-start-time-us: 1705563610120124
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 4
x-stripe-client-envoy-start-time-us: 1705563610119481
access-control-allow-credentials: true
content-length: 0

GET
H2 200 elements-inner-payment-request-9873cb4068dc5095000e64458624ac3f.html Show response
js.stripe.com/v3/ Frame 7FD9 820 B
2 KB 88ms
87ms Document
text/html 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-payment-request-9873cb4068dc5095000e64458624ac3f.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

46cd9da62e48758019033efbd0cb8adcc8818f42ef4dea6c83efc0063d2f093a

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 3591
cache-control: max-age=31536000
content-length: 820
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 06:40:20 GMT
etag: "9873cb4068dc5095000e64458624ac3f"
last-modified: Thu, 18 Jan 2024 05:24:18 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
x-amz-cf-id: 8nMjg3mJbaX3nZnl6Ziin86vL0z_3PuLoAmukp_Ox_SARkL0akAe6A==
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
x-content-type-options: nosniff

POST
H2 200 b Show response
r.stripe.com/ Frame DC87 0
273 B 144ms
144ms Fetch
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:10 GMT
x-stripe-server-envoy-start-time-us: 1705563610124447
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 7
x-stripe-client-envoy-start-time-us: 1705563610123823
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 4457 0
273 B 193ms
193ms Fetch
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:10 GMT
x-stripe-server-envoy-start-time-us: 1705563610508958
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 4
x-stripe-client-envoy-start-time-us: 1705563610508231
access-control-allow-credentials: true
content-length: 0

GET
H2 200 shared-6dd1441cf37f4a0448e75338cca8c002.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 7FD9 533 KB
117 KB 95ms
93ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-9873cb4068dc5095000e64458624ac3f.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

207f8c2a000504f9d1bf6b7021ea01252684ad378ac34a6b905e03e1fcd94a4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-9873cb4068dc5095000e64458624ac3f.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:26:52 GMT
content-encoding: br
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 824
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Thu, 18 Jan 2024 05:24:32 GMT
server: Cloudfront
etag: W/"faf6ca6e9d17a91adace5b6a322c6484"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: g7veAS_hizVmHB3pxy8eH9B60mm42GIh6m2N8kcIY3mgpGPGE5tLdQ==

GET
H2 200 ui-shared-5e70bb60bbe35da7bfb390bf6f668194.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 7FD9 405 KB
103 KB 92ms
91ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/ui-shared-5e70bb60bbe35da7bfb390bf6f668194.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-9873cb4068dc5095000e64458624ac3f.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

a3ba43aa269ba38b1b1053f8835d26ac13e5d648d75179b5edff178837abd8f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-9873cb4068dc5095000e64458624ac3f.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:31:20 GMT
content-encoding: br
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 593
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Thu, 18 Jan 2024 05:24:33 GMT
server: Cloudfront
etag: W/"c5e33e67d528594a232161ccfd925d2e"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: i_hJtDWdIF1ZEkJ0t2lsrZ5OQ5aL78B7b0c1jj9MscJ2cyMqxG17Cw==

GET
H2 200 elements-inner-payment-request-3ffc11299cc450c4bdf1d2675b9d9ac7.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 7FD9 72 KB
25 KB 107ms
107ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-payment-request-3ffc11299cc450c4bdf1d2675b9d9ac7.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-9873cb4068dc5095000e64458624ac3f.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

3f534a74830530483c1dd97b3689ee418a6499b5d0925aa9f009ffcfcc317fe7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-9873cb4068dc5095000e64458624ac3f.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:03:27 GMT
content-encoding: gzip
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 2204
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Fri, 12 Jan 2024 18:09:19 GMT
server: Cloudfront
etag: W/"ac57b4658a09416a9b023bb26ee29cac"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: RB3WB8gUwuO1hWqmlvgxt3-e_slwwm3oC-7Ai174HIMdoP7zd12SeQ==

GET
H2 200 ui-shared-1d27f4e2b314637ba4bb9d7ff79c23c7.css
js.stripe.com/v3/fingerprinted/css/ Frame 7FD9 20 KB
4 KB 90ms
89ms Stylesheet
text/css 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/ui-shared-1d27f4e2b314637ba4bb9d7ff79c23c7.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-9873cb4068dc5095000e64458624ac3f.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

394724ca0118829643c12fb5a033cb66680e51327ba157677d18dec209278a3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-9873cb4068dc5095000e64458624ac3f.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 06:48:07 GMT
content-encoding: gzip
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 3129
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Thu, 04 Jan 2024 21:09:46 GMT
server: Cloudfront
etag: W/"b361d7109e9925ca18e32c9da528520f"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: vkBkrCPfd1ehPcKTmlFfu1uzBUbkzz19hDbTri46JszJm2kh9WcB6g==

GET
H2 200 elements-inner-payment-request-6851fb638395ab2ad12082441235bcfa.css
js.stripe.com/v3/fingerprinted/css/ Frame 7FD9 11 KB
3 KB 91ms
90ms Stylesheet
text/css 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/elements-inner-payment-request-6851fb638395ab2ad12082441235bcfa.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-9873cb4068dc5095000e64458624ac3f.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

5033e337e474e5d2818fee21b093eaef81d5f545fd49b5f635b3e1160fa83abe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-9873cb4068dc5095000e64458624ac3f.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 06:57:55 GMT
content-encoding: br
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 2535
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
last-modified: Fri, 12 Jan 2024 21:06:27 GMT
server: Cloudfront
etag: W/"828ee6578d45b518446bf74a1cc39038"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: T5K2GqFvvvzg6MsMrRkm87lFREmMQsv1bono2F9gaDDgS8HFoWJo4Q==

GET
H2 200 api.js Show response
hcaptcha.com/1/ Frame 3949 326 KB
92 KB 332ms
81ms Script
application/javascript 104.19.219.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hcaptcha.com/1/api.js?onload=captchaLoad&render=explicit

Requested by

Host: b.stripecdn.com
URL: https://b.stripecdn.com/stripethirdparty-srv/assets/v20.6/HCaptchaInvisible.html?id=3a43367c-c866-4544-afec-5870b0ffcea8&origin=https%3A%2F%2Fjs.stripe.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ed80804c791a1a3b8d7f86bbbdcb0fa653f2aa9679b585e7d259aa63cce1073a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b.stripecdn.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 7dd34c129f9f4ea3b51fe1fa61080774.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: EWHNDPoE5ftpmErhJIwmGeaNXj5HLxHT
age: 0
x-amz-cf-pop: YUL62-C2
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 12 Jan 2024 19:30:31 GMT
server: cloudflare
etag: W/"fbd0e8fceba7f4b3dee625e845b0fbdf"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=300
cf-ray: 847530391aba548b-YYZ
x-amz-cf-id: O89m40K-c-siiz0Q2znxa9jFswCKTT9nZrEoWJQo8R6YkGupB9uP7Q==

GET
H2 200 vendors~AddressAutocomplete~AffirmInContext~AmazonPayButton~AuthMap~DemoPayButton~DynamicMap~GoogleA~0add53ca.d1e7b6b2c46f0cb34935.bundle.js Show response
b.stripecdn.com/stripethirdparty-srv/assets/v20.6/ Frame 3949 114 KB
35 KB 122ms
121ms Script
text/javascript 2600:9000:21da:3600:b:1d09:f200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://b.stripecdn.com/stripethirdparty-srv/assets/v20.6/vendors~AddressAutocomplete~AffirmInContext~AmazonPayButton~AuthMap~DemoPayButton~DynamicMap~GoogleA~0add53ca.d1e7b6b2c46f0cb34935.bundle.js

Requested by

Host: b.stripecdn.com
URL: https://b.stripecdn.com/stripethirdparty-srv/assets/v20.6/HCaptchaInvisible.html?id=3a43367c-c866-4544-afec-5870b0ffcea8&origin=https%3A%2F%2Fjs.stripe.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21da:3600:b:1d09:f200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudfront /

Resource Hash

b937209845ab8f20d6ced84d5486ff20cb4c8d754f13b26463519ed1c9731edb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b.stripecdn.com/stripethirdparty-srv/assets/v20.6/HCaptchaInvisible.html?id=3a43367c-c866-4544-afec-5870b0ffcea8&origin=https%3A%2F%2Fjs.stripe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Thu, 18 Jan 2024 07:19:56 GMT
via: 1.1 1ffe498380a643d1bb2efaa624b761a6.cloudfront.net (CloudFront)
age: 1216
x-amz-cf-pop: EWR53-C1
x-cache: Hit from cloudfront
last-modified: Wed, 17 Jan 2024 17:35:51 GMT
server: Cloudfront
etag: W/"30f4374e28471e15dc7ebc6499e426f0"
vary: Accept-Encoding,Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=31536000, public
timing-allow-origin: *
x-amz-cf-id: 4okwZ4IITC3kzp0ayP-pDCJug97F5FsXOOJoaBCQu-WQA9XqC0-n0Q==

GET
H2 200 HCaptchaInvisible.8685d0046428a20373d9.bundle.js Show response
b.stripecdn.com/stripethirdparty-srv/assets/v20.6/ Frame 3949 17 KB
7 KB 183ms
182ms Script
text/javascript 2600:9000:21da:3600:b:1d09:f200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://b.stripecdn.com/stripethirdparty-srv/assets/v20.6/HCaptchaInvisible.8685d0046428a20373d9.bundle.js

Requested by

Host: b.stripecdn.com
URL: https://b.stripecdn.com/stripethirdparty-srv/assets/v20.6/HCaptchaInvisible.html?id=3a43367c-c866-4544-afec-5870b0ffcea8&origin=https%3A%2F%2Fjs.stripe.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21da:3600:b:1d09:f200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudfront /

Resource Hash

13a8879b1f42490a44ee1e591f57d6a296d0f0c3f9a6ec4a26cbbd8e635a5736

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b.stripecdn.com/stripethirdparty-srv/assets/v20.6/HCaptchaInvisible.html?id=3a43367c-c866-4544-afec-5870b0ffcea8&origin=https%3A%2F%2Fjs.stripe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Thu, 18 Jan 2024 07:19:55 GMT
via: 1.1 1ffe498380a643d1bb2efaa624b761a6.cloudfront.net (CloudFront)
age: 1216
x-amz-cf-pop: EWR53-C1
x-cache: Hit from cloudfront
last-modified: Wed, 17 Jan 2024 23:36:57 GMT
server: Cloudfront
etag: W/"d99d4c04a8ddd971807a07a4e59e00dc"
vary: Accept-Encoding,Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=31536000, public
timing-allow-origin: *
x-amz-cf-id: fIa9cFRNeJ8Q5hu_blp-54-f2zeUPl1V6IjFzqrqtXvMLO3fzPTVZA==

POST
H2 200 csp-report
q.stripe.com/ Frame 7FD9 0
716 B 132ms
131ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jan 2024 07:40:10 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563610841485
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: blue
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1705563610840885
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 7FD9 0
716 B 131ms
130ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jan 2024 07:40:10 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563610841145
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: blue
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1705563610840907
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 3949 0
490 B 220ms
220ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://b.stripecdn.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 18 Jan 2024 07:40:10 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1705563610900986
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: blue
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
x-stripe-server-envoy-upstream-service-time-ms: 0
x-stripe-client-envoy-start-time-us: 1705563610900606
cache-control: max-age=0, no-cache, no-store, must-revalidate
x-robots-tag: none
expires: 0

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 7FD9 474 B
864 B 86ms
85ms Fetch
application/json 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.stripe.com/v3/.deploy_status_henson.json
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.93.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-93-43.jfk50.r.cloudfront.net
Software: Cloudfront /
Resource Hash: f0aed7241eba2494db2bb05093be566589b0a9a6dcd5846446db8f078d556356

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-payment-request-9873cb4068dc5095000e64458624ac3f.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 18 Jan 2024 07:39:40 GMT
via: 1.1 2da1a465458d2c4bd692e693d75f0780.cloudfront.net (CloudFront)
last-modified: Thu, 18 Jan 2024 05:59:09 GMT
server: Cloudfront
age: 34
x-amz-cf-pop: JFK50-P8
etag: "cae7b1f731ebdbac50cef4b3b72b0b4e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
content-length: 474
x-amz-cf-id: -MyEZZ_VczQOGET1Ss6ptIimcd8043UVq3jy7Swca3BtdEIdS-hN2Q==

POST
H2 200 b Show response
r.stripe.com/ Frame DC87 0
273 B 194ms
193ms Fetch
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:11 GMT
x-stripe-server-envoy-start-time-us: 1705563611181314
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 5
x-stripe-client-envoy-start-time-us: 1705563611180607
access-control-allow-credentials: true
content-length: 0

POST
H3 204 rum Show response
secure.winred.com/cdn-cgi/ 0
142 B 120ms
90ms XHR
text/plain 2606:4700::6813:d459
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
content-type: application/json

Response headers

date: Thu, 18 Jan 2024 07:40:11 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://secure.winred.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 8475303a5e5036fd-YYZ

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 232 KB
80 KB 132ms
132ms Script
application/javascript 2607:f8b0:4004:c08::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11094181768

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::61 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8558280cb8380c97c03bab6c04fde3ab096c1a93bcfb3709d610590218052672

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 82086
x-xss-protection: 0
last-modified: Thu, 18 Jan 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Jan 2024 07:40:11 GMT

GET
H2 200 hcaptcha.html Show response
newassets.hcaptcha.com/captcha/v1/2a00369/static/ Frame 278F 2 KB
1 KB 81ms
77ms Document
text/html 104.19.219.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/2a00369/static/hcaptcha.html?_v=lqlnua4kcjd

Requested by

Host: hcaptcha.com
URL: https://hcaptcha.com/1/api.js?onload=captchaLoad&render=explicit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b93ff2894a22e45fa8ab3e7ac246ba1c7f1ca4a4b772ecd0734a062091ae0c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://b.stripecdn.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-origin: *
age: 446156
alt-svc: h3=":443"; ma=86400
cache-control: max-age=1209600
cf-cache-status: HIT
cf-ray: 8475303dcc3b548b-YYZ
content-encoding: br
content-type: text/html
cross-origin-embedder-policy: credentialless
cross-origin-resource-policy: cross-origin
date: Thu, 18 Jan 2024 07:40:11 GMT
last-modified: Fri, 12 Jan 2024 19:30:31 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
via: 1.1 b7321b4add4495066f8401239ad07f94.cloudfront.net (CloudFront)
x-amz-cf-id: ybHKiK3yzKik-YmNEsfhKYHXuLD24k5ZuOHm-5rmTULzNf0rU3ZAdQ==
x-amz-cf-pop: YUL62-C2
x-amz-server-side-encryption: AES256
x-amz-version-id: 5seh2Fy1m5uAejWNOpND.L8.XAC93K8_
x-cache: Miss from cloudfront
x-content-type-options: nosniff

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11094181768/ 3 KB
2 KB 127ms
127ms Script
text/javascript 2607:f8b0:4004:c08::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11094181768/?random=1705563611804&cv=11&fst=1705563611804&bg=ffffff&guid=ON&async=1&gtm=45be41a0v9102692410&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth&hn=www.googleadservices.com&frm=0&tiba=Trump%202024&auid=1012720694.1705563608&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-11094181768

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

56cb4038ca01d49b498f6c3839ecaf7ac3b4b6a16e9921d54ad7e2d15b8148ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1392
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 hcaptcha.js Show response
newassets.hcaptcha.com/captcha/v1/2a00369/ Frame 278F 326 KB
92 KB 80ms
79ms Script
application/javascript 104.19.219.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/2a00369/hcaptcha.js

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/2a00369/static/hcaptcha.html?_v=lqlnua4kcjd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ed80804c791a1a3b8d7f86bbbdcb0fa653f2aa9679b585e7d259aa63cce1073a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://newassets.hcaptcha.com/captcha/v1/2a00369/static/hcaptcha.html?_v=lqlnua4kcjd
Origin: https://newassets.hcaptcha.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 7dd34c129f9f4ea3b51fe1fa61080774.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: EWHNDPoE5ftpmErhJIwmGeaNXj5HLxHT
age: 125024
x-amz-cf-pop: YUL62-C2
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 12 Jan 2024 19:30:31 GMT
server: cloudflare
etag: W/"fbd0e8fceba7f4b3dee625e845b0fbdf"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=1209600
cf-ray: 8475303e5c6a548b-YYZ
x-amz-cf-id: O89m40K-c-siiz0Q2znxa9jFswCKTT9nZrEoWJQo8R6YkGupB9uP7Q==

POST
H2 200 checksiteconfig Show response
api2.hcaptcha.com/ Frame 278F 719 B
1020 B 118ms
111ms XHR
application/json 104.19.219.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.hcaptcha.com/checksiteconfig?v=2a00369&host=b.stripecdn.com&sitekey=463b917e-e264-403f-ad34-34af0ee10294&sc=1&swa=1&spst=1

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/2a00369/hcaptcha.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1d7d7f58ee047dd90687d45bca4ee0ca563d50e08ce568472a4d9080a3e65026

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://newassets.hcaptcha.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 18 Jan 2024 07:40:12 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
server: cloudflare
vary: Origin, Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://newassets.hcaptcha.com
access-control-allow-credentials: true
cf-ray: 8475303f6cd1548b-YYZ
access-control-allow-headers: Cache-Control, Content-Type, DNT, Referer, User-Agent, challenge-bypass-token, cf-chl-bypass, challenge-bypass-token, challenge-bypass-host, challenge-bypass-path
alt-svc: h3=":443"; ma=86400

GET
H2 200 /
www.google.com/pagead/1p-user-list/11094181768/ 42 B
108 B 158ms
156ms Image
image/gif 2607:f8b0:4004:c07::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11094181768/?random=1705563611804&cv=11&fst=1705561200000&bg=ffffff&guid=ON&async=1&gtm=45be41a0v9102692410&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth&frm=0&tiba=Trump%202024&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_xyh8LDON7vyFrAY7invEdZ03E4aZ-Q8TZaW8XEUlIJKJlMnd&random=3193942565&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::93 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:12 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.ca/pagead/1p-user-list/11094181768/ 42 B
108 B 128ms
128ms Image
image/gif 2607:f8b0:4004:c08::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/11094181768/?random=1705563611804&cv=11&fst=1705561200000&bg=ffffff&guid=ON&async=1&gtm=45be41a0v9102692410&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Fmaralagotruth121923%2F%3F_raclid%3Db4212e52-bcdc-4ad7-a293-7b6dcaab8e47%26utm_content%3Dst188%26utm_medium%3Dad%26utm_source%3Dci_d_truth&frm=0&tiba=Trump%202024&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_xyh8LDON7vyFrAY7invEdZ03E4aZ-Q8TZaW8XEUlIJKJlMnd&random=3193942565&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 07:40:12 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 hsw.js Show response
newassets.hcaptcha.com/c/3a84c15/ Frame 278F 506 KB
220 KB 83ms
83ms Script
application/javascript 104.19.219.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/c/3a84c15/hsw.js

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/2a00369/hcaptcha.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bb1fc509673c7bfa18deea5a1fab54ca33fb84b961a46a32f27f5e595b9630a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://newassets.hcaptcha.com/captcha/v1/2a00369/static/hcaptcha.html?_v=lqlnua4kcjd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:40:12 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 981fd743d9643ae0100d9c3fcfb96f78.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: WxGex9z4fR9K3hI3pY622MyGuT5HJV8e
age: 115821
x-amz-cf-pop: YUL62-C2
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 09 Jan 2024 17:07:55 GMT
server: cloudflare
etag: W/"22965986ade7ea3c1e439a2ed4224345"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3024000
cf-ray: 847530402ca536c7-YYZ
x-amz-cf-id: yDwsmNaFjHpY56e_lHndvA60bhzpgevEK5IclQ0eu8blwB90tzrdvg==

POST
H2 200 b Show response
r.stripe.com/ Frame 4457 0
273 B 192ms
192ms Fetch
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:12 GMT
x-stripe-server-envoy-start-time-us: 1705563612349361
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 4
x-stripe-client-envoy-start-time-us: 1705563612349127
access-control-allow-credentials: true
content-length: 0

POST
H2 200 463b917e-e264-403f-ad34-34af0ee10294 Show response
api.hcaptcha.com/getcaptcha/ Frame 278F 3 KB
2 KB 327ms
323ms XHR
application/json 104.19.219.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hcaptcha.com/getcaptcha/463b917e-e264-403f-ad34-34af0ee10294

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/2a00369/hcaptcha.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8e1785d6fefd8da049768e205ba24cfba39b23df35bd793399a87252e23561f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://newassets.hcaptcha.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Thu, 18 Jan 2024 07:40:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
server: cloudflare
vary: Origin, Accept-Encoding
content-type: application/json
access-control-allow-origin: https://newassets.hcaptcha.com
access-control-allow-credentials: true
cf-ray: 847530441e40548b-YYZ
alt-svc: h3=":443"; ma=86400

GET
H2 200 common.js Show response
maps.googleapis.com/maps-api-v3/api/js/55/8/ 254 KB
55 KB 130ms
129ms Script
text/javascript 2607:f8b0:4004:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/55/8/common.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5f Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435b672222ed7009a38928a3360d957a0d2142acf3cd037e6e17d6ccd7f9f8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:14:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1555
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56495
x-xss-protection: 0
last-modified: Wed, 17 Jan 2024 00:07:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 17 Jan 2025 07:14:18 GMT

GET
H2 200 util.js Show response
maps.googleapis.com/maps-api-v3/api/js/55/8/ 177 KB
55 KB 114ms
113ms Script
text/javascript 2607:f8b0:4004:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/55/8/util.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5f Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8d45c4a08c6e39e0e0283fbe0761a642a1391ee1362ad4cf36f51de702c2fd2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 05:43:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6983
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55764
x-xss-protection: 0
last-modified: Wed, 17 Jan 2024 00:07:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 17 Jan 2025 05:43:50 GMT

POST
H2 200 b Show response
r.stripe.com/ Frame 4457 0
273 B 192ms
191ms Fetch
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-6dd1441cf37f4a0448e75338cca8c002.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Thu, 18 Jan 2024 07:40:14 GMT
x-stripe-server-envoy-start-time-us: 1705563614228921
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1705563614228137
access-control-allow-credentials: true
content-length: 0

GET
H2 200 trusted-types-checker-efd8cf45ce422659c098993bfc62531b.js Show response
js.stripe.com/v3/fingerprinted/js/ 176 B
679 B 88ms
88ms Script
text/javascript 13.35.93.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/trusted-types-checker-efd8cf45ce422659c098993bfc62531b.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-43.jfk50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

07b6b3d899dd69c0e9eb463e23e10e30e82588eddf95d15d45bb505c6703a813

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:13:14 GMT
via: 1.1 9ad14e3f9b528d4215643d5af359b816.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 1626
x-amz-cf-pop: JFK50-P8
x-cache: Hit from cloudfront
content-length: 176
last-modified: Mon, 08 Jan 2024 21:41:58 GMT
server: Cloudfront
etag: "96f5b26d366f47393b3ff36fe7471474"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: WQvYuqlp1o6eCnRV4SDwd3-eyyq0RLUUvW740CuMCEFD-DVxRlG_IA==

Verdicts & Comments Add Verdict or Comment

59 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

32 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
app.winred.com/api/v3/users	1970-01-21 03:22:03	Name: rvid Value: a23f6536-a090-4216-a5f0-c4771c91cf64
.secure.winred.com/	1970-01-20 17:46:05	Name: __cf_bm Value: _Ws8M6tkzrOJte5Qs734PGnh2f71rxcvBcx.T7vYpx0-1705563606-1-AVvvRQdC+wgosYqVhBy7H7Cr08ub6rRJA1ryjD60G9vqiFIkLm4FyfFaRdxbHzf1Ut9kdP18qcApt48CDLp1774=
secure.winred.com/	1969-12-31 23:59:59	Name: origin_url Value: https://secure.winred.com/save-america-joint-fundraising-committee/maralagotruth121923/?_raclid=b4212e52-bcdc-4ad7-a293-7b6dcaab8e47&utm_content=st188&utm_medium=ad&utm_source=ci_d_truth
.winred.com/	1970-01-20 19:55:39	Name: _gcl_au Value: 1.1.1012720694.1705563608
.secure.winred.com/	1970-01-21 02:31:39	Name: cf_clearance Value: Zv.oYZiQJKbyOZVnrV77wR2amAzfyjtlO9gLuNmea2A-1705563608-1-AfRftx1KwADnREUUNrJJzqQmpcmFc98UXhoR8b+zVL9ApnZ4tspGjt+GEfk26d8nKZp3srMFol57Fz7/LICk8nI=
.winred.com/	1969-12-31 23:59:59	Name: _revv_v3_session Value: bmlqUGJBdGhucEpNbjB1Nm9MRHFDcWhFZU5TQ2VyT0FTL2xoSXFoQURrdFFFdjV4a2FSUURYVWpZSnQ3K3g2UEttczgyOWVONFNKa3ZHMkIrMzFjRFZVWlF2aENJTXlSd2JFZFQwaWFmR3BTZ2E1c2FkSlNVckhON0lwOWtCSXZJYkNXVUhTMjUyNy90dGUxdFcwdnVtMTRsY0s2MzV3RXN0eWtMNGgzVGxMNFd0VW03VGYyWDJDY3ptT3JzNUhZcVg4RU1wc3lDRVdtUWlQdU5jV3p6ak9BSHlWUFUva1VVQWNCVXM3Lzg1UUxRNGhXSW9HeEQvWEEvMkFDYUF5bTIrdmx5VzQrWlFtRkVZSDZHQ2RkeUd0SFArcjlHalpnTi9UcVdabGFPaW1paU1vZlRHUmxESlVvWWthd0VSMWJBcGVJeFhveUZWMEZMcEc4T1dVUFN6VFJwbXVJa1VISTQ3MC9TQjVzSnI4PS0tbzhIb3Bxc21Sc0IxbmxkVWZSZ0pKdz09--4f763a90ba14cc3f32062a335223a3ce58b10736
secure.winred.com/	1969-12-31 23:59:59	Name: sso_tries Value: 1
secure.winred.com/	1970-01-21 03:22:03	Name: rvid Value: a23f6536-a090-4216-a5f0-c4771c91cf64
.winred.com/	1970-01-21 03:22:03	Name: _ga_X6H0114PDF Value: GS1.1.1705563608.1.0.1705563608.0.0.0
.winred.com/	1970-01-21 03:22:03	Name: _ga_0YWKLMCX4D Value: GS1.1.1705563608.1.0.1705563608.0.0.0
secure.winred.com/	1970-01-20 20:10:00	Name: _cids Value: W3siYyI6ImI0MjEyZTUyLWJjZGMtNGFkNy1hMjkzLTdiNmRjYWFiOGU0NyIsIngiOjE3MTMzMzk2MDl9XQ==
.winred.com/	1970-01-21 03:22:03	Name: _ga Value: GA1.2.1232550333.1705563609
.winred.com/	1970-01-20 17:47:30	Name: _gid Value: GA1.2.156899792.1705563609
.winred.com/	1970-01-20 17:46:03	Name: _gat_UA-60901920-1 Value: 1
.winred.com/	1970-01-20 17:46:03	Name: _dc_gtm_UA-73658561-7 Value: 1
.winred.com/	1970-01-21 03:22:03	Name: FPID Value: FPID2.2.trSxgVntKDjQbOF7RCbvsrbnaQY4gxA8gDaLedFfiwE%3D.1705563609
.winred.com/	1970-01-20 17:47:15	Name: FPLC Value: t68pwjcf4sCVQgUCI43U8yg%2BYB9A6uAK5rHdCDaYMacRAxv9PN3eVokz3Gnps1pu38G4XIYZdfao0UvKcUZe4TNqqPwdzMvIIHkns8xOAgUeOdq1BwVV7s%2FiuDSkVg%3D%3D
.winred.com/	1970-01-20 17:46:05	Name: FPGSID Value: 1.1705563609.1705563609.G-X6H0114PDF.AkTW4SCo9mtdEIIAI8LM4g
.winred.com/	1970-01-20 19:55:39	Name: _fbp Value: fb.1.1705563609471.667709939
.twitter.com/	1970-01-21 03:22:03	Name: guest_id_marketing Value: v1%3A170556360952558560
.twitter.com/	1970-01-21 03:22:03	Name: guest_id_ads Value: v1%3A170556360952558560
.twitter.com/	1970-01-21 03:22:03	Name: personalization_id Value: "v1_NH4cpq67zwwu2oel6RwuZg=="
.twitter.com/	1970-01-21 03:22:03	Name: guest_id Value: v1%3A170556360952558560
.t.co/	1970-01-21 03:22:03	Name: muc_ads Value: 9b87654f-1699-490d-9100-0bcb78ef5304
.winred.com/	1970-01-21 03:22:03	Name: _ga_HNR33QTX08 Value: GS1.2.1705563609.1.0.1705563609.60.0.0
m.stripe.com/	1970-01-21 03:22:03	Name: m Value: 1864cfa3-19eb-43e8-8b00-09a08a6fa93d1e5de0
.secure.winred.com/	1970-01-21 02:31:39	Name: __stripe_mid Value: 97fec411-ef49-4587-bb9f-905af264712dba1cbe
.secure.winred.com/	1970-01-20 17:46:05	Name: __stripe_sid Value: 7d489fa7-6b10-49c0-a34f-79822e1de074bbc5bc
.google.com/	1970-01-20 22:09:34	Name: NID Value: 511=I9fyKhEmCFBVxb55zvSr1ovIOBspHnYSpJ5KZ1rgdLlaPKEUdeL026HZ8pGKc3QaJ1pukxK1mJfVQLvA2dSETVp8tt-KNY98V6K72XToE4rycUoc_9-AKZMeMbNbY5Nv3n054vU2bf8qzq6JVt7lGchrpESP7QMIuvwd4bElR8U
.doubleclick.net/	1970-01-21 03:22:03	Name: IDE Value: AHWqTUnsw9M3h6B0LOMr8vGYEv4BOxnJJuN_-9LNbbAysV3e4mwzhyqdcXszqj0c
api2.hcaptcha.com/	1970-01-20 17:46:05	Name: __cflb Value: 0H28vk2VKwPbLoawFincekpozDKK5F2cp8KtdnLcZUh
api.hcaptcha.com/	1970-01-20 18:29:15	Name: hmt_id Value: f1ae741c-5d26-4938-bde2-d20fdbeee2a7

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' https://pay.google.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".
security	error	(Line 6) Message: This document requires 'TrustedScript' assignment.
network	error	URL: https://pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/cspreport Message: Failed to load resource: the server responded with a status of 404 ()
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9381094.fls.doubleclick.net
a-delivery.rmbl.ws
a.ads.rmbl.ws
adservice.google.ca
adservice.google.com
analytics.google.com
analytics.twitter.com
api.hcaptcha.com
api2.hcaptcha.com
app.winred.com
b.stripecdn.com
cdn.nucleusfiles.com
connect.facebook.net
d35ligi1n5bgzc.cloudfront.net
googleads.g.doubleclick.net
gtm.winred.com
hcaptcha.com
js.stripe.com
m.stripe.com
m.stripe.network
maps.googleapis.com
merchant-ui-api.stripe.com
newassets.hcaptcha.com
pay.google.com
play.google.com
q.stripe.com
r.stripe.com
secure.winred.com
static.ads-twitter.com
static.cloudflareinsights.com
stats.g.doubleclick.net
t.co
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googletagmanager.com
www.gstatic.com
104.19.219.90
104.244.42.133
104.244.42.3
13.35.93.43
142.251.16.149
146.75.28.157
151.101.64.176
172.98.56.41
198.137.150.201
2001:4860:4802:32::181
2600:9000:21da:3600:b:1d09:f200:93a1
2600:9000:26fa:c00:0:7d26:ee00:93a1
2606:4700:3037::ac43:8758
2606:4700::6810:3865
2606:4700::6810:fa45
2606:4700::6813:d459
2607:f8b0:4004:c06::71
2607:f8b0:4004:c07::93
2607:f8b0:4004:c08::5c
2607:f8b0:4004:c08::5e
2607:f8b0:4004:c08::61
2607:f8b0:4004:c08::9a
2607:f8b0:4004:c09::5e
2607:f8b0:4004:c09::5f
2607:f8b0:4004:c09::8a
2607:f8b0:4004:c09::9a
2607:f8b0:4004:c17::9d
2a03:2880:f003:c0e:face:b00c:0:3
2a03:2880:f103:83:face:b00c:0:25de
34.211.13.104
38.70.189.71
54.187.119.242
007b4be1404b0f21a158fa83a2ae9375393b2d932a17e9745aa392fcadc7cf2f
0205063075c34d68e5ed29db53ce37570b3369cd91b5c4e5ab15bfaae0fd9412
042e2de0cb5720f25c17d0c9d40fbf5d1a5711c3e5e275ca939a36298e69117a
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
06f2b08df8287c36897c409e0776bc5cc13d0e78fb5d6f927cf1c54069ceae02
07b6b3d899dd69c0e9eb463e23e10e30e82588eddf95d15d45bb505c6703a813
0c9cc88c27618b01e95063377382195b9062bdbef5eb1687e5881d3f318dbe63
0e3de16d530f4634a1ad26ed8151bbea4d2c48c3b5e942d711caa37668060099
0f0af8590adca51f917493212d5f1c2cb6041751c2b21d387eb3d36f0065e7a4
134abba498d6db213aa8db194004f1be5b17ce68bbed4f51ffbd63bcb637dbe2
13a8879b1f42490a44ee1e591f57d6a296d0f0c3f9a6ec4a26cbbd8e635a5736
18afce2482e80c281355f73655f8b8ef61eba649c06277dae589291145e43662
195286a33cabaa8f3b0c747f0df4b0805c26a81719f1c5e1fa56d177eac8688d
1bb8affc0ad0f6449490148a0ec45435d64f1494b92ad385f266b9b86d7aa076
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1d7d7f58ee047dd90687d45bca4ee0ca563d50e08ce568472a4d9080a3e65026
1df19255b4b07c13647377049a5d3d4b23519c012b91e923ee22cf18c4e8d2b2
207f8c2a000504f9d1bf6b7021ea01252684ad378ac34a6b905e03e1fcd94a4d
23537e4949904f154a942db3bd14074fa1f5e98f9bb824209e24d2e04862f0c7
247a74c5584350ea1cac5af52c1bfca8b6d4730d019610086c076c6993d05413
2abc1b2af4ad732ef26f0a7f5f6bb8db1a4ec821dfafc07c0613de05d6d5ccad
34da31ab5500ec421e5ce0f484140984a62f91334934c0f3a5160304c7c48db6
35dcc382eb69d00369d708708cdc545f3968b68fa5bbe3e728d11fedd04f93bb
36f0bf882a876b13aeb20cf7a495421a43f336da5422072a58f58ce303fb6284
394724ca0118829643c12fb5a033cb66680e51327ba157677d18dec209278a3d
3cef5d81369ac39c8da814762cdcf2fb00d65bb98baa70776223ddd289c6c014
3f534a74830530483c1dd97b3689ee418a6499b5d0925aa9f009ffcfcc317fe7
42fa6c755c6427833572147096b10125f7dd9f965e0bbc45763625e08f80f016
435b672222ed7009a38928a3360d957a0d2142acf3cd037e6e17d6ccd7f9f8af
4478451f5d1bee368021a4e0473c1ba6bdc1818449dd0f0e14600ecb4482431e
46cd9da62e48758019033efbd0cb8adcc8818f42ef4dea6c83efc0063d2f093a
46ec86e0d317a4ca8f66eae2f92e3477c7c5d1e77bceaa714e8722280a8ca051
4ea3ccf90fbeb832933a644e78bbcab350b1e7d7601be53af4626242aee8ef73
4ec0827f796bdadb833f52dd7ea841e12158d9f488554ecb73479cc2ea6f6d8e
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
5033e337e474e5d2818fee21b093eaef81d5f545fd49b5f635b3e1160fa83abe
5632bd20dacf65fbd2510d0c97c4312a163ed00a7654d7111655752a05b426a6
56c275580c205b0eb6b834258881ae4d17c21541c559fb2e217e2e2d43f921b0
56cb4038ca01d49b498f6c3839ecaf7ac3b4b6a16e9921d54ad7e2d15b8148ed
5b93ff2894a22e45fa8ab3e7ac246ba1c7f1ca4a4b772ecd0734a062091ae0c4
5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848
6037734d0ad3dd7b2f31955aeeb4b34e2316f726e1bd884d7dbc979649570049
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
621661fe1c7a59420c624f7a421c566ebfb38cfbc7edd98ee0462c44d15971f9
63293d7cb7e2db4b24a51f81bcf1946d5a9a516051a274997fcef446b9b7b7bd
641defe78e044cbd72e13110f131016fc26c1e8b00ef29ad142e177a0e54bfe1
6abd8c4f912b4d2c7eeda9cc264ee88a8295593cffa9a10d4892415c8085b6e8
706a130e25def3f112db1bf34d2ff316d5c1336e196842d19382532afc568e94
71cb66aea504951c7d2499622f35a263da91af2fd72b6efd2889657da0e8b817
81565c8e33a496d37dc653c1984dbd43cb4b685b0d098ada183c9d963b081fee
81a6832550bd52d1c44e1e63c2d9137a441dd53d31302c3070000403d032b012
82ac8af55974ba6e08e9c87df6570ee2eed15b1225514a72c32ebe561a51a6bd
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8558280cb8380c97c03bab6c04fde3ab096c1a93bcfb3709d610590218052672
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
8d45c4a08c6e39e0e0283fbe0761a642a1391ee1362ad4cf36f51de702c2fd2f
8e1785d6fefd8da049768e205ba24cfba39b23df35bd793399a87252e23561f1
947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1
961951e588ed2cbd0dadda321becf5c4d27451bb0896262f86e7d922da5794ca
9cb95be59a1f120f8246937993d18e8f52ac97673a7f2eab174f7b89d657415d
9f17a2750b4df3a97edb460c44c84ac73606e96aa2d96e5cdc18505ff8a526b6
a3ba43aa269ba38b1b1053f8835d26ac13e5d648d75179b5edff178837abd8f1
a90492ff833ba2c9260fb83307882241e32afa818d4cc865a90b0442050dd92a
ab5896c4f28152942b089d685fefcb1ab59c91c345b73a44da1d416119124ab9
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad1ba8a0bf7fd330eaea3ed9824a33f41a1104812188f3bcff5b388b66537799
ad4c6f0dd9bd0f97380702191b82e786d3eb9f552f2650c15d73e390d3557403
b13ac5db06aaef364bbea670ddcd08f23abd89018ced6134df333c0b35251afc
b2c9879acadc56c88c28bd34bcb37273b87a0f3724d61385d596c5cef7e9f822
b937209845ab8f20d6ced84d5486ff20cb4c8d754f13b26463519ed1c9731edb
ba2338aa6670580269c762f51c4291daef913201aa8f4d4fd166c1a878262652
bb1fc509673c7bfa18deea5a1fab54ca33fb84b961a46a32f27f5e595b9630a3
bf15413499b81555136c08dd340efaf4b00a8eb7ac1067d558e70bf6fbbfb07f
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cd4c2cce4e42a2c7aefa661b49a52512335d33d54996bbf70b656db25d540ec1
cd6490f733f584b4e012708c33830a3ad79c2efac2e310af491cd38b74ffbd26
ce16b2489366f391f28ea29c8a8cbd56b90985c6db5e1b69ab6772b07b2161af
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d2720171709824c6e0a9f8756ab5ecc53c8427980a68255a51daa59c401512ec
d6ff339ddb4525268c21fa26ded66b0703f177e742281dc9bcd558288f8e1101
d92d1e4f2fc616480eb4e1df82c44cac0ca401ae0adad5b3b69f05d0cf33f5f3
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
decb67735d60421da8f1a0d1e91f7eadcf501ebb8d8058992ad2c85bb2dd7f36
e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e76ee05d1cbc130b3ad2dcf446fc445dbe1f59f16c00533ffa91eb2dd4966567
ed80804c791a1a3b8d7f86bbbdcb0fa653f2aa9679b585e7d259aa63cce1073a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0aed7241eba2494db2bb05093be566589b0a9a6dcd5846446db8f078d556356
f4d2decc94ce07732aad41b68bf98f9baa81591bb7584f75d6ec20831440b2ff

secure.winred.com Open in urlscan Pro 2606:4700::6813:d459 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

174 Requests

99 %HTTPS

63 %IPv6

21 Domains

38 Subdomains

31 IPs

3 Countries

4440 kBTransfer

14634 kBSize

32 Cookies

10 Outgoing links

Page URL History

Redirected requests

174 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

secure.winred.com Open in urlscan Pro
2606:4700::6813:d459 Public Scan

Screenshot
Live screenshot

Full Image

174
Requests

99 %
HTTPS

63 %
IPv6

21
Domains

38
Subdomains

31
IPs

3
Countries

4440 kB
Transfer

14634 kB
Size

32
Cookies

174 HTTP transactions
0 data transactions