secure.winred.com Open in urlscan Pro
2606:4700::6812:9c15 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://click.campaigns.rnchq.com/?qs=fae92772902f5f9ab4e8d37b4a73a97c4592d4544f706bb3166ffc962e6c1ae646f7c162d73f87c149bdda1dca95...
Effective URL:
https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&a...
Submission: On December 06 via api (December 6th 2021, 4:04:17 pm UTC) from CA — Scanned from CA

Summary HTTP 157 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 26 IPs in 1 countries across 18 domains to perform 157 HTTP transactions. The main IP is 2606:4700::6812:9c15, located in United States and belongs to CLOUDFLARENET, US. The main domain is secure.winred.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on October 5th 2021. Valid for: a year.

This is the only time secure.winred.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	13.111.145.38 13.111.145.38	22606 (EXACT-7) (EXACT-7)
11	2606:4700::68... 2606:4700::6812:9c15	13335 (CLOUDFLAR...) (CLOUDFLARENET)
27	13.225.214.95 13.225.214.95	16509 (AMAZON-02) (AMAZON-02)
4	2607:f8b0:400... 2607:f8b0:4006:823::200a	15169 (GOOGLE) (GOOGLE)
4	13.225.63.38 13.225.63.38	16509 (AMAZON-02) (AMAZON-02)
4	2607:f8b0:400... 2607:f8b0:4006:809::2008	15169 (GOOGLE) (GOOGLE)
1	69.192.26.112 69.192.26.112	16625 (AKAMAI-AS) (AKAMAI-AS)
1	69.192.20.36 69.192.20.36	16625 (AKAMAI-AS) (AKAMAI-AS)
6	23.208.216.220 23.208.216.220	16625 (AKAMAI-AS) (AKAMAI-AS)
41	54.187.159.182 54.187.159.182	16509 (AMAZON-02) (AMAZON-02)
21	2607:f8b0:400... 2607:f8b0:4006:807::200e	15169 (GOOGLE) (GOOGLE)
1 3	142.250.80.38 142.250.80.38	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f01... 2a03:2880:f012:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
4	2607:f8b0:400... 2607:f8b0:400d:c08::5c	15169 (GOOGLE) (GOOGLE)
2	2600:9000:21e... 2600:9000:21ea:5800:19:7d10:bd80:93a1	16509 (AMAZON-02) (AMAZON-02)
1 1	142.250.65.194 142.250.65.194	15169 (GOOGLE) (GOOGLE)
3	52.54.252.147 52.54.252.147	14618 (AMAZON-AES) (AMAZON-AES)
1	2607:f8b0:400... 2607:f8b0:4006:808::2002	15169 (GOOGLE) (GOOGLE)
1	52.21.82.71 52.21.82.71	14618 (AMAZON-AES) (AMAZON-AES)
5	2607:f8b0:400... 2607:f8b0:4006:80b::2003	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:402... 2607:f8b0:4023:1404::9c	15169 (GOOGLE) (GOOGLE)
1	52.88.27.164 52.88.27.164	16509 (AMAZON-02) (AMAZON-02)
5	2a03:2880:f11... 2a03:2880:f112:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2607:f8b0:400... 2607:f8b0:4006:80b::2004	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:81e::2003	15169 (GOOGLE) (GOOGLE)
1	142.250.81.226 142.250.81.226	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:80c::2002	15169 (GOOGLE) (GOOGLE)
1	34.225.233.122 34.225.233.122	14618 (AMAZON-AES) (AMAZON-AES)
157	26

1 13.111.145.38 (United States) 1 redirects

ASN22606 (EXACT-7, US)
PTR: click.campaigns.rnchq.com

click.campaigns.rnchq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700::6812:9c15 (United States)

ASN13335 (CLOUDFLARENET, US)

secure.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 13.225.214.95 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-214-95.ewr50.r.cloudfront.net

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:823::200a (United States)

ASN15169 (GOOGLE, US)

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.225.63.38 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-63-38.ewr53.r.cloudfront.net

d35ligi1n5bgzc.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:809::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.192.26.112 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a69-192-26-112.deploy.static.akamaitechnologies.com

cdn-pci.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.192.20.36 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a69-192-20-36.deploy.static.akamaitechnologies.com

a8416096648.cdn-pci.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 23.208.216.220 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-208-216-220.deploy.static.akamaitechnologies.com

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

41 54.187.159.182 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ip-54-187-159-182.stripe.com

q.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2607:f8b0:4006:807::200e (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
play.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.80.38 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s34-in-f6.1e100.net

9323526.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f012:8:face:b00c:0:1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:400d:c08::5c (Morganton, United States)

ASN15169 (GOOGLE, US)

pay.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:21ea:5800:19:7d10:bd80:93a1 (United States)

ASN16509 (AMAZON-02, US)

m.stripe.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.65.194 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s72-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.54.252.147 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-54-252-147.compute-1.amazonaws.com

datacloud.tealiumiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
collect.tealiumiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:808::2002 (United States)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.21.82.71 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-21-82-71.compute-1.amazonaws.com

visitor-service-us-east-1.tealiumiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:80b::2003 (United States)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4023:1404::9c (Columbus, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.88.27.164 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-88-27-164.us-west-2.compute.amazonaws.com

m.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a03:2880:f112:83:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80b::2004 (United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:81e::2003 (United States)

ASN15169 (GOOGLE, US)

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.81.226 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s74-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80c::2002 (United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.225.233.122 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-225-233-122.compute-1.amazonaws.com

logx.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
69	stripe.com js.stripe.com q.stripe.com r.stripe.com m.stripe.com	794 KB
20	google.com pay.google.com adservice.google.com www.google.com play.google.com	378 KB
11	winred.com secure.winred.com app.winred.com	253 KB
8	google-analytics.com www.google-analytics.com	116 KB
7	doubleclick.net 2 redirects 9323526.fls.doubleclick.net cm.g.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net	4 KB
6	tiqcdn.com tags.tiqcdn.com	22 KB
5	facebook.com www.facebook.com	864 B
5	gstatic.com www.gstatic.com	103 KB
4	tealiumiq.com datacloud.tealiumiq.com collect.tealiumiq.com visitor-service-us-east-1.tealiumiq.com	3 KB
4	facebook.net connect.facebook.net	202 KB
4	googletagmanager.com www.googletagmanager.com	217 KB
4	cloudfront.net d35ligi1n5bgzc.cloudfront.net	494 KB
4	googleapis.com maps.googleapis.com	169 KB
3	optimizely.com cdn-pci.optimizely.com a8416096648.cdn-pci.optimizely.com logx.optimizely.com	110 KB
2	google.ca www.google.ca	565 B
2	stripe.network m.stripe.network	16 KB
1	googleadservices.com www.googleadservices.com	14 KB
1	rnchq.com 1 redirects click.campaigns.rnchq.com	507 B
157	18

	Domain	Requested by
32	r.stripe.com	js.stripe.com
27	js.stripe.com	secure.winred.com js.stripe.com
13	play.google.com	www.gstatic.com
10	secure.winred.com	secure.winred.com
9	q.stripe.com	secure.winred.com
8	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com secure.winred.com www.gstatic.com
6	tags.tiqcdn.com	secure.winred.com tags.tiqcdn.com
5	www.facebook.com	secure.winred.com
5	www.gstatic.com	pay.google.com www.gstatic.com
4	pay.google.com	js.stripe.com pay.google.com secure.winred.com www.gstatic.com
4	connect.facebook.net	secure.winred.com connect.facebook.net
4	www.googletagmanager.com	secure.winred.com www.googletagmanager.com
4	d35ligi1n5bgzc.cloudfront.net	secure.winred.com
4	maps.googleapis.com	secure.winred.com maps.googleapis.com
3	9323526.fls.doubleclick.net	1 redirects www.googletagmanager.com secure.winred.com
2	www.google.ca	secure.winred.com
2	www.google.com	secure.winred.com
2	stats.g.doubleclick.net	www.google-analytics.com
2	collect.tealiumiq.com	tags.tiqcdn.com
2	m.stripe.network	js.stripe.com m.stripe.network
1	logx.optimizely.com	cdn-pci.optimizely.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	www.googleadservices.com	www.googletagmanager.com
1	m.stripe.com	m.stripe.network
1	visitor-service-us-east-1.tealiumiq.com	tags.tiqcdn.com
1	adservice.google.com	9323526.fls.doubleclick.net
1	datacloud.tealiumiq.com	secure.winred.com
1	cm.g.doubleclick.net	1 redirects
1	app.winred.com	secure.winred.com
1	a8416096648.cdn-pci.optimizely.com	cdn-pci.optimizely.com
1	cdn-pci.optimizely.com	secure.winred.com
1	click.campaigns.rnchq.com	1 redirects
157	32

This site contains links to these domains. Also see Links.

Domain
winred.com
www.80810-info.com
www.gop.com

Subject Issuer	Validity	Valid
www.winred.com DigiCert SHA2 Extended Validation Server CA	`2021-10-05` - `2022-10-26`	a year	crt.sh
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA	`2021-10-21` - `2022-02-02`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
cdn-pci.optimizely.com DigiCert SHA2 Secure Server CA	`2021-02-17` - `2022-02-21`	a year	crt.sh
*.cdn-pci.optimizely.com DigiCert SHA2 Secure Server CA	`2021-02-17` - `2022-02-21`	a year	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2021-04-19` - `2022-04-27`	a year	crt.sh
*.stripe.com DigiCert SHA2 Secure Server CA	`2021-09-08` - `2022-09-07`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-09-14` - `2021-12-13`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.tealiumiq.com Amazon	`2021-09-24` - `2022-10-23`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
m.stripe.com DigiCert TLS RSA SHA256 2020 CA1	`2021-10-20` - `2022-02-02`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.google.ca GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
logx.optimizely.com Amazon	`2021-08-23` - `2022-09-21`	a year	crt.sh

This page contains 14 frames:

Primary Page: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
Frame ID: 18D1DA1E161136BC136F07A82380373F
Requests: 60 HTTP requests in this frame

Frame: https://a8416096648.cdn-pci.optimizely.com/client_storage/a8416096648.html
Frame ID: FF667CE9D4D7C195988A72F66F938D68
Requests: 1 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-f7902241893e7a497417843cb15dc858.html
Frame ID: 7E4FA8B5C0E5A24AF52B5F1953BE8300
Requests: 3 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html
Frame ID: 5046E51C53A56A2DC8C6A92AEE53D264
Requests: 16 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html
Frame ID: 31EE032709856CB883C54050055E7650
Requests: 7 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html
Frame ID: 81C7DCB36B83607A9FD9EC68DC7B3510
Requests: 24 HTTP requests in this frame

Frame: https://js.stripe.com/v3/payment-request-inner-google-pay-60c82d552399a5dd4abfa20b710458c0.html
Frame ID: 7D623E737B3A30F352AEF0C21521A9A1
Requests: 5 HTTP requests in this frame

Frame: https://js.stripe.com/v3/payment-request-inner-browser-1c4bf5a6899d19fb1761d102cda7bcc6.html
Frame ID: 6A815A9496F7F22DF147E65313A74EDF
Requests: 4 HTTP requests in this frame

Frame: https://9323526.fls.doubleclick.net/activityi;dc_pre=CITts8HGz_QCFeUH0AQdcAwDOQ;src=9323526;type=landi0;cat=gop_d0;ord=4442037101237;gtm=2wgc10;auiddc=397441093.1638806649;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd
Frame ID: A5D77CA4E890A8D0822F8C6383A0756E
Requests: 2 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: BD9190BF9A4BBF8074C7ABB31E3C878D
Requests: 5 HTTP requests in this frame

Frame: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=
Frame ID: CD6CBAAFFF1030C03E9940D00BA04486
Requests: 16 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html
Frame ID: FDB742D3883A71076F3E868B8002F81A
Requests: 6 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 70DFF84F4B0223416A4F0EE7C105A60F
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: B0DB7B4AEE471FA6AA7489AF826BD1E3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Republican National Committee

Page URL History Show full URLs

https://click.campaigns.rnchq.com/?qs=fae92772902f5f9ab4e8d37b4a73a97c4592d4544f706bb3166ffc962e6c1ae646f7c162... HTTP 302
https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20... Page URL

Page Statistics

157
Requests

99 %
HTTPS

50 %
IPv6

18
Domains

32
Subdomains

26
IPs

1
Countries

2895 kB
Transfer

8665 kB
Size

23
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://winred.com/terms/donor-terms/
Title: terms of use

Search URL Search Domain Scan URL

URL: https://winred.com/privacy
Title: privacy policy

Search URL Search Domain Scan URL

URL: http://www.80810-info.com/
Title: www.80810-info.com

Search URL Search Domain Scan URL

URL: http://www.gop.com/
Title: www.gop.com

Search URL Search Domain Scan URL

URL: https://winred.com/
Title: Powered by

Search URL Search Domain Scan URL

URL: https://winred.com/about-our-ads/
Title: About Our Ads

Search URL Search Domain Scan URL

URL: https://winred.com/support/
Title: Questions about your charge? Go to our Support Center

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://click.campaigns.rnchq.com/?qs=fae92772902f5f9ab4e8d37b4a73a97c4592d4544f706bb3166ffc962e6c1ae646f7c162d73f87c149bdda1dca9572ad43931abdc2e0e150 HTTP 302
https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 40

https://9323526.fls.doubleclick.net/activityi;src=9323526;type=landi0;cat=gop_d0;ord=4442037101237;gtm=2wgc10;auiddc=397441093.1638806649;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd HTTP 302
https://9323526.fls.doubleclick.net/activityi;dc_pre=CITts8HGz_QCFeUH0AQdcAwDOQ;src=9323526;type=landi0;cat=gop_d0;ord=4442037101237;gtm=2wgc10;auiddc=397441093.1638806649;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd

Request Chain 60

https://cm.g.doubleclick.net/pixel?tealium_cookie_sync=true&google_nid=tealium_dmp&google_cm&tealium_vid=017d907cf87b0022f86f3fc608d203072014c06a00b08&tealium_account=gop&tealium_profile=main HTTP 302
https://datacloud.tealiumiq.com/vdata/i.gif?tealium_cookie_sync=true&tealium_vid=017d907cf87b0022f86f3fc608d203072014c06a00b08&tealium_account=gop&tealium_profile=main&google_gid=CAESENMJMJcjWiBs3UpQNQq1e_I&google_cver=1

157 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request trump-social-founding-supporters Show response
secure.winred.com/rnc/
Redirect Chain

https://click.campaigns.rnchq.com/?qs=fae92772902f5f9ab4e8d37b4a73a97c4592d4544f706bb3166ffc962e6c1ae646f7c162d73f87c149bdda1dca9572ad43931abdc2e0e150
https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_tr...

44 KB
13 KB

181ms
92ms

Document
text/html

2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91c43e87a8ba043009368fc55877ed7974db292737deb389ca07ddd7a26c815d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

date: Mon, 06 Dec 2021 16:04:08 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
cache-control: no-store, no-cache, must-revalidate, private, max-age=0
x-revv-cache: Hit from Revv
x-request-id: a90d4793-e3c2-4bd7-a597-c25814447a74
x-runtime: 0.023083
x-rack-cors: miss; no-origin
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6b96bf8fc8d2ca47-YUL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

Cache-Control: private
Content-Type: text/html; charset=utf-8
Location: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
Date: Mon, 06 Dec 2021 16:04:07 GMT
Connection: close
Content-Length: 493

GET
H2 200 / Show response
js.stripe.com/v3/ 268 KB
71 KB 85ms
23ms Script
application/javascript 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

3ed1f78a1ee89c913a730637376afbd17148beec7eca98ed43e46713bb585898

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 27
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:03:42 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Fri, 03 Dec 2021 23:13:39 GMT
server: Cloudfront
etag: W/"da8eae94c6390a2e9b43e620a7d73207"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: IWs_2ZyAxMd3g5habILQtivYWLQMqR-xh0yUMrTL4boQnrxD1jgEUg==

GET
H2 200 landing_page-4d8ad4ae71325632689399f3673f1196d135dd83520986c3531e8e646912ad13.css
secure.winred.com/assets/ 217 KB
34 KB 43ms
36ms Stylesheet
text/css 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/landing_page-4d8ad4ae71325632689399f3673f1196d135dd83520986c3531e8e646912ad13.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bbe935971411b547760ad22c28a55c7573abd06b49bcd13a361444dc94fa1c0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:08 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 549
cf-polished: origSize=225723
last-modified: Fri, 03 Dec 2021 01:43:59 GMT
strict-transport-security: max-age=0; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: 87Z32R0MDF838TXK
x-amz-id-2: bPoMTaa8DGvul/LUZyFNZQRxT7MYpF/7LdXksUnG3jwD+TSN7o/dIs8WsXQHGXW97w04RT8hwco=
cf-bgj: minify
server: cloudflare
etag: W/"9bd66b1efebd8bfddb9730e61146964c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
x-amz-version-id: tzVSTXYyLkLRTSTDBeRwPs8KVSDcmmSY
cf-ray: 6b96bf90899dca47-YUL
expires: Mon, 06 Dec 2021 20:04:08 GMT

GET
H2 200 1638551770.css
secure.winred.com/stylesheets/rv_page_01fm52qbrcp63q2sbneyd1jw28/ 8 KB
2 KB 55ms
48ms Stylesheet
text/css 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/stylesheets/rv_page_01fm52qbrcp63q2sbneyd1jw28/1638551770.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7297ef321f1b682622a9adacc3ada5ba2d6912115f57dd9948ffec18d33cb41

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-rack-cors: miss; no-origin
date: Mon, 06 Dec 2021 16:04:08 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 232324
cf-polished: origSize=8437
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 3c0d30eb-95f2-444f-a68c-877d1ce7f29f
x-runtime: 0.051315
expires: Tue, 06 Dec 2022 21:53:20 GMT
last-modified: Fri, 03 Dec 2021 17:25:47 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=31556952
cf-ray: 6b96bf9089a8ca47-YUL
cf-bgj: minify

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 154 KB
50 KB 103ms
51ms Script
text/javascript 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

mafe /

Resource Hash

18c33eea07a67aef897ec1cda0bee45cab46d25b88b98a875f010f51c2af3af8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:08 GMT
content-encoding: gzip
vary: Accept-Language
server: mafe
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
server-timing: gfet4t7; dur=20
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51189
x-xss-protection: 0
expires: Mon, 06 Dec 2021 16:34:08 GMT

GET
H2 200 application-landing-page-36cd0a6085201393f2fabbfa8313d174e8533225bd2d05c67cfcfa56a4ecae3a.js Show response
secure.winred.com/assets/ 612 KB
172 KB 63ms
58ms Script
application/javascript 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/application-landing-page-36cd0a6085201393f2fabbfa8313d174e8533225bd2d05c67cfcfa56a4ecae3a.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3f7fb4c1f2d3ee57a3767048afa62cdf8d4187c4f85ee32bdf91976c2bc72ad6

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:08 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 549
cf-polished: origSize=627317
last-modified: Fri, 03 Dec 2021 01:43:58 GMT
strict-transport-security: max-age=0; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: 87Z07885GEA9GYZ5
x-amz-id-2: C/S68yF8x+SELXUZUVaVp9IfxCwlqkAYC/GspMB4udQLIIPBWCOJyVgv82ziYJzuaOqh48kIQQc=
cf-bgj: minify
server: cloudflare
etag: W/"cbdde4319e62c173bcbb5df4621dfcbb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
x-amz-version-id: YktyhJTK4DpeR7OSNg_udb.E71SxF80Q
cf-ray: 6b96bf9089adca47-YUL
expires: Mon, 06 Dec 2021 20:04:08 GMT

GET
H3 200 api.js Show response
secure.winred.com/cdn-cgi/bm/cv/669835187/ 35 KB
9 KB 15ms
15ms Script
text/javascript 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/bm/cv/669835187/api.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
content-type: text/javascript
vary: Accept-Encoding
cache-control: max-age=604800, public
cf-ray: 6b96bf91cf1c4bcb-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 20210126_GOP_TMAGAC_EOM_Eom_Web_Pop-Ups_Jan-2021_V2-Nancy-Chuck_2450x1628_%281%29.png
d35ligi1n5bgzc.cloudfront.net/widget_images/images/000/072/089/medium/ 198 KB
199 KB 63ms
20ms Image
image/png 13.225.63.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/widget_images/images/000/072/089/medium/20210126_GOP_TMAGAC_EOM_Eom_Web_Pop-Ups_Jan-2021_V2-Nancy-Chuck_2450x1628_%281%29.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-38.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0330d92f80895c477e7bf33190ec17d06bc1a4eed429a65bc7384507855dc743

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id: s7tI8l7qLc_B4JRQEzxbHXJXvN2kOwdG
via: 1.1 42d3518040c55e24793897f7f5d5f342.cloudfront.net (CloudFront)
etag: "1fc1ef83ebd8473806455daa01ba93a9"
last-modified: Sat, 17 Jul 2021 13:08:16 GMT
server: AmazonS3
age: 14321
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
date: Mon, 06 Dec 2021 12:05:28 GMT
x-amz-cf-pop: EWR53-C1
accept-ranges: bytes
content-length: 202763
x-amz-cf-id: EsEgJN5rTsWUpVNNIJaJsyF2Y7beUC_PolJtu88QkgBkyf5G834NhA==

GET
H2 200 1200px-Republican_Disc.svg.png
d35ligi1n5bgzc.cloudfront.net/profiles/images/000/012/049/square/ 7 KB
8 KB 65ms
21ms Image
image/png 13.225.63.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/profiles/images/000/012/049/square/1200px-Republican_Disc.svg.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-38.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c885ef025f7d73741c3fae1f63830e9beec3f662f0ca17ea7746b534b34ac5d5

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id: gbL12paoPRxv210hmmexw4Iij5jW0Goh
via: 1.1 42d3518040c55e24793897f7f5d5f342.cloudfront.net (CloudFront)
etag: "7c98913b783795d6b02b742196b9a24a"
last-modified: Sat, 17 Jul 2021 18:30:39 GMT
server: AmazonS3
age: 14452
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
date: Mon, 06 Dec 2021 12:03:17 GMT
x-amz-cf-pop: EWR53-C1
accept-ranges: bytes
content-length: 7348
x-amz-cf-id: epUIG1fzn2hxilOmZ193pObaJif1oLnC5VCX63Kn93-_3H4qDTGxZQ==

GET
H3 200 win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.png
secure.winred.com/assets/ 9 KB
9 KB 31ms
30ms Image
image/webp 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36f0bf882a876b13aeb20cf7a495421a43f336da5422072a58f58ce303fb6284

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:08 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 6054
cf-polished: origFmt=png, origSize=11635
content-length: 8708
content-disposition: inline; filename="win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: A3FVF60T8JBSMA4A
x-amz-id-2: y3yq2fOiUgIRAL9BTbBy+q+ANVjEtGWeZZPcC9mPAT3O9JTNXVEGDcH7f1aHsSR5ykd3XX/kzYo=
expires: Mon, 06 Dec 2021 20:04:08 GMT
last-modified: Tue, 09 Nov 2021 03:32:15 GMT
server: cloudflare
etag: "972c0cca8d1e490484e89513f902e847"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
content-type: image/webp
vary: Accept
cache-control: public, max-age=14400
x-amz-version-id: VTcW9ork7TOvvSB02l.TGI7mplJh2Key
accept-ranges: bytes
cf-ray: 6b96bf921f8f4bcb-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg
secure.winred.com/assets/ 19 KB
8 KB 30ms
28ms Image
image/svg+xml 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:08 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 548
content-type: image/svg+xml
strict-transport-security: max-age=0; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: YVVF8GQKCV8N82S7
x-amz-id-2: 6UuSH/xU0Ig4KRJevmkT4XoSG69IjlNwJISDblCq+IFRmwtSaELtXbs1WxP7jcBMbMBekBC2kyc=
last-modified: Sun, 01 Aug 2021 04:38:40 GMT
server: cloudflare
etag: W/"d31530d4186af669daf4f47099614593"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: Mx.E1m3nz1bm4vsF8Q.JawodiIk.JRm8
cache-control: public, max-age=14400
cf-ray: 6b96bf922f914bcb-YUL
expires: Mon, 06 Dec 2021 20:04:08 GMT

GET
H3 200 email-decode.min.js Show response
secure.winred.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
960 B 14ms
14ms Script
application/javascript 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 01 Dec 2021 12:21:00 GMT
server: cloudflare
etag: W/"61a768ac-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
strict-transport-security: max-age=0; includeSubDomains
cf-ray: 6b96bf914e8e4bcb-YUL
vary: Accept-Encoding
expires: Wed, 08 Dec 2021 16:04:08 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 262 KB
63 KB 95ms
46ms Script
application/javascript 2607:f8b0:4006:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6b78480d93aa0cbde74c94673b0fdf29794f029bf8d5d516277874a8d3dd1002

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:08 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 63951
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 06 Dec 2021 16:04:08 GMT

GET
H2 200 8416096648.js Show response
cdn-pci.optimizely.com/js/ 421 KB
109 KB 71ms
19ms Script
text/javascript 69.192.26.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-pci.optimizely.com/js/8416096648.js
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 69.192.26.112 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-26-112.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 0c4d83d7ed629fcf090ecc239a585be39101f7237e8e45f68cfab655ff00d71a

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-amz-meta-pci_enabled: True
x-amz-version-id: FZv7Y0vG_r1MLd_cH84parTMbLEEiXj_
content-encoding: gzip
etag: "940eae59b1c9007134d9371ae76fac66"
x-amz-request-id: CKT0PQSVKEFV75BX
x-amz-meta-revision: 74566
x-amz-replication-status: PENDING
vary: Accept-Encoding
content-length: 110520
x-amz-id-2: cXv5piKjezetPbbbRdipbRZiZEVf833wXZAWCCLGiGR1MulcbvFcLHao8Oe6hAods41/wnfkUv8=
last-modified: Sun, 05 Dec 2021 23:42:30 GMT
server: AmazonS3
date: Mon, 06 Dec 2021 16:04:08 GMT
access-control-max-age: 86400
access-control-allow-methods: GET, HEAD
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-amz-meta-revision
cache-control: max-age=120
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: *

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 278 KB
80 KB 83ms
34ms Script
application/javascript 2607:f8b0:4006:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KQQBPQZ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bcbcb01150d080ba819cb712a93a7edb61a231f027a77308ea5ad900aa88005e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:08 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 81792
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 06 Dec 2021 16:04:08 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 62ms
36ms XHR
application/json 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
vary: Origin, X-Origin, Referer
content-length: 23
x-xss-protection: 0

GET
H2 200 20210719_GOP_2021_RNC-FUNDRAISING_GENERIC-WINRED-PETITION_TRUMP_EA-DESKTOP_VARIANT-3_2450X1628.jpg
d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/103/233/large/ 212 KB
213 KB 61ms
21ms Image
image/jpeg 13.225.63.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/103/233/large/20210719_GOP_2021_RNC-FUNDRAISING_GENERIC-WINRED-PETITION_TRUMP_EA-DESKTOP_VARIANT-3_2450X1628.jpg
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/stylesheets/rv_page_01fm52qbrcp63q2sbneyd1jw28/1638551770.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-38.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 75fb90521d1e7155f5aee298e5c171e0f2e536ec07208d07026bcc9eb7122915

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Sun, 05 Dec 2021 23:11:48 GMT
via: 1.1 42d3518040c55e24793897f7f5d5f342.cloudfront.net (CloudFront)
last-modified: Mon, 26 Jul 2021 23:12:54 GMT
server: AmazonS3
age: 60741
etag: "9850f1b559292e2f241f63a58a735aec"
x-cache: Hit from cloudfront
x-amz-version-id: HkcTIJ9zx4wXCPixj6m6o0kqQnoABBZH
x-amz-cf-pop: EWR53-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 217234
x-amz-cf-id: 6cYjBykhNleYlmsHDV-rlLmFv5FCdowax3hDK1wpJJ7-IzdJ-ygzzA==

GET
H2 200 a8416096648.html Show response
a8416096648.cdn-pci.optimizely.com/client_storage/ Frame FF66 2 KB
1 KB 108ms
25ms Document
text/html 69.192.20.36
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a8416096648.cdn-pci.optimizely.com/client_storage/a8416096648.html
Requested by: Host: cdn-pci.optimizely.com
URL: https://cdn-pci.optimizely.com/js/8416096648.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 69.192.20.36 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-20-36.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 19d2e43a96b539c5bfee8691baa248a6560e8bacd2bdc2350bc9f740af273a02

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

x-amz-id-2: 52ksQNhPUbL3lAi51xK9Wvn221C+xzWyodIU2c927oJbcFqwXw8N9Rj1C/Qj9y9C+oAXthPswJg=
x-amz-request-id: WC11KYGVM1399R23
x-amz-replication-status: COMPLETED
last-modified: Sun, 05 Dec 2021 23:41:57 GMT
etag: "babba104758b256b59a40b5b04e1c534"
x-amz-meta-pci_enabled: True
content-encoding: gzip
x-amz-version-id: 63SgUfGImE8zm1qsicPdUKTwIDVKYMJt
accept-ranges: bytes
content-type: text/html; charset=utf-8
server: AmazonS3
content-length: 891
vary: Accept-Encoding
cache-control: max-age=120
date: Mon, 06 Dec 2021 16:04:08 GMT

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/gop/main/prod/ 29 KB
9 KB 70ms
23ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 626e124aafce560a521c9ce7e4cc884ea850ad2ab2228389ebc02350bcda0e92

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:08 GMT
content-encoding: gzip
last-modified: Tue, 09 Jun 2020 18:29:15 GMT
server: AkamaiNetStorage
etag: "d3a4917f0b04f7f490bed307234c1b79:1591727355.318358"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=300
accept-ranges: bytes
content-length: 9387
expires: Mon, 06 Dec 2021 16:09:08 GMT

GET
H2 200 m-outer-f7902241893e7a497417843cb15dc858.html Show response
js.stripe.com/v3/ Frame 7E4F 240 B
958 B 22ms
20ms Document
text/html 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/m-outer-f7902241893e7a497417843cb15dc858.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

1969520bd7b0ea7b84b1cbdda4a8ae93c321abe6eaeff82b5fa496680bf88a0f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src https://m.stripe.network; img-src https://q.stripe.com; font-src 'none'; media-src 'none'; object-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 240
last-modified: Wed, 27 Oct 2021 22:19:31 GMT
accept-ranges: bytes
server: Cloudfront
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-security-policy: default-src 'self'; connect-src 'self' https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src https://m.stripe.network; img-src https://q.stripe.com; font-src 'none'; media-src 'none'; object-src 'none'; report-uri https://q.stripe.com/csp-report
timing-allow-origin: *
date: Mon, 06 Dec 2021 16:03:39 GMT
cache-control: max-age=60
etag: "f7902241893e7a497417843cb15dc858"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
x-amz-cf-id: BaR9mqYBiCa6Zo9lXjsrbJaijQ0qYVCcqgvTU3bndgmQ05Tkkn-dfA==
age: 29

GET
H2 200 controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html Show response
js.stripe.com/v3/ Frame 5046 349 B
1 KB 19ms
19ms Document
text/html 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

32d4644b89b4c67b6db6b306cadc64f32d9283a4edefb88d1c95bcd45694270d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 349
last-modified: Fri, 03 Dec 2021 22:47:13 GMT
accept-ranges: bytes
server: Cloudfront
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
timing-allow-origin: *
date: Mon, 06 Dec 2021 16:03:34 GMT
cache-control: max-age=60
etag: "4b2a0f6fa6eaf0d5f5e2c2d0b0102078"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
x-amz-cf-id: XwrpB-zTw4m4f3xcKEYG-bgoGX_L8uP7xJPW_D6kncGmOi6DkxejOg==
age: 34

GET
H2 200 elements-inner-card-378af023188ba17d45ed1ebc05831546.html Show response
js.stripe.com/v3/ Frame 31EE 6 KB
2 KB 20ms
19ms Document
text/html 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

02f6346535d658a846962a682488d1fdd568a1fff592036667d2d7a853511fe9

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
last-modified: Fri, 03 Dec 2021 22:47:20 GMT
server: Cloudfront
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
timing-allow-origin: *
content-encoding: gzip
date: Mon, 06 Dec 2021 16:04:06 GMT
cache-control: max-age=60
etag: W/"378af023188ba17d45ed1ebc05831546"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
x-amz-cf-id: Ktax_6__Sw_XHZEfL0bUChXGfHqzH0be-QTwrrEcqUzHacV8vgqdFw==
age: 4

GET
H2 200 current_with_info Show response
app.winred.com/api/v3/users/ 162 B
2 KB 90ms
89ms XHR
application/vnd.api+json 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.winred.com/api/v3/users/current_with_info?organization_token=rv_org_6KNvU36Z2qWJ2gfUBWqGZGoc&redirect=https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-36cd0a6085201393f2fabbfa8313d174e8533225bd2d05c67cfcfa56a4ecae3a.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8bddcca7513349f6d73c3fd3232c1e8966353005796e8e8ce8dd367898b4b7bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-rack-cors-original-access-control-allow-origin: https://secure.winred.com
date: Mon, 06 Dec 2021 16:04:08 GMT
x-rack-cors-original-access-control-max-age: 0
x-rack-cors-original-access-control-allow-credentials: true
cf-cache-status: DYNAMIC
x-rack-cors-original-access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 0
x-rack-cors-original-access-control-expose-headers
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-request-id: 3f9be7fb-3e83-4d3f-91c4-c1c12bd312fe
x-runtime: 0.010593
server: cloudflare
etag: W/"8bddcca7513349f6d73c3fd3232c1e89"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/vnd.api+json
access-control-allow-origin: https://secure.winred.com
vary: Origin
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
cf-ray: 6b96bf933c5eca47-YUL
x-rack-cors: hit
x-content-type-options: nosniff
access-control-expose-headers

POST
H3 201 live Show response
secure.winred.com/api/v3/donations/ 406 B
2 KB 159ms
149ms XHR
application/json 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/api/v3/donations/live

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-36cd0a6085201393f2fabbfa8313d174e8533225bd2d05c67cfcfa56a4ecae3a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

873cde696bd561fdcab804af4eb210ff5c5a1d2bad06130342b44072d33d249f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

X-CSRF-Token: 89tzC1lViap93xSVsdYXep8gVmAqr/ztFlWoPCMe3Vzz+bB4JqBLkvbudvmy7wcK6uA6LW9jf3p2ByQz/YnISA==
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
X-Requested-With: XMLHttpRequest
X-Revv-Apikey: cnZfb3JnX1R4blVmTW1ReFNtUlVGcDNxaEJ6bnhmNjo6Y1ZzbW9oUzE5bkxRVTVyK3RvL1Vydz09SHQzSERNSkhWUHBKcG85YnhhTDVnUFZvbHlmZW91WUxwaDdzT1IwRU8xSGNCK1AxcEVyK2tTWU5tSStCRzVxOE9UejBIZEpmMUV2NnFoMWEyTE9Fd01DK1hlTE9aa0J2L3VDL2dBRT0=

Response headers

x-rack-cors-original-access-control-allow-origin: https://secure.winred.com
date: Mon, 06 Dec 2021 16:04:08 GMT
x-rack-cors-original-access-control-max-age: 0
x-rack-cors-original-access-control-allow-credentials: true
cf-cache-status: DYNAMIC
x-rack-cors-original-access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 0
x-rack-cors-original-access-control-expose-headers
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-request-id: 5947abbe-216d-4654-ba11-47c9a278f72b
x-runtime: 0.084578
server: cloudflare
etag: W/"873cde696bd561fdcab804af4eb210ff"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://secure.winred.com
vary: Origin
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
cf-ray: 6b96bf9359174bcb-YUL
x-rack-cors: hit
x-content-type-options: nosniff
access-control-expose-headers

GET
H2 200 controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html Show response
js.stripe.com/v3/ Frame 81C7 349 B
1 KB 20ms
20ms Document
text/html 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

32d4644b89b4c67b6db6b306cadc64f32d9283a4edefb88d1c95bcd45694270d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 349
last-modified: Fri, 03 Dec 2021 22:47:13 GMT
accept-ranges: bytes
server: Cloudfront
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
timing-allow-origin: *
date: Mon, 06 Dec 2021 16:03:34 GMT
cache-control: max-age=60
etag: "4b2a0f6fa6eaf0d5f5e2c2d0b0102078"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
x-amz-cf-id: UpIy05MP20KfwkBmL8wxiosC7ktrgulwXbqrzGCT-XlaH1mwUbu5kQ==
age: 34

GET
H2 200 payment-request-inner-google-pay-60c82d552399a5dd4abfa20b710458c0.html Show response
js.stripe.com/v3/ Frame 7D62 434 B
1 KB 22ms
22ms Document
text/html 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/payment-request-inner-google-pay-60c82d552399a5dd4abfa20b710458c0.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

f0b6e7438d98877c3085761d380c763545784389620bbbc8254bd5e30e83a3eb

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://pay.google.com; script-src 'self' https://pay.google.com; style-src 'self' 'unsafe-inline'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 434
last-modified: Fri, 03 Dec 2021 22:47:20 GMT
accept-ranges: bytes
server: Cloudfront
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-security-policy: default-src 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://pay.google.com; script-src 'self' https://pay.google.com; style-src 'self' 'unsafe-inline'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; report-uri https://q.stripe.com/csp-report
timing-allow-origin: *
date: Mon, 06 Dec 2021 16:03:40 GMT
cache-control: max-age=60
etag: "60c82d552399a5dd4abfa20b710458c0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
x-amz-cf-id: hIEwpsZDCXe6KVnQ8DpVK40eWOYvPVMkWau1P9Vssgpf8_-_PelupA==
age: 35

GET
H2 200 payment-request-inner-browser-1c4bf5a6899d19fb1761d102cda7bcc6.html Show response
js.stripe.com/v3/ Frame 6A81 370 B
1 KB 21ms
20ms Document
text/html 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/payment-request-inner-browser-1c4bf5a6899d19fb1761d102cda7bcc6.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

5ebf765fb54f6bcbe0e6cd23a33c3096f26bb86aaa27f885e6d574ffe6a63114

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://pay.google.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 370
last-modified: Fri, 03 Dec 2021 22:47:13 GMT
accept-ranges: bytes
server: Cloudfront
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://pay.google.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
timing-allow-origin: *
date: Mon, 06 Dec 2021 16:03:43 GMT
cache-control: max-age=60
etag: "1c4bf5a6899d19fb1761d102cda7bcc6"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
x-amz-cf-id: ZsMPwfK722Zi4F6xYGaOpWE_R4CX0PEtC26O1IRoWbLH9qtKUTP58g==
age: 26

POST
H2 200 csp-report
q.stripe.com/ Frame 7E4F 0
348 B 579ms
387ms Other
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 293
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 5046 0
347 B 500ms
310ms Other
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 205
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 31EE 0
346 B 295ms
110ms Other
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 4
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 81C7 0
348 B 452ms
292ms Other
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 197
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 7D62 0
347 B 468ms
311ms Other
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 208
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 6A81 0
347 B 264ms
109ms Other
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 4
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

GET
H2 200 m-outer-639174098ea8fe7fede6fa654790e8ec.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 7E4F 1 KB
1 KB 23ms
22ms Script
application/javascript 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/m-outer-639174098ea8fe7fede6fa654790e8ec.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-f7902241893e7a497417843cb15dc858.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

6b5402ff8932ed835d39a31b75c6bc737a80f6ddcd6269a1fa53556485ca3ad8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/m-outer-f7902241893e7a497417843cb15dc858.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 22
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:03:46 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Mon, 25 Oct 2021 19:35:20 GMT
server: Cloudfront
etag: W/"5213886b88cd72e6d0aebc89868e5d13"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: QQo_ov7Pdm8xyGBTEr-4O7ncauwe9Mne0Y0ES_vyL0nZ0AMk0VPqdg==

GET
H2 200 shared-81d67bdc5b083df068e5c3ff7fb127b3.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 5046 197 KB
54 KB 24ms
23ms Script
application/javascript 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

dae3dcabf7b6ce492e82906c84bf1151d406eacbcd59ceaedaaa9e0819585c4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 31
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:03:39 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Fri, 03 Dec 2021 22:47:14 GMT
server: Cloudfront
etag: W/"5dfa4dd7157aaee1fd4068b2d01eebca"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: SxPkz08tZUKc2Qo8Nusw90UzOTv7l-ic-z0d_ouCKtXYgRtxMoM8Xg==

GET
H2 200 controller-757ad3cd84aa3526116ef1c0095afef2.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 5046 306 KB
85 KB 33ms
32ms Script
application/javascript 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/controller-757ad3cd84aa3526116ef1c0095afef2.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

b43f598121b061463cc62dba6ac8e7582d667eb35d8223b06a4ac933b447199c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 50
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:03:23 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Fri, 03 Dec 2021 22:47:14 GMT
server: Cloudfront
etag: W/"de903a6ff74c7ac43fc0a675bc111f3e"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: KtIP4l12oJ8dkoUA-KzNEPAiM9889wYd3bdaFcjKUB9cyrgGAJ6ZEQ==

GET
H2 200 ui-shared-46e93b3755a485133d7e5e7e1db48eaf.css
js.stripe.com/v3/fingerprinted/css/ Frame 31EE 15 KB
3 KB 36ms
35ms Stylesheet
text/css 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/ui-shared-46e93b3755a485133d7e5e7e1db48eaf.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

d9f33ed9fdd936a670993b9a8e6ca44e7a358d0f7b217b6c6638b502f66a8015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 27
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:03:47 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Wed, 03 Nov 2021 22:14:27 GMT
server: Cloudfront
etag: W/"7c0a4ba6a732ed01cc27774f97bbe8bd"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: XQzqtKVXVQpQpEimZJb6-cSgzLldXjhenZ3zP53-yeXnk2zMNPkNTg==

GET
H2 200 shared-81d67bdc5b083df068e5c3ff7fb127b3.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 31EE 197 KB
54 KB 37ms
36ms Script
application/javascript 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

dae3dcabf7b6ce492e82906c84bf1151d406eacbcd59ceaedaaa9e0819585c4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 31
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:03:39 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Fri, 03 Dec 2021 22:47:14 GMT
server: Cloudfront
etag: W/"5dfa4dd7157aaee1fd4068b2d01eebca"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: kniVnLBxGv6t3BUOxVEOR-c6HMCRyMZ2g9-8cebAx70Tc041hNWIBQ==

GET
H2 200 ui-shared-edf311672d554521839b8daa26afdc33.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 31EE 216 KB
66 KB 42ms
41ms Script
application/javascript 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/ui-shared-edf311672d554521839b8daa26afdc33.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

381ebeeec0644d9fcbfeb6d1f3b692cbecb1b020a4c2ce5a712887d7c652db42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 57
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:03:24 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Mon, 22 Nov 2021 23:04:51 GMT
server: Cloudfront
etag: W/"043c0ce9389f1c1479f40a32fa726309"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: fONJpU8IdEa_kkJUFVmDNfrBWn5e4SkJNtWRKsV4jeeuTbmf4b-ymA==

GET
H2 200 elements-inner-card-f168cb5e237dc04a5625532edb08f52d.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 31EE 46 KB
12 KB 43ms
43ms Script
application/javascript 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-card-f168cb5e237dc04a5625532edb08f52d.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

d0c4620ce8318742733f6d4b9ff6881018b9b2c51b2ae13f16dfc284461faa73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 23
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:03:47 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Thu, 18 Nov 2021 21:18:10 GMT
server: Cloudfront
etag: W/"64ac4bf7f6b6d9ed8cee940c632f347f"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: Olzk3LtrfOKwcgg4d9PatqjE_dxA9audAV0PdfUSbz0HjQWbjjAaAg==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 65ms
19ms Script
text/javascript 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KQQBPQZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 6134
date: Mon, 06 Dec 2021 14:21:55 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Mon, 06 Dec 2021 16:21:55 GMT

GET
H3

200

activityi;dc_pre=CITts8HGz_QCFeUH0AQdcAwDOQ;src=9323526;type=landi0;cat=gop_d0;ord=4442037101237;gtm=2wgc10;auiddc=397441093.1638806649;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-soci... Show response
9323526.fls.doubleclick.net/ Frame A5D7
Redirect Chain

https://9323526.fls.doubleclick.net/activityi;src=9323526;type=landi0;cat=gop_d0;ord=4442037101237;gtm=2wgc10;auiddc=397441093.1638806649;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-so...
https://9323526.fls.doubleclick.net/activityi;dc_pre=CITts8HGz_QCFeUH0AQdcAwDOQ;src=9323526;type=landi0;cat=gop_d0;ord=4442037101237;gtm=2wgc10;auiddc=397441093.1638806649;ps=1;~oref=https%3A%2F%2F...

754 B
538 B

87ms
60ms

Document
text/html

142.250.80.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9323526.fls.doubleclick.net/activityi;dc_pre=CITts8HGz_QCFeUH0AQdcAwDOQ;src=9323526;type=landi0;cat=gop_d0;ord=4442037101237;gtm=2wgc10;auiddc=397441093.1638806649;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KQQBPQZ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f6.1e100.net

Software

cafe /

Resource Hash

318234a3467765bba6d4307f1aa806ec04c7f24234739b99f59511be361be228

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: about:blank

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 06 Dec 2021 16:04:09 GMT
expires: Mon, 06 Dec 2021 16:04:09 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 513
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 06 Dec 2021 16:04:09 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://9323526.fls.doubleclick.net/activityi;dc_pre=CITts8HGz_QCFeUH0AQdcAwDOQ;src=9323526;type=landi0;cat=gop_d0;ord=4442037101237;gtm=2wgc10;auiddc=397441093.1638806649;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 87 KB
35 KB 61ms
35ms Script
application/javascript 2607:f8b0:4006:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-9323526

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KQQBPQZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:809::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0c971e6db21f464c3c85d6d37ac2d8f18008e66ec112c7891a00fdf721ab3a1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35939
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 06 Dec 2021 16:04:09 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
26 KB 61ms
20ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 25965
x-xss-protection: 0
pragma: public
x-fb-debug: heS4GNr0lEnDipITZWCNi1hfYaCOq5rOmKRU4JXGxJyLk9AueFC6dtyXNqE4c7sybLI4mw+BWfvPwULfrl5n6Q==
x-fb-trip-id: 1512268381
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Mon, 06 Dec 2021 16:04:09 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 activityi;register_conversion=1;src=9323526;type=landi0;cat=gop_d0;ord=4442037101237;gtm=2wgc10;auiddc=397441093.1638806649;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-...
9323526.fls.doubleclick.net/ 0
0 90ms
37ms Image
text/html 142.250.80.38
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://9323526.fls.doubleclick.net/activityi;register_conversion=1;src=9323526;type=landi0;cat=gop_d0;ord=4442037101237;gtm=2wgc10;auiddc=397441093.1638806649;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd?
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.80.38 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s34-in-f6.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H2 200 shared-81d67bdc5b083df068e5c3ff7fb127b3.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 81C7 197 KB
54 KB 22ms
20ms Script
application/javascript 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

dae3dcabf7b6ce492e82906c84bf1151d406eacbcd59ceaedaaa9e0819585c4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 32
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:03:39 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Fri, 03 Dec 2021 22:47:14 GMT
server: Cloudfront
etag: W/"5dfa4dd7157aaee1fd4068b2d01eebca"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: 6BwwETEGMy-Q2pMC3OeyiCuHfKrnDSuflGE8lLomKRa4gePqq6oEJw==

GET
H2 200 controller-757ad3cd84aa3526116ef1c0095afef2.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 81C7 306 KB
85 KB 23ms
22ms Script
application/javascript 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/controller-757ad3cd84aa3526116ef1c0095afef2.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

b43f598121b061463cc62dba6ac8e7582d667eb35d8223b06a4ac933b447199c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 51
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:03:23 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Fri, 03 Dec 2021 22:47:14 GMT
server: Cloudfront
etag: W/"de903a6ff74c7ac43fc0a675bc111f3e"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: aswxjkZRigWKq5X4cYOcBFsoPRwGOvVjfXdJKCshWuFk5a8tKkCg_Q==

GET
H2 200 pay.js Show response
pay.google.com/gp/p/js/ Frame 7D62 95 KB
31 KB 131ms
64ms Script
application/javascript 2607:f8b0:400d:c08::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/js/pay.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-60c82d552399a5dd4abfa20b710458c0.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c08::5c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

111f1700ccb35898fa18b3bbf8eb1d0b0f6e7f744cf9fa6e59e5a2723dd9f20f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-AmjudUPwgy1t76cBBi+2tw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'nonce-AmjudUPwgy1t76cBBi+2tw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private, max-age=600
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'report-sample' 'nonce-AmjudUPwgy1t76cBBi+2tw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'nonce-AmjudUPwgy1t76cBBi+2tw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Mon, 06 Dec 2021 16:04:09 GMT

GET
H2 200 shared-81d67bdc5b083df068e5c3ff7fb127b3.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 7D62 197 KB
54 KB 29ms
28ms Script
application/javascript 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-60c82d552399a5dd4abfa20b710458c0.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

dae3dcabf7b6ce492e82906c84bf1151d406eacbcd59ceaedaaa9e0819585c4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-google-pay-60c82d552399a5dd4abfa20b710458c0.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 32
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:03:39 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Fri, 03 Dec 2021 22:47:14 GMT
server: Cloudfront
etag: W/"5dfa4dd7157aaee1fd4068b2d01eebca"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: xTluSl-7aXfmvCMVIEFZScLetb4uJGoSY-Zcb8mO8CVav_btWWghFQ==

GET
H2 200 payment-request-inner-google-pay-4645f70b2486dff134650d5d522fad20.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 7D62 13 KB
5 KB 30ms
30ms Script
application/javascript 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/payment-request-inner-google-pay-4645f70b2486dff134650d5d522fad20.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-60c82d552399a5dd4abfa20b710458c0.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

032b2cd62ca53bd3edf67462afb364442044e4338d4eedf1269375bc238682d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-google-pay-60c82d552399a5dd4abfa20b710458c0.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: EWR50-C1
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:04:09 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Wed, 10 Nov 2021 20:01:25 GMT
server: Cloudfront
etag: W/"e54b5138e0469d998089f7239d6f9aeb"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
timing-allow-origin: *
x-amz-cf-id: Po_dQDfxwVHU6YqLVWDLy_1vKFs0gyoymUgI1lZUgqa88cAKtTwQXw==

GET
H2 200 shared-81d67bdc5b083df068e5c3ff7fb127b3.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 6A81 197 KB
54 KB 23ms
22ms Script
application/javascript 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-browser-1c4bf5a6899d19fb1761d102cda7bcc6.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

dae3dcabf7b6ce492e82906c84bf1151d406eacbcd59ceaedaaa9e0819585c4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-browser-1c4bf5a6899d19fb1761d102cda7bcc6.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 32
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:03:39 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Fri, 03 Dec 2021 22:47:14 GMT
server: Cloudfront
etag: W/"5dfa4dd7157aaee1fd4068b2d01eebca"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: E0dE799Q8tdJppr7qQzyAZV3NbIqUeZOL1GPBmk0NWPBZdHxaywhyg==

GET
H2 200 payment-request-inner-browser-f2a776258b5d03fabd63ccb663dcf89a.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 6A81 11 KB
5 KB 24ms
23ms Script
application/javascript 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/payment-request-inner-browser-f2a776258b5d03fabd63ccb663dcf89a.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-browser-1c4bf5a6899d19fb1761d102cda7bcc6.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

71a55578d53e666ef644669139972f47092d97114a67c8b251f155ef6c19c15d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-browser-1c4bf5a6899d19fb1761d102cda7bcc6.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: EWR50-C1
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:04:09 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Mon, 25 Oct 2021 19:35:22 GMT
server: Cloudfront
etag: W/"10d818482d8e44820136b10d6f9b02e4"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
timing-allow-origin: *
x-amz-cf-id: grZA_AMZIQp0p8JfIFgHuoEgY2E6fesU1LM3UzWS9b2QUoCuG3bI0w==

GET
H2 200 utag.39.js Show response
tags.tiqcdn.com/utag/gop/main/prod/ 3 KB
2 KB 24ms
23ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.39.js?utv=ut4.46.201909121401
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: af4b8dcbb0f1beb04e333fb40d352f763415cc15b83b6c79646d773c4d5893b6

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
content-encoding: gzip
last-modified: Thu, 12 Sep 2019 14:01:06 GMT
server: AkamaiNetStorage
etag: "0f7ae16a39aeb401a433557708bafd97:1568296866.396571"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1452
expires: Tue, 21 Dec 2021 16:04:09 GMT

GET
H2 200 utag.5.js Show response
tags.tiqcdn.com/utag/gop/main/prod/ 13 KB
4 KB 24ms
24ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.5.js?utv=ut4.46.201909102207
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 2646d818e258e85ba1721270d71684413d53dfa2dd8ac6957738d56a86ab1b5f

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
content-encoding: gzip
last-modified: Tue, 10 Sep 2019 22:07:42 GMT
server: AkamaiNetStorage
etag: "606a7fe5adc12f074e7ad290ea7644d9:1568153262.338063"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 4177
expires: Tue, 21 Dec 2021 16:04:09 GMT

GET
H2 200 utag.44.js Show response
tags.tiqcdn.com/utag/gop/main/prod/ 3 KB
1 KB 25ms
24ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.44.js?utv=ut4.46.202002071856
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 048ab7812899a24caacd50b1921fc17d5a3f7cd1fde2863d439a024a2245c6f8

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
content-encoding: gzip
last-modified: Fri, 07 Feb 2020 18:56:58 GMT
server: AkamaiNetStorage
etag: "624aec441dbcaae3f4aef04be799a630:1581101818.286578"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1190
expires: Tue, 21 Dec 2021 16:04:09 GMT

GET
H2 200 utag.45.js Show response
tags.tiqcdn.com/utag/gop/main/prod/ 14 KB
5 KB 25ms
25ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.45.js?utv=ut4.46.202006091829
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: aa920fa4fdea358365f980f78d82a992fa119070a07cb21d3aeee419d88429aa

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
content-encoding: gzip
last-modified: Tue, 09 Jun 2020 18:29:15 GMT
server: AkamaiNetStorage
etag: "598807775548ec7884f6579c1db8fbdb:1591727355.818648"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 4582
expires: Tue, 21 Dec 2021 16:04:09 GMT

GET
H2 200 inner.html Show response
m.stripe.network/ Frame BD91 932 B
2 KB 81ms
28ms Document
text/html 2600:9000:21ea:5800:19:7d10:bd80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/inner.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-639174098ea8fe7fede6fa654790e8ec.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21ea:5800:19:7d10:bd80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudfront /

Resource Hash

ed34a59f182c66e2b25c602f3c9b0f21435a8f475d5dbc9e6830ff4c7929f5cd

Security Headers

Name	Value
Content-Security-Policy	connect-src 'self' https://m.stripe.com; default-src 'self'; font-src data: https:; frame-src 'self' https://js.stripe.com; img-src 'self' https://m.stripe.com; media-src 'none'; object-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 932
last-modified: Thu, 04 Nov 2021 19:04:57 GMT
accept-ranges: bytes
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
x-content-type-options: nosniff
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://m.stripe.com; default-src 'none'; font-src 'self'; frame-src 'self' https://js.stripe.com; img-src 'self' https://m.stripe.com; script-src 'self' 'sha256-Qj6AdMOUjZkBBUTjGW/OORBoqx2Pohcq8Bg/ZvZzgYw='; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy: connect-src 'self' https://m.stripe.com; default-src 'self'; font-src data: https:; frame-src 'self' https://js.stripe.com; img-src 'self' https://m.stripe.com; media-src 'none'; object-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; report-uri https://q.stripe.com/csp-report
date: Mon, 06 Dec 2021 16:02:25 GMT
cache-control: max-age=300, public
etag: "f6254e6dd0cb06228801a1c8baf0939f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 90a990c5327e86ade86681120dc4a237.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
x-amz-cf-id: -IZo7qjy9FfExTKWn3rQuW42ols8K5Qc7mmwy6wBCdWeS9H0CwZW5Q==
age: 104

POST
H3 204 result Show response
secure.winred.com/cdn-cgi/bm/cv/ 0
535 B 15ms
15ms XHR
text/plain 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/bm/cv/result?req_id=6b96bf8fc8d2ca47

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/cdn-cgi/bm/cv/669835187/api.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/json

Response headers

strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
date: Mon, 06 Dec 2021 16:04:09 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-ray: 6b96bf957bcb4bcb-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 js Show response
www.google-analytics.com/gtm/ 129 KB
42 KB 66ms
40ms Script
application/javascript 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=OPT-NTPH8CG&t=gtm16&cid=43008973.1638806649

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fe47f6390f33e0175bdc61b16d8076a94a3fb8bc06b7fb3a7c9ba4aab0ff0afa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43378
x-xss-protection: 0
expires: Mon, 06 Dec 2021 16:04:09 GMT

POST
H2 200 0 Show response
r.stripe.com/ Frame 5046 0
213 B 98ms
97ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
content-length: 0

GET
H2 200 countryRanges-ed6f8980af15d82ca172d25916879a5c.json Show response
js.stripe.com/v3/fingerprinted/data/ Frame 31EE 143 KB
36 KB 20ms
20ms XHR
application/json 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/data/countryRanges-ed6f8980af15d82ca172d25916879a5c.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

5785c083b1cf0a752958975ebf6365d60896c3e809e7fd9bd94dc6e11bc75004

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 13
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:04:07 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Mon, 25 Oct 2021 19:35:30 GMT
server: Cloudfront
etag: W/"ed6f8980af15d82ca172d25916879a5c"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: ZWTJXFDTPt8Y7aVdOmvuQlnwmKCS9EBTNCj6JQngaFLZuC0ThoQJzA==

GET
H2

200

i.gif
datacloud.tealiumiq.com/vdata/
Redirect Chain

https://cm.g.doubleclick.net/pixel?tealium_cookie_sync=true&google_nid=tealium_dmp&google_cm&tealium_vid=017d907cf87b0022f86f3fc608d203072014c06a00b08&tealium_account=gop&tealium_profile=main
https://datacloud.tealiumiq.com/vdata/i.gif?tealium_cookie_sync=true&tealium_vid=017d907cf87b0022f86f3fc608d203072014c06a00b08&tealium_account=gop&tealium_profile=main&google_gid=CAESENMJMJcjWiBs3U...

43 B
965 B

26ms
25ms

Image
image/gif

52.54.252.147
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://datacloud.tealiumiq.com/vdata/i.gif?tealium_cookie_sync=true&tealium_vid=017d907cf87b0022f86f3fc608d203072014c06a00b08&tealium_account=gop&tealium_profile=main&google_gid=CAESENMJMJcjWiBs3UpQNQq1e_I&google_cver=1
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
Protocol: H2
Server: 52.54.252.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-252-147.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 16:04:09 GMT
x-serverid: uconnect_i-04f2c39b30b4efb48
x-did: 017d907cf87b0022f86f3fc608d203072014c06a00b08
x-tid: 017d907cf87b0022f86f3fc608d203072014c06a00b08
vary: Origin
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-acc: gop:main:2:vdata
cache-control: no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
x-region: us-east-1
content-type: image/gif
x-ulver: f8f5e005b8b6e369c2cee0a0923be629b8a9d3a5-SNAPSHOT
content-length: 43
x-uuid: 55d61c3e-4a6c-46ac-93a1-d00ed3638bba
expires: Mon, 06 Dec 2021 16:04:09 GMT

Redirect headers

pragma: no-cache
date: Mon, 06 Dec 2021 16:04:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://datacloud.tealiumiq.com/vdata/i.gif?tealium_cookie_sync=true&tealium_vid=017d907cf87b0022f86f3fc608d203072014c06a00b08&tealium_account=gop&tealium_profile=main&google_gid=CAESENMJMJcjWiBs3UpQNQq1e_I&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 437
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 i.gif Show response
collect.tealiumiq.com/gop/main/2/ 43 B
747 B 86ms
33ms XHR
image/gif 52.54.252.147
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collect.tealiumiq.com/gop/main/2/i.gif
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.5.js?utv=ut4.46.201909102207
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.54.252.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-252-147.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryYazsIFv9aEbz4JUf

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
vary: Origin
x-serverid: uconnect_i-0d2a544ed4675b3bd
x-tid: 017d907cf87b0022f86f3fc608d203072014c06a00b08
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-acc: gop:main:2:datacloud
x-region: us-east-1
content-length: 43
pragma: no-cache
x-did: 017d907cf87b0022f86f3fc608d203072014c06a00b08
content-type: image/gif
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers: X-Region
cache-control: no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
access-control-allow-credentials: true
x-ulver: f8f5e005b8b6e369c2cee0a0923be629b8a9d3a5-SNAPSHOT
x-uuid: 4eba2864-81a7-4c52-877a-57ba513a3514
expires: Mon, 06 Dec 2021 16:04:09 GMT

POST
H2 200 i.gif Show response
collect.tealiumiq.com/gop/main/2/ 43 B
746 B 76ms
38ms XHR
image/gif 52.54.252.147
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collect.tealiumiq.com/gop/main/2/i.gif
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.45.js?utv=ut4.46.202006091829
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.54.252.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-252-147.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary6yXBbOpxxxBwsNiT

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
vary: Origin
x-serverid: uconnect_i-0a5b3efa87782bfa9
x-tid: 017d907cf87b0022f86f3fc608d203072014c06a00b08
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-acc: gop:main:2:datacloud
x-region: us-east-1
content-length: 43
pragma: no-cache
x-did: 017d907cf87b0022f86f3fc608d203072014c06a00b08
content-type: image/gif
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers: X-Region
cache-control: no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
access-control-allow-credentials: true
x-ulver: f8f5e005b8b6e369c2cee0a0923be629b8a9d3a5-SNAPSHOT
x-uuid: a3d20e14-6a3a-4078-80ca-fb74d03feb88
expires: Mon, 06 Dec 2021 16:04:09 GMT

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
202 B 21ms
21ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=gop/main/202006091829&cb=1638806649340
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
last-modified: Thu, 14 Apr 2016 16:57:51 GMT
server: AkamaiNetStorage
etag: "7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type: application/x-javascript
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Mon, 06 Dec 2021 16:14:09 GMT

GET
H3 200 1171422386625841 Show response
connect.facebook.net/signals/config/ 5 KB
2 KB 53ms
28ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1171422386625841?v=2.9.48&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d68eb8e1826d9711bd5b411fbce0f61516fb7da1b8dd5d090251e6d3f2bf0cd5

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 2266
x-xss-protection: 0
pragma: public
x-fb-debug: davEEtIV1MOIJ2+OGnmnTiwx2hiH8/5YZQqKhNTMnKEPk+tE7Py5wNKeH/mf0DPlKzDCg5aJSb2MSKRkOSlvIQ==
x-frame-options: DENY
date: Mon, 06 Dec 2021 16:04:09 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 98ms
96ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 csp-report
q.stripe.com/ Frame BD91 0
122 B 288ms
288ms Other
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://m.stripe.network/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
x-envoy-upstream-service-time: 194
server: nginx
content-length: 0
strict-transport-security: max-age=31556926; includeSubDomains; preload

POST
H2 200 csp-report
q.stripe.com/ Frame BD91 0
120 B 101ms
100ms Other
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://m.stripe.network/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
x-envoy-upstream-service-time: 5
server: nginx
content-length: 0
strict-transport-security: max-age=31556926; includeSubDomains; preload

GET
H3 200 payframe Show response
pay.google.com/gp/p/ui/ Frame CD6C 17 KB
7 KB 94ms
60ms Document
text/html 2607:f8b0:400d:c08::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=

Requested by

Host: pay.google.com
URL: https://pay.google.com/gp/p/js/pay.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c08::5c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5fa8d71009e5e82e381a32a416da980968388b6b2d2a85410f1c47a91e8fdebe

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport script-src 'report-sample' 'nonce-9Qco1SHdUFXaOOcpQozA2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'nonce-9Qco1SHdUFXaOOcpQozA2A' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/

Response headers

content-type: text/html; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-ua-compatible: IE=edge
expires: Mon, 06 Dec 2021 16:04:09 GMT
date: Mon, 06 Dec 2021 16:04:09 GMT
cache-control: private, max-age=3600
strict-transport-security: max-age=31536000
content-security-policy: require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport script-src 'report-sample' 'nonce-9Qco1SHdUFXaOOcpQozA2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'nonce-9Qco1SHdUFXaOOcpQozA2A' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport
cross-origin-resource-policy: same-site
cross-origin-opener-policy: same-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 0 Show response
r.stripe.com/ Frame 5046 0
213 B 102ms
101ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 8
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 5046 0
213 B 98ms
97ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 5046 0
213 B 96ms
96ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 5046 0
213 B 96ms
96ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 5046 0
213 B 98ms
98ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 96ms
96ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 96ms
96ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 157ms
157ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 156ms
154ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 156ms
155ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 156ms
155ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 155ms
154ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 155ms
155ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 155ms
154ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 153ms
153ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

GET
H2 200 dc_pre=CITts8HGz_QCFeUH0AQdcAwDOQ;src=9323526;type=landi0;cat=gop_d0;ord=4442037101237;gtm=2wgc10;auiddc=*;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famou...
adservice.google.com/ddm/fls/z/ Frame A5D7 42 B
494 B 155ms
103ms Image
image/gif 2607:f8b0:4006:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CITts8HGz_QCFeUH0AQdcAwDOQ;src=9323526;type=landi0;cat=gop_d0;ord=4442037101237;gtm=2wgc10;auiddc=*;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd

Requested by

Host: 9323526.fls.doubleclick.net
URL: https://9323526.fls.doubleclick.net/activityi;dc_pre=CITts8HGz_QCFeUH0AQdcAwDOQ;src=9323526;type=landi0;cat=gop_d0;ord=4442037101237;gtm=2wgc10;auiddc=397441093.1638806649;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:808::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://9323526.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 16:04:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 0 Show response
r.stripe.com/ Frame 5046 0
213 B 151ms
151ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 5046 0
213 B 150ms
150ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
content-length: 0

GET
H2 200 017d907cf87b0022f86f3fc608d203072014c06a00b08 Show response
visitor-service-us-east-1.tealiumiq.com/gop/main/ 898 B
1 KB 80ms
26ms Script
application/javascript 52.21.82.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://visitor-service-us-east-1.tealiumiq.com/gop/main/017d907cf87b0022f86f3fc608d203072014c06a00b08?callback=utag.ut%5B%22writevamain%22%5D&rnd=1638806649506

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.21.82.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-21-82-71.compute-1.amazonaws.com

Software

Resource Hash

7143f13cdb44d746fc1f31626ce073645f18451d1cebf1f2984fd3e6f0c80c91

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-version: f8f5e005b8b6e369c2cee0a0923be629b8a9d3a5-SNAPSHOT
date: Mon, 06 Dec 2021 16:04:09 GMT
x-region: us-east-1
content-length: 898
strict-transport-security: max-age=31536000; includeSubdomains
x-nodeid: i-03a0d3863c0e33602
content-type: application/javascript; charset=utf-8

POST
H2 200 0 Show response
r.stripe.com/ Frame 5046 0
213 B 145ms
144ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

GET
H3 200 657928937632482 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 24ms
24ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/657928937632482?v=2.9.48&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

511b9d16faa374c5a400579ce33a42e5e5ff293335cedc2e5f6a310e778944e8

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 88942
x-xss-protection: 0
pragma: public
x-fb-debug: 4X95glo+/dU3AKlg45rEAvpBt6Kt9mG8nupama5ZsMJsBqXcp2Ls9I1ZJaQfAvMx5WkHI80CVOWUnQuunxSz3Q==
x-frame-options: DENY
date: Mon, 06 Dec 2021 16:04:09 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 out-4.5.41.js Show response
m.stripe.network/ Frame BD91 85 KB
14 KB 27ms
27ms Script
text/javascript 2600:9000:21ea:5800:19:7d10:bd80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/out-4.5.41.js

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/inner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21ea:5800:19:7d10:bd80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudfront /

Resource Hash

a2f6b81396ab1150effea054efbf1623212ea0419976389ce8f10e909d39e4c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://m.stripe.network/inner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 241
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:00:08 GMT
last-modified: Thu, 04 Nov 2021 19:04:57 GMT
server: Cloudfront
etag: W/"2db385faf28cf5f9393cf01a0a1edfa2"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
via: 1.1 90a990c5327e86ade86681120dc4a237.cloudfront.net (CloudFront)
cache-control: max-age=300, public
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: XLmHDi22iabZVbAza55pcczXhES0-nRyBUhUyWD-RvP2z1buIlD7Yw==

POST
H2 200 0 Show response
r.stripe.com/ Frame 5046 0
213 B 130ms
130ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
content-length: 0

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 38ms
38ms XHR
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=286986161&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd&ul=en-us&de=UTF-8&dt=Republican%20National%20Committee&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aHDACEADRAAAAC~&jid=959429459&gjid=1996353045&cid=43008973.1638806649&tid=UA-2431644-99&_gid=1274565726.1638806649&_r=1&gtm=2wgc10KQQBPQZ&z=889749354

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 16:04:09 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.google-analytics.com/gtm/ 87 KB
34 KB 34ms
34ms Script
application/javascript 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=GTM-K942VSZ&t=gtm40&cid=43008973.1638806649

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ea892a41fb6a3150d68fc851aca64b1609d051f25f59c6b965ac34c816167e70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34986
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 06 Dec 2021 16:04:09 GMT

GET
H2 200 Recurring_Uncheck_Popup.jpg
d35ligi1n5bgzc.cloudfront.net/widget_images/images/000/086/541/original/ 74 KB
75 KB 19ms
18ms Image
image/jpeg 13.225.63.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/widget_images/images/000/086/541/original/Recurring_Uncheck_Popup.jpg
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-38.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ebbd3a4b27adf2b4cfb8ff1aeb3f60c0090ee800443cd0b82da7a1874dc6b634

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Mon, 06 Dec 2021 12:03:18 GMT
via: 1.1 42d3518040c55e24793897f7f5d5f342.cloudfront.net (CloudFront)
last-modified: Sat, 17 Jul 2021 13:34:26 GMT
server: AmazonS3
age: 14452
etag: "6029c4183843891a6eb4e504f9d3d2d5"
x-cache: Hit from cloudfront
x-amz-version-id: SbmaijjJGZAXrktWwHCqF_pxNnP68RcL
x-amz-cf-pop: EWR53-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 76066
x-amz-cf-id: KnhDX-DRRvIew-dUSDa6jdXOKB4xoeMh8BoNDZ4vCfbW2i9hfg9TMQ==

POST
H3 404 cspreport
pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/ Frame CD6C 2 KB
2 KB 32ms
31ms Other
text/html 2607:f8b0:400d:c08::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/cspreport
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400d:c08::5c Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: d6ff339ddb4525268c21fa26ded66b0703f177e742281dc9bcd558288f8e1101

Request headers

Referer: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 16:04:09 GMT
referrer-policy: no-referrer
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1608
content-type: text/html; charset=UTF-8

GET
H2 200 m=_b,_tp Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AM... Frame CD6C 147 KB
52 KB 73ms
20ms Script
text/javascript 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Requested by

Host: pay.google.com
URL: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad6945a0f0f97fb15a8997a2a1d10ad6b4291985a7467c530434e7c04c124505

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 03 Dec 2021 17:12:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 255089
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52727
x-xss-protection: 0
last-modified: Fri, 03 Dec 2021 03:45:46 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
expires: Sat, 03 Dec 2022 17:12:40 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
440 B 130ms
54ms XHR
text/plain 2607:f8b0:4023:1404::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-2431644-99&cid=43008973.1638806649&jid=959429459&gjid=1996353045&_gid=1274565726.1638806649&_u=aHDACEACRAAAAC~&z=1809084487

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4023:1404::9c Columbus, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 06 Dec 2021 16:04:09 GMT
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 1660815514223309 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 27ms
26ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1660815514223309?v=2.9.48&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

fc2ccef085594d1720ce27023740483286cb0f8e0702011ea99622ffa75a4a42

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 89005
x-xss-protection: 0
pragma: public
x-fb-debug: UCZduIGl7bTJWwxg8p60r2ZnG74OP3tvhphVf46oOhi0A0kbN90zL8TMaMiuKbwZkH7xDkYxbF3bGMlF2uka8g==
x-frame-options: DENY
date: Mon, 06 Dec 2021 16:04:09 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 6 Show response
m.stripe.com/ Frame BD91 156 B
523 B 298ms
100ms XHR
application/json 52.88.27.164
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.41.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.88.27.164 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-88-27-164.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

5833973d2af0906b754aed80fadc9332e8049779de41176192837c8d5e6adee1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
x-content-type-options: nosniff
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/json;charset=utf-8
access-control-allow-origin: https://m.stripe.network
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

GET
H3 200 m=byfTOb,lsjVmc,LEikZe Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.QCF... Frame CD6C 36 KB
13 KB 46ms
19ms Script
text/javascript 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.QCFvUZxGfng.L.B1.O/am=BgAC/d=1/exm=_b,_tp/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrjR-xq119NGsi7rkSpL4akPvJ_yfw/ee=cEt90b:ws9Tlc;uY49fb:COQbmf;Oj465e:KG2eXe;yEQyxe:p8L0ob;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;iFQyKf:vfuNJf;dIoSBb:SpsfSb;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;io8t5d:yDVVkb;j7137d:KG2eXe;ul9GGd:JrBFQb;sP4Vbe:VwDzFe;kMFpHd:blwjVc;SNUn3:ZwDk9d/m=byfTOb,lsjVmc,LEikZe

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2d9f427387d66c1e47f6fc9338e3877a8493526fbcf277cdb7f3e55d77cd85a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 03 Dec 2021 17:21:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 254570
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13458
x-xss-protection: 0
last-modified: Tue, 30 Nov 2021 23:41:24 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
expires: Sat, 03 Dec 2022 17:21:19 GMT

POST
H3 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
25 B 92ms
53ms XHR
text/plain 2607:f8b0:4023:1404::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-73658561-7&cid=43008973.1638806649&jid=471578055&gjid=409361577&_gid=1274565726.1638806649&_u=aHDAiEADRAAAAG~&z=899930979

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4023:1404::9c Columbus, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 06 Dec 2021 16:04:09 GMT
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 21ms
20ms Image
image/gif 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=286986161&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd&ul=en-us&de=UTF-8&dt=Republican%20National%20Committee&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aHDAiEADRAAAAC~&jid=471578055&gjid=409361577&cid=43008973.1638806649&tid=UA-73658561-7&_gid=1274565726.1638806649&gtm=2wgc10NTQZ9N&cd61=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd&z=289627256

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 10:00:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 21831
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 21ms
20ms Image
image/gif 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=286986161&t=event&ni=0&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd&ul=en-us&de=UTF-8&dt=Republican%20National%20Committee&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=donation%20landing%20page&ea=user%20session%20start&el=landing%20page%20settings&_u=aHDAiEADRAAAAG~&jid=&gjid=&cid=43008973.1638806649&tid=UA-73658561-7&_gid=1274565726.1638806649&gtm=2wgc10NTQZ9N&cd41=anonymous&cd58=t&cd61=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd&z=646222318

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 10:00:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 21831
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 22ms
19ms Image
image/gif 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=286986161&t=event&ni=1&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd&ul=en-us&de=UTF-8&dt=Republican%20National%20Committee&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Google%20Optimize&ea=t2gbJrM9QpmSN5KrZn0uCQ&_u=aHDACEADRAAAAG~&jid=&gjid=&cid=43008973.1638806649&tid=UA-2431644-99&_gid=1274565726.1638806649&gtm=2wgc10KQQBPQZ&z=1161275784

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 10:00:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 21831
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 m=IZT63,ws9Tlc,p8L0ob,vfuNJf,PrPYRd,Ru0Pgb,hc6Ubd,ZyYHPb,Das5Le Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.QCF... Frame CD6C 73 KB
27 KB 21ms
21ms Script
text/javascript 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.QCFvUZxGfng.L.B1.O/am=BgAC/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrjR-xq119NGsi7rkSpL4akPvJ_yfw/ee=cEt90b:ws9Tlc;uY49fb:COQbmf;Oj465e:KG2eXe;yEQyxe:p8L0ob;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;iFQyKf:vfuNJf;dIoSBb:SpsfSb;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;io8t5d:yDVVkb;j7137d:KG2eXe;ul9GGd:JrBFQb;sP4Vbe:VwDzFe;kMFpHd:blwjVc;SNUn3:ZwDk9d/m=IZT63,ws9Tlc,p8L0ob,vfuNJf,PrPYRd,Ru0Pgb,hc6Ubd,ZyYHPb,Das5Le

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

058d6bb45f407a87de0e1aafd110a5e3422d7d35f6c8b33b4f43e577fd1e0281

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 03 Dec 2021 17:21:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 254570
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27350
x-xss-protection: 0
last-modified: Tue, 30 Nov 2021 23:41:24 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
expires: Sat, 03 Dec 2022 17:21:19 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
406 B 73ms
19ms Image
image/gif 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1171422386625841&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd&rl=&if=false&ts=1638806649962&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=28&it=1638806649349&coo=false&exp=p0&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Mon, 06 Dec 2021 16:04:10 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
213 B 73ms
20ms Image
image/gif 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=657928937632482&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd&rl=&if=false&ts=1638806649972&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=30&fbp=fb.1.1638806649968.177995043&it=1638806649349&coo=false&exp=p0&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Mon, 06 Dec 2021 16:04:10 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
212 B 73ms
21ms Image
image/gif 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1660815514223309&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd&rl=&if=false&ts=1638806649976&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=30&fbp=fb.1.1638806649968.177995043&it=1638806649349&coo=false&exp=p0&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Mon, 06 Dec 2021 16:04:10 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ Frame CD6C 49 KB
20 KB 21ms
18ms Script
text/javascript 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.QCFvUZxGfng.L.B1.O/am=BgAC/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrjR-xq119NGsi7rkSpL4akPvJ_yfw/ee=cEt90b:ws9Tlc;uY49fb:COQbmf;Oj465e:KG2eXe;yEQyxe:p8L0ob;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;iFQyKf:vfuNJf;dIoSBb:SpsfSb;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;io8t5d:yDVVkb;j7137d:KG2eXe;ul9GGd:JrBFQb;sP4Vbe:VwDzFe;kMFpHd:blwjVc;SNUn3:ZwDk9d/m=IZT63,ws9Tlc,p8L0ob,vfuNJf,PrPYRd,Ru0Pgb,hc6Ubd,ZyYHPb,Das5Le

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 6135
date: Mon, 06 Dec 2021 14:21:55 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Mon, 06 Dec 2021 16:21:55 GMT

GET
H3 200 pay Show response
pay.google.com/gp/p/ui/ Frame CD6C 1 MB
337 KB 64ms
63ms XHR
text/html 2607:f8b0:400d:c08::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/ui/pay

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c08::5c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

43f0484beaf27eb73a15335d58348caec579f2072cf6bdc631eecb826390be65

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport, script-src 'report-sample' 'nonce-zNSdHYce+w8bP4pL5pmvfw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport;worker-src 'self', script-src 'nonce-zNSdHYce+w8bP4pL5pmvfw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://pay.google.com https://pay.sandbox.google.com;report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport
cross-origin-resource-policy: same-site
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge
server: ESF
cross-origin-opener-policy: unsafe-none
x-frame-options: DENY
strict-transport-security: max-age=31536000
content-type: text/html; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: private, max-age=3600
content-security-policy: require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport, script-src 'report-sample' 'nonce-zNSdHYce+w8bP4pL5pmvfw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport;worker-src 'self', script-src 'nonce-zNSdHYce+w8bP4pL5pmvfw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://pay.google.com https://pay.sandbox.google.com;report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport
expires: Mon, 06 Dec 2021 16:04:10 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 91ms
40ms Image
image/gif 2607:f8b0:4006:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-73658561-7&cid=43008973.1638806649&jid=471578055&_u=aHDAiEADRAAAAG~&z=780183558

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 16:04:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
501 B 90ms
38ms Image
image/gif 2607:f8b0:4006:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-73658561-7&cid=43008973.1638806649&jid=471578055&_u=aHDAiEADRAAAAG~&z=780183558

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 16:04:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 log Show response
play.google.com/ Frame CD6C 131 B
152 B 96ms
68ms XHR
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 88ms
37ms Preflight
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Mon, 06 Dec 2021 16:04:10 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 log Show response
play.google.com/ Frame CD6C 131 B
152 B 91ms
66ms XHR
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 74ms
38ms Preflight
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Mon, 06 Dec 2021 16:04:10 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 log Show response
play.google.com/ Frame CD6C 131 B
152 B 91ms
67ms XHR
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 61ms
38ms Preflight
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Mon, 06 Dec 2021 16:04:10 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 49ms
39ms Preflight
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Mon, 06 Dec 2021 16:04:10 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 log Show response
play.google.com/ Frame CD6C 131 B
152 B 109ms
86ms XHR
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame CD6C 131 B
152 B 97ms
75ms XHR
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 38ms
37ms Preflight
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Mon, 06 Dec 2021 16:04:10 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 m=Wt6vjf,hhhU8,FCpbqb,WhJNk Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.QCF... Frame CD6C 17 KB
7 KB 20ms
20ms Script
text/javascript 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.QCFvUZxGfng.L.B1.O/am=BgAC/d=1/exm=Das5Le,IZT63,LEikZe,PrPYRd,Ru0Pgb,ZyYHPb,_b,_tp,byfTOb,hc6Ubd,lsjVmc,p8L0ob,vfuNJf,ws9Tlc/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrjR-xq119NGsi7rkSpL4akPvJ_yfw/ee=cEt90b:ws9Tlc;uY49fb:COQbmf;Oj465e:KG2eXe;yEQyxe:p8L0ob;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;iFQyKf:vfuNJf;dIoSBb:SpsfSb;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;io8t5d:yDVVkb;j7137d:KG2eXe;ul9GGd:JrBFQb;sP4Vbe:VwDzFe;kMFpHd:blwjVc;SNUn3:ZwDk9d/m=Wt6vjf,hhhU8,FCpbqb,WhJNk

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8664390f269923cfc07cec5a2f94704ff85786a0ee80ebf564654041e822fd3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 03 Dec 2021 17:21:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 254570
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7265
x-xss-protection: 0
last-modified: Tue, 30 Nov 2021 23:41:24 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
expires: Sat, 03 Dec 2022 17:21:20 GMT

GET
H3 200 m=lwddkf,EFQ78c Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.QCF... Frame CD6C 8 KB
3 KB 21ms
21ms Script
text/javascript 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.QCFvUZxGfng.L.B1.O/am=BgAC/d=1/exm=Das5Le,FCpbqb,IZT63,LEikZe,PrPYRd,Ru0Pgb,WhJNk,Wt6vjf,ZyYHPb,_b,_tp,byfTOb,hc6Ubd,hhhU8,lsjVmc,p8L0ob,vfuNJf,ws9Tlc/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrjR-xq119NGsi7rkSpL4akPvJ_yfw/ee=cEt90b:ws9Tlc;uY49fb:COQbmf;Oj465e:KG2eXe;yEQyxe:p8L0ob;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;iFQyKf:vfuNJf;dIoSBb:SpsfSb;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;io8t5d:yDVVkb;j7137d:KG2eXe;ul9GGd:JrBFQb;sP4Vbe:VwDzFe;kMFpHd:blwjVc;SNUn3:ZwDk9d/m=lwddkf,EFQ78c

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

40a3be1a3422a8d3afc05bc4cf5b8a559ccc414022040153343dac7060335c0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 03 Dec 2021 17:21:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 254570
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3333
x-xss-protection: 0
last-modified: Tue, 30 Nov 2021 23:41:24 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
expires: Sat, 03 Dec 2022 17:21:20 GMT

POST
H3 200 log Show response
play.google.com/ Frame CD6C 131 B
152 B 83ms
82ms XHR
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 35ms
34ms Preflight
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Mon, 06 Dec 2021 16:04:10 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 105ms
95ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 103ms
96ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 5046 0
213 B 96ms
96ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 97 KB
39 KB 35ms
34ms Script
application/javascript 2607:f8b0:4006:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-855990581

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KQQBPQZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:809::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d9a2a58152da21139bd31f6246ad165c851486b59e504cebbeba31fb88278967

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39633
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 06 Dec 2021 16:04:10 GMT

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 96ms
95ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 98ms
97ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

GET
H2 200 elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html Show response
js.stripe.com/v3/ Frame FDB7 8 KB
3 KB 21ms
20ms Document
text/html 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

511675914ab8ffc93b9bea8ab7dd40b4a92fa69a38dfa867b41e155f90bcb9bd

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
last-modified: Fri, 03 Dec 2021 22:47:13 GMT
server: Cloudfront
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
timing-allow-origin: *
content-encoding: gzip
date: Mon, 06 Dec 2021 16:03:38 GMT
cache-control: max-age=60
etag: W/"925c170ec154d4f37ad142e0a248f069"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
x-amz-cf-id: 2bCF6L3UYXS_zmnjO0CxcD-vYUHEm2N6RvGFr2VKOd_EMmcEyLm6KA==
age: 33

POST
H3 200 log Show response
play.google.com/ Frame CD6C 131 B
152 B 61ms
60ms XHR
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 129ms
129ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
content-length: 0

POST
H2 200 csp-report
q.stripe.com/ Frame FDB7 0
346 B 124ms
123ms Other
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 1
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

GET
H2 200 ui-shared-46e93b3755a485133d7e5e7e1db48eaf.css
js.stripe.com/v3/fingerprinted/css/ Frame FDB7 15 KB
3 KB 23ms
21ms Stylesheet
text/css 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/ui-shared-46e93b3755a485133d7e5e7e1db48eaf.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

d9f33ed9fdd936a670993b9a8e6ca44e7a358d0f7b217b6c6638b502f66a8015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 29
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:03:47 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Wed, 03 Nov 2021 22:14:27 GMT
server: Cloudfront
etag: W/"7c0a4ba6a732ed01cc27774f97bbe8bd"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: ffzDBcL785KWIQhUv8VixOW-MI9CxH8kY6DqUU65oW0wc1FzD4O3Bw==

GET
H2 200 shared-81d67bdc5b083df068e5c3ff7fb127b3.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame FDB7 197 KB
54 KB 23ms
22ms Script
application/javascript 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

dae3dcabf7b6ce492e82906c84bf1151d406eacbcd59ceaedaaa9e0819585c4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 33
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:03:39 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Fri, 03 Dec 2021 22:47:14 GMT
server: Cloudfront
etag: W/"5dfa4dd7157aaee1fd4068b2d01eebca"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: mjgt8tFYUCNzinQzj-wSRjLKcQDK5go1GswKD3fpzL54DQs7E5Qnhg==

GET
H2 200 ui-shared-edf311672d554521839b8daa26afdc33.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame FDB7 216 KB
66 KB 25ms
23ms Script
application/javascript 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/ui-shared-edf311672d554521839b8daa26afdc33.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

381ebeeec0644d9fcbfeb6d1f3b692cbecb1b020a4c2ce5a712887d7c652db42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 59
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:03:24 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Mon, 22 Nov 2021 23:04:51 GMT
server: Cloudfront
etag: W/"043c0ce9389f1c1479f40a32fa726309"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: _lFVjIwBMJceadszjcaHVxOb9kfeQOWq9IbD-0fjXa_YMwB89SzFdA==

GET
H2 200 elements-inner-payment-request-0d10a69033631bfe544b3980c5f4db2d.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame FDB7 44 KB
15 KB 29ms
27ms Script
application/javascript 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-payment-request-0d10a69033631bfe544b3980c5f4db2d.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

6f688e7295480921d6bc7f3bc1ad03cd2874ae3f04315efc95d3ca439c0436f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 15
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:03:54 GMT
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
last-modified: Mon, 22 Nov 2021 23:04:48 GMT
server: Cloudfront
etag: W/"7912344645a92469680eceb8450d1619"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: n0SEohIh8Xs6FpeuUTFNVExzT3-LV9xagRHlOtwAyFfP9oD7LA93gg==

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 37 KB
14 KB 117ms
63ms Script
text/javascript 142.250.81.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-855990581

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.81.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s74-in-f2.1e100.net

Software

cafe /

Resource Hash

7317a02358b2b617ba0934b570c313ee76f29176c4821a9a5fd1656413e5f41b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14333
x-xss-protection: 0
server: cafe
etag: 8469929769973419123
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 06 Dec 2021 16:04:10 GMT

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 98ms
97ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 97ms
97ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 98ms
98ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 81C7 0
213 B 98ms
98ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:10 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/855990581/ 3 KB
2 KB 92ms
43ms Script
text/javascript 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/855990581/?random=1638806650386&cv=9&fst=1638806650386&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oac10&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd&tiba=Republican%20National%20Committee&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2123a80c833ab930c0d2b97ece9c12193de3bcf1551ae0562323e220e7222c37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 16:04:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1223
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 70DF 0
18 B 53ms
28ms Document
text/plain 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://secure.winred.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/plain
access-control-allow-origin: https://secure.winred.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority: u=3,i
date: Mon, 06 Dec 2021 16:04:10 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame B0DB 0
15 B 32ms
29ms Document
text/plain 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://secure.winred.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/plain
access-control-allow-origin: https://secure.winred.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority: u=3,i
date: Mon, 06 Dec 2021 16:04:10 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/855990581/ 42 B
64 B 78ms
48ms Image
image/gif 2607:f8b0:4006:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/855990581/?random=1638806650386&cv=9&fst=1638806400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oac10&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd&tiba=Republican%20National%20Committee&async=1&fmt=3&is_vtc=1&random=4065914934&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 16:04:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/855990581/ 42 B
64 B 71ms
44ms Image
image/gif 2607:f8b0:4006:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/855990581/?random=1638806650386&cv=9&fst=1638806400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oac10&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_email_contribute_top_5_nd&tiba=Republican%20National%20Committee&async=1&fmt=3&is_vtc=1&random=4065914934&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 16:04:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 204
No Content events Show response
logx.optimizely.com/v1/ 0
362 B 105ms
24ms XHR
text/plain 34.225.233.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://logx.optimizely.com/v1/events
Requested by: Host: cdn-pci.optimizely.com
URL: https://cdn-pci.optimizely.com/js/8416096648.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.225.233.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-233-122.compute-1.amazonaws.com
Software: nginx/1.17.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Mon, 06 Dec 2021 16:04:10 GMT
Server: nginx/1.17.2
Content-Type: text/plain
Access-Control-Allow-Origin: https://secure.winred.com
Access-Control-Expose-Headers: X-Results-Data-Source
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-Request-Id: f246e817-2905-4741-950c-0b6a60503298

GET
H3 200 common.js Show response
maps.googleapis.com/maps-api-v3/api/js/47/2/ 77 KB
28 KB 45ms
19ms Script
text/javascript 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/47/2/common.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

085346e55834af33cdee2afcdb902bcff88841f0ce214258f3a60301b1047d0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 14:17:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6390
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28707
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 17:54:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 06 Dec 2022 14:17:43 GMT

GET
H3 200 util.js Show response
maps.googleapis.com/maps-api-v3/api/js/47/2/ 297 KB
91 KB 47ms
21ms Script
text/javascript 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/47/2/util.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8cdf739cfcec04930c7c4036a0065a9a4e21ae471827649efee0d1bb95e6aeaf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 03 Dec 2021 23:30:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 232439
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 92814
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 17:54:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 03 Dec 2022 23:30:14 GMT

GET
H2 200 trusted-types-checker-cda1635e27dc416e23614def05f39e01.js Show response
js.stripe.com/v3/fingerprinted/js/ 172 B
671 B 21ms
21ms Script
application/javascript 13.225.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/trusted-types-checker-cda1635e27dc416e23614def05f39e01.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-95.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

95606fd79e5ed034243c781bbfdacc97d7fbc04174981a4a45cd4ad63008afed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
via: 1.1 aaf8cf6e639b571d00317b950854b0bd.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 24
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 16:03:51 GMT
content-length: 172
last-modified: Fri, 05 Nov 2021 21:06:48 GMT
server: Cloudfront
etag: "c78a4d54d725874984ae69d553523207"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: JgRnt3F27ATBpFOjWH68se1y8R1g9pvciv6kQsVEffe5dBjEqq3-oQ==

POST
H2 200 0 Show response
r.stripe.com/ Frame 5046 0
213 B 98ms
98ms XHR
application/octet-stream 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 16:04:15 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

Verdicts & Comments Add Verdict or Comment

72 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

23 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
app.winred.com/api/v3/users	1970-01-21 19:02:53	Name: rvid Value: 8c04fac3-e8b9-45a1-9ac6-c63b2e4f7331
secure.winred.com/	1969-12-31 23:59:59	Name: origin_url Value: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd
secure.winred.com/	1969-12-31 23:59:59	Name: sso_tries Value: 1
secure.winred.com/	1970-01-21 19:01:26	Name: rvid Value: 8c04fac3-e8b9-45a1-9ac6-c63b2e4f7331
.winred.com/	1969-12-31 23:59:59	Name: _revv_v3_session Value: VmZxT1pHRDBDcDZXTy82QmJYL0VGQi9sdDRtY1U2MTgvL1RkUGx6SGppS2dWc0VnekQ0ZUhScDllU3YxNGNOa05kY3V6aEZCbW9zcEJndmlRcEdpc0tFNit5QUUwdTEwUTVrWEJsUzVmRU0wOTc5NERoeVkyaEFLYVlyc2dEMWxJMUU1WjZ4U0VrY3FpbjFHbWNvK0U0QWs0UURMQzhJNGJWSnBYVWRiWDI5bm9VNjcvMzNwZWFCK2ErZTExMWFRQmh4WUdLTG1naWRqdXRGY09qaVFmMWtiZzVKMjN6eGI5RFdFa0RCOTNHVEthK0pwanZtMVpLZHhPM0Nhb3BPcG5rVzlPRjRRT2FDWllRKzZQZEs0VDNabHF0OUkwSXB3SUZXUU5BZXRkK0IrM0t0T1UzNk92aGhmaGxZOEF2SHR6ZzgzUlE2ZDhZbEg5MFdlb2hnL001dWd4bWhudWIvcEFEZTlManp2QTRuNTNPcUg5eU9FbWFObFVEd05XbFVtb3V5VWx3eCtQSUltSEVGdG9KQXU3TGZieW4yekE4cnZzY2JEQ0pVYnhxcmNqcitxS2RhOGZucGxReXZvb0tCSzV0OFBmc0pwVkJMODRDNTRtcEZzSU05QmtPMEQ4RDg5VEM2Y2YwMG1LQWRoOUZuK3UyUTI5NXZBK08zWnF5STNkWTJJSnRuZkFVeWNKUjZmVmVSZzlmT3hyaUdheXp6ckpKckVtWmEzNzV1aXIxNFFMSkNFbUFpMGxjWmFQbmg0QWRWelhYeURSbWg4a3RKbWkrY0R4YXh1UDVrSWtHd1Q0VW9OdWZNdFlLZFZTOWVxYmdQdUpuc3NxQ1daTkJGWHY1SU03TjNHcnFPRkxVT3VXNGd1QTU0ZTZyNnRtK2cyYTJMTDJTQVZITnhZQzVaZk9BT2c1OHo0aURFSmZWaFIrWk1aRTN4UzRDT3I4dTVCeko3SW5rbXQ3Y3lLMGhjSUJiK3QreEFRdFdwZEJLeEd2dStua0ZpMHRkTmhGYjhLVWpvQzhDaWhDVHQyaW1XcTkxa3lhM1B6ZHM0Wk9OV2xrQUJOWXIzTk9URnZQTFhCVGFNd1g1Tm9yRHRMbVRMVS0ta0I0eTM0aWRDMEtBbGd3S0tCQ2tSdz09--80541a9024ce25ce2f8effde6a88bc7c3e44d8f5
.winred.com/	1970-01-20 01:23:02	Name: _gcl_au Value: 1.1.397441093.1638806649
.google.com/	1970-01-20 03:36:57	Name: NID Value: 511=a4kH46Jhr1QsHQeWT0QiTueT3yn5ShvP8ODALk7u361Rm-N99ZWobP3SoPiEw9M4BwsHnhTZiOJu2ARWvZVWY44M_FffIqyHA99r9MO6QG0MoCN-jPnS0JxQJXWZUaUTBmad5zCukbuK6_iG8wxhJWsKBpbYZE_x6B5wixdNqCg
.secure.winred.com/	1970-01-19 23:13:28	Name: __cf_bm Value: MJGM6m89CRUynLgncmeU6Puaq8FGtW8Zb2TkTjlMark-1638806649-0-ATw0LVTbkJhCcme5E64wMe2y9tocIqebXLtRCXNNEAki0fm19ESmaKrcRF1bZpfitRpPMjEl3gPW8+WpqlkpnnVnxbT8oCEcgNDrJWFWpv3eRbtCNZ3dHjxCiMCJIYc1rEPJHdzN+iG6GZSo9cPiI0T9G0DelmUqRXh+Q4FHxTitIOjFQaaDJcgokqkNq98L5g==
.doubleclick.net/	1970-01-20 16:44:38	Name: IDE Value: AHWqTUnxKpyavcYzr9NJJLWzd0yY0oUApOiBmNUofzI6Ox4LKc2u805TSQwkySGdLaU
.winred.com/	1970-01-20 16:44:38	Name: _ga Value: GA1.2.43008973.1638806649
.winred.com/	1970-01-19 23:14:53	Name: _gid Value: GA1.2.1274565726.1638806649
.tealiumiq.com/	1970-01-20 07:59:02	Name: TAPID Value: gop/main>017d907cf87b0022f86f3fc608d203072014c06a00b08\|
.winred.com/	1970-01-20 07:59:02	Name: utag_main Value: v_id:017d907cf87b0022f86f3fc608d203072014c06a00b08$_sn:1$_se:1$_ss:1$_st:1638808448956$ses_id:1638806648956%3Bexp-session$_pn:1%3Bexp-session$dcsyncran:1%3Bexp-session$dc_visit:1$dc_event:2%3Bexp-session$dc_region:us-east-1%3Bexp-session
.tealiumiq.com/	1970-01-20 03:35:31	Name: tcs.google_cver Value: eyJnb3AvbWFpbiI6IjF8MTYzODgwNjY0OTQ5NSJ9
.tealiumiq.com/	1970-01-20 03:35:31	Name: tcs.google_gid Value: eyJnb3AvbWFpbiI6IkNBRVNFTk1KTUpjaldpQnMzVXBRTlFxMWVfSXwxNjM4ODA2NjQ5NDk1In0=
.winred.com/	1970-01-19 23:13:26	Name: _gat_UA-2431644-99 Value: 1
.winred.com/	1970-01-20 03:32:38	Name: optimizelyEndUserId Value: oeu1638806649592r0.18278832426421476
.winred.com/	1970-01-19 23:13:26	Name: _dc_gtm_UA-73658561-7 Value: 1
.winred.com/	1970-01-20 01:23:02	Name: _fbp Value: fb.1.1638806649968.177995043
.facebook.com/	1970-01-20 01:23:02	Name: fr Value: 0Ai7ARILa3Shf7vo8..BhrjR6...1.0.BhrjR6.
m.stripe.com/	1970-01-20 16:44:38	Name: m Value: af182ad4-b85a-4f3f-9439-502498b8fe1e4057e0
.secure.winred.com/	1970-01-20 07:59:02	Name: __stripe_mid Value: 60c4fa68-b539-490c-bc98-2ca8dcd32df8f0f5c9
.secure.winred.com/	1970-01-19 23:13:28	Name: __stripe_sid Value: e067e76d-6c84-4b2e-bc7f-b13827a9135b6e1a40

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd(Line 66) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn-pci.optimizely.com/js/8416096648.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_email_contribute_top_5_nd(Line 66) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn-pci.optimizely.com/js/8416096648.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'sha256-Qj6AdMOUjZkBBUTjGW/OORBoqx2Pohcq8Bg/ZvZzgYw='".
deprecation	warning	URL: https://js.stripe.com/v3/fingerprinted/js/payment-request-inner-browser-f2a776258b5d03fabd63ccb663dcf89a.js Message: The 'basic-card' payment method is deprecated and will be removed in M100, around March 2022. See https://www.chromestatus.com/features/5730051011117056 for more details.
security	error	(Line 6) Message: This document requires 'TrustedScript' assignment.
network	error	URL: https://pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/cspreport Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9323526.fls.doubleclick.net
a8416096648.cdn-pci.optimizely.com
adservice.google.com
app.winred.com
cdn-pci.optimizely.com
click.campaigns.rnchq.com
cm.g.doubleclick.net
collect.tealiumiq.com
connect.facebook.net
d35ligi1n5bgzc.cloudfront.net
datacloud.tealiumiq.com
googleads.g.doubleclick.net
js.stripe.com
logx.optimizely.com
m.stripe.com
m.stripe.network
maps.googleapis.com
pay.google.com
play.google.com
q.stripe.com
r.stripe.com
secure.winred.com
stats.g.doubleclick.net
tags.tiqcdn.com
visitor-service-us-east-1.tealiumiq.com
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
13.111.145.38
13.225.214.95
13.225.63.38
142.250.65.194
142.250.80.38
142.250.81.226
23.208.216.220
2600:9000:21ea:5800:19:7d10:bd80:93a1
2606:4700::6812:9c15
2607:f8b0:4006:807::200e
2607:f8b0:4006:808::2002
2607:f8b0:4006:809::2008
2607:f8b0:4006:80b::2003
2607:f8b0:4006:80b::2004
2607:f8b0:4006:80c::2002
2607:f8b0:4006:81e::2003
2607:f8b0:4006:823::200a
2607:f8b0:400d:c08::5c
2607:f8b0:4023:1404::9c
2a03:2880:f012:8:face:b00c:0:1
2a03:2880:f112:83:face:b00c:0:25de
34.225.233.122
52.21.82.71
52.54.252.147
52.88.27.164
54.187.159.182
69.192.20.36
69.192.26.112
02f6346535d658a846962a682488d1fdd568a1fff592036667d2d7a853511fe9
032b2cd62ca53bd3edf67462afb364442044e4338d4eedf1269375bc238682d8
0330d92f80895c477e7bf33190ec17d06bc1a4eed429a65bc7384507855dc743
048ab7812899a24caacd50b1921fc17d5a3f7cd1fde2863d439a024a2245c6f8
058d6bb45f407a87de0e1aafd110a5e3422d7d35f6c8b33b4f43e577fd1e0281
085346e55834af33cdee2afcdb902bcff88841f0ce214258f3a60301b1047d0f
0c4d83d7ed629fcf090ecc239a585be39101f7237e8e45f68cfab655ff00d71a
0c971e6db21f464c3c85d6d37ac2d8f18008e66ec112c7891a00fdf721ab3a1a
0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
111f1700ccb35898fa18b3bbf8eb1d0b0f6e7f744cf9fa6e59e5a2723dd9f20f
18c33eea07a67aef897ec1cda0bee45cab46d25b88b98a875f010f51c2af3af8
1969520bd7b0ea7b84b1cbdda4a8ae93c321abe6eaeff82b5fa496680bf88a0f
19d2e43a96b539c5bfee8691baa248a6560e8bacd2bdc2350bc9f740af273a02
2123a80c833ab930c0d2b97ece9c12193de3bcf1551ae0562323e220e7222c37
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2646d818e258e85ba1721270d71684413d53dfa2dd8ac6957738d56a86ab1b5f
318234a3467765bba6d4307f1aa806ec04c7f24234739b99f59511be361be228
32d4644b89b4c67b6db6b306cadc64f32d9283a4edefb88d1c95bcd45694270d
36f0bf882a876b13aeb20cf7a495421a43f336da5422072a58f58ce303fb6284
381ebeeec0644d9fcbfeb6d1f3b692cbecb1b020a4c2ce5a712887d7c652db42
3ed1f78a1ee89c913a730637376afbd17148beec7eca98ed43e46713bb585898
3f7fb4c1f2d3ee57a3767048afa62cdf8d4187c4f85ee32bdf91976c2bc72ad6
40a3be1a3422a8d3afc05bc4cf5b8a559ccc414022040153343dac7060335c0c
43f0484beaf27eb73a15335d58348caec579f2072cf6bdc631eecb826390be65
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
511675914ab8ffc93b9bea8ab7dd40b4a92fa69a38dfa867b41e155f90bcb9bd
511b9d16faa374c5a400579ce33a42e5e5ff293335cedc2e5f6a310e778944e8
5785c083b1cf0a752958975ebf6365d60896c3e809e7fd9bd94dc6e11bc75004
5833973d2af0906b754aed80fadc9332e8049779de41176192837c8d5e6adee1
5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848
5ebf765fb54f6bcbe0e6cd23a33c3096f26bb86aaa27f885e6d574ffe6a63114
5fa8d71009e5e82e381a32a416da980968388b6b2d2a85410f1c47a91e8fdebe
626e124aafce560a521c9ce7e4cc884ea850ad2ab2228389ebc02350bcda0e92
6b5402ff8932ed835d39a31b75c6bc737a80f6ddcd6269a1fa53556485ca3ad8
6b78480d93aa0cbde74c94673b0fdf29794f029bf8d5d516277874a8d3dd1002
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6f688e7295480921d6bc7f3bc1ad03cd2874ae3f04315efc95d3ca439c0436f2
7143f13cdb44d746fc1f31626ce073645f18451d1cebf1f2984fd3e6f0c80c91
71a55578d53e666ef644669139972f47092d97114a67c8b251f155ef6c19c15d
7317a02358b2b617ba0934b570c313ee76f29176c4821a9a5fd1656413e5f41b
75fb90521d1e7155f5aee298e5c171e0f2e536ec07208d07026bcc9eb7122915
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8664390f269923cfc07cec5a2f94704ff85786a0ee80ebf564654041e822fd3d
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
873cde696bd561fdcab804af4eb210ff5c5a1d2bad06130342b44072d33d249f
8bddcca7513349f6d73c3fd3232c1e8966353005796e8e8ce8dd367898b4b7bb
8cdf739cfcec04930c7c4036a0065a9a4e21ae471827649efee0d1bb95e6aeaf
91c43e87a8ba043009368fc55877ed7974db292737deb389ca07ddd7a26c815d
95606fd79e5ed034243c781bbfdacc97d7fbc04174981a4a45cd4ad63008afed
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a2f6b81396ab1150effea054efbf1623212ea0419976389ce8f10e909d39e4c7
aa920fa4fdea358365f980f78d82a992fa119070a07cb21d3aeee419d88429aa
ad6945a0f0f97fb15a8997a2a1d10ad6b4291985a7467c530434e7c04c124505
af4b8dcbb0f1beb04e333fb40d352f763415cc15b83b6c79646d773c4d5893b6
b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6
b43f598121b061463cc62dba6ac8e7582d667eb35d8223b06a4ac933b447199c
bbe935971411b547760ad22c28a55c7573abd06b49bcd13a361444dc94fa1c0e
bcbcb01150d080ba819cb712a93a7edb61a231f027a77308ea5ad900aa88005e
c885ef025f7d73741c3fae1f63830e9beec3f662f0ca17ea7746b534b34ac5d5
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
d0c4620ce8318742733f6d4b9ff6881018b9b2c51b2ae13f16dfc284461faa73
d68eb8e1826d9711bd5b411fbce0f61516fb7da1b8dd5d090251e6d3f2bf0cd5
d6ff339ddb4525268c21fa26ded66b0703f177e742281dc9bcd558288f8e1101
d9a2a58152da21139bd31f6246ad165c851486b59e504cebbeba31fb88278967
d9f33ed9fdd936a670993b9a8e6ca44e7a358d0f7b217b6c6638b502f66a8015
dae3dcabf7b6ce492e82906c84bf1151d406eacbcd59ceaedaaa9e0819585c4e
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea892a41fb6a3150d68fc851aca64b1609d051f25f59c6b965ac34c816167e70
ebbd3a4b27adf2b4cfb8ff1aeb3f60c0090ee800443cd0b82da7a1874dc6b634
ed34a59f182c66e2b25c602f3c9b0f21435a8f475d5dbc9e6830ff4c7929f5cd
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0b6e7438d98877c3085761d380c763545784389620bbbc8254bd5e30e83a3eb
f2d9f427387d66c1e47f6fc9338e3877a8493526fbcf277cdb7f3e55d77cd85a
f7297ef321f1b682622a9adacc3ada5ba2d6912115f57dd9948ffec18d33cb41
fc2ccef085594d1720ce27023740483286cb0f8e0702011ea99622ffa75a4a42
fe47f6390f33e0175bdc61b16d8076a94a3fb8bc06b7fb3a7c9ba4aab0ff0afa

secure.winred.com Open in urlscan Pro 2606:4700::6812:9c15 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

157 Requests

99 %HTTPS

50 %IPv6

18 Domains

32 Subdomains

26 IPs

1 Countries

2895 kBTransfer

8665 kBSize

23 Cookies

7 Outgoing links

Page URL History

Redirected requests

157 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

secure.winred.com Open in urlscan Pro
2606:4700::6812:9c15 Public Scan

Screenshot
Live screenshot

Full Image

157
Requests

99 %
HTTPS

50 %
IPv6

18
Domains

32
Subdomains

26
IPs

1
Countries

2895 kB
Transfer

8665 kB
Size

23
Cookies

157 HTTP transactions
0 data transactions