Submitted URL: https://droplink.co/xHj1C
Effective URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Submission: On December 13 via manual from US — Scanned from FI

Summary

This website contacted 21 IPs in 7 countries across 17 domains to perform 46 HTTP transactions. The main IP is 172.67.146.19, located in United States and belongs to CLOUDFLARENET, US. The main domain is u88469-drco.quins.us.
TLS certificate: Issued by WE1 on November 28th 2024. Valid for: 3 months.
This is the only time u88469-drco.quins.us was scanned on urlscan.io!

urlscan.io Verdict: No classification


Live information

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
2 11 172.67.146.19 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
2 216.58.206.67 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 104.19.230.21 13335 (CLOUDFLAR...)
1 104.17.24.14 13335 (CLOUDFLAR...)
1 2a04:fa87:fff... 2635 (AUTOMATTIC)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
2 216.58.212.130 15169 (GOOGLE)
1 104.19.229.21 13335 (CLOUDFLAR...)
2 2a01:4f8:fff2... 24940 (HETZNER-A...)
1 188.114.96.3 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a04:4e42:600... 54113 (FASTLY)
2 103.67.200.72 60558 (SECUREDSE...)
6 142.250.74.206 15169 (GOOGLE)
2 216.58.212.162 15169 (GOOGLE)
1 2800:3f0:4001... 15169 (GOOGLE)
1 142.250.185.130 15169 (GOOGLE)
46 21
Apex Domain
Subdomains
Transfer
11 quins.us
quins.us
u88469-drco.quins.us
wp.quins.us
216 KB
8 google.com
fundingchoicesmessages.google.com — Cisco Umbrella Rank: 695
133 KB
4 consentframework.com
cache.consentframework.com — Cisco Umbrella Rank: 36540
choices.consentframework.com — Cisco Umbrella Rank: 38496
api.consentframework.com — Cisco Umbrella Rank: 35112
309 KB
3 doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 218
googleads.g.doubleclick.net — Cisco Umbrella Rank: 43
186 KB
3 gstatic.com
fonts.gstatic.com
csi.gstatic.com
31 KB
2 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 110
26 KB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 36
2 hcaptcha.com
js.hcaptcha.com — Cisco Umbrella Rank: 8003
newassets.hcaptcha.com — Cisco Umbrella Rank: 5948
51 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 29
2 KB
1 fmlabsonline.com
cpm.fmlabsonline.com — Cisco Umbrella Rank: 116602
241 B
1 revbid.net
cpm.revbid.net
241 B
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 318
1 KB
1 profitsfly.com
cdn.profitsfly.com
69 KB
1 gravatar.com
secure.gravatar.com — Cisco Umbrella Rank: 2458
1 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 225
28 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
108 KB
1 droplink.co
droplink.co — Cisco Umbrella Rank: 983698
3 KB
46 17
Domain Requested by
8 fundingchoicesmessages.google.com securepubads.g.doubleclick.net
7 u88469-drco.quins.us 2 redirects quins.us
u88469-drco.quins.us
2 pagead2.googlesyndication.com securepubads.g.doubleclick.net
2 www.google-analytics.com www.googletagmanager.com
2 api.consentframework.com choices.consentframework.com
2 securepubads.g.doubleclick.net u88469-drco.quins.us
securepubads.g.doubleclick.net
2 wp.quins.us u88469-drco.quins.us
wp.quins.us
2 fonts.gstatic.com fonts.googleapis.com
2 fonts.googleapis.com quins.us
u88469-drco.quins.us
2 quins.us quins.us
1 googleads.g.doubleclick.net u88469-drco.quins.us
1 csi.gstatic.com pagead2.googlesyndication.com
1 cpm.fmlabsonline.com cdn.profitsfly.com
1 cpm.revbid.net cdn.profitsfly.com
1 cdn.jsdelivr.net cdn.profitsfly.com
1 cdn.profitsfly.com u88469-drco.quins.us
1 newassets.hcaptcha.com js.hcaptcha.com
1 choices.consentframework.com u88469-drco.quins.us
1 cache.consentframework.com u88469-drco.quins.us
1 secure.gravatar.com u88469-drco.quins.us
1 cdnjs.cloudflare.com u88469-drco.quins.us
1 js.hcaptcha.com u88469-drco.quins.us
1 www.googletagmanager.com u88469-drco.quins.us
1 droplink.co 1 redirects
46 24

This site contains links to these domains. Also see Links.

Domain
cryptednews.space
cmp.sirdata.com
Subject Issuer Validity Valid
quins.us
WE1
2024-11-28 -
2025-02-26
3 months crt.sh
upload.video.google.com
WR2
2024-11-04 -
2025-01-27
3 months crt.sh
*.gstatic.com
WR2
2024-11-04 -
2025-01-27
3 months crt.sh
*.google-analytics.com
WR2
2024-11-04 -
2025-01-27
3 months crt.sh
hcaptcha.com
WE1
2024-11-05 -
2025-02-03
3 months crt.sh
cdnjs.cloudflare.com
WE1
2024-11-26 -
2025-02-24
3 months crt.sh
*.gravatar.com
Sectigo ECC Domain Validation Secure Server CA
2023-12-05 -
2025-01-04
a year crt.sh
consentframework.com
WE1
2024-11-14 -
2025-02-12
3 months crt.sh
*.g.doubleclick.net
WR2
2024-11-04 -
2025-01-27
3 months crt.sh
*.consentframework.com
RapidSSL TLS RSA CA G1
2024-02-19 -
2025-03-20
a year crt.sh
profitsfly.com
WE1
2024-10-16 -
2025-01-14
3 months crt.sh
*.google.com
WR2
2024-11-04 -
2025-01-27
3 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2024 Q3
2024-07-30 -
2025-08-31
a year crt.sh
*.revbid.net
GlobalSign GCC R6 AlphaSSL CA 2023
2024-11-12 -
2025-12-14
a year crt.sh
*.fmlabsonline.com
AlphaSSL CA - SHA256 - G4
2024-01-04 -
2025-02-04
a year crt.sh

This page contains 1 frames:

Primary Page: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Frame ID: 5191072A7996B79CDACBFAEB7F66BCDF
Requests: 47 HTTP requests in this frame

Screenshot

Page Title

Keep window open for 15 seconds!

Page URL History Show full URLs

  1. https://droplink.co/xHj1C HTTP 302
    https://quins.us/ref.php?conf=i%2FqQQlXnLr1c8vf1m21ucLtUdA5Sp1iUV95FVicRwOA5PiZNdc9NF%2FjkXKK... Page URL
  2. https://quins.us/ref.php?conf=i%2FqQQlXnLr1c8vf1m21ucLtUdA5Sp1iUV95FVicRwOA5PiZNdc9NF%2FjkXKK... Page URL
  3. https://u88469-drco.quins.us/ HTTP 302
    https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide HTTP 301
    https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/

Overall confidence: 100%
Detected patterns

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

46
Requests

91 %
HTTPS

48 %
IPv6

17
Domains

24
Subdomains

21
IPs

7
Countries

1161 kB
Transfer

4146 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://droplink.co/xHj1C HTTP 302
    https://quins.us/ref.php?conf=i%2FqQQlXnLr1c8vf1m21ucLtUdA5Sp1iUV95FVicRwOA5PiZNdc9NF%2FjkXKK4AA5QYUfFVyv%2FmLlRFUrHQTUV8mwSuHGOgy5OS0FeD%2BZQqMTgac1zou9sslKn4%2F82NWaAnAPFGeqCPCxF%2FGZ1%2BEFNa%2FhGskmz1S5AKYXSlJG78MoVVx9j%2FdwMwZa5vGavPZdZVoO5g8EbiJUiqh0dXvQGZcVhfpi7FWvQKYtGTBl9itC7oerD6gp9ZXV6B3%2B28qBU6VlbM0ivvnlmuVtMayULa6M%2BuAfsG3klE9iqLnLOEcw%3D Page URL
  2. https://quins.us/ref.php?conf=i%2FqQQlXnLr1c8vf1m21ucLtUdA5Sp1iUV95FVicRwOA5PiZNdc9NF%2FjkXKK4AA5QYUfFVyv%2FmLlRFUrHQTUV8mwSuHGOgy5OS0FeD%2BZQqMTgac1zou9sslKn4%2F82NWaAnAPFGeqCPCxF%2FGZ1%2BEFNa%2FhGskmz1S5AKYXSlJG78MoVVx9j%2FdwMwZa5vGavPZdZVoO5g8EbiJUiqh0dXvQGZcVhfpi7FWvQKYtGTBl9itC7oerD6gp9ZXV6B3%2B28qBU6VlbM0ivvnlmuVtMayULa6M%2BuAfsG3klE9iqLnLOEcw%3D&continue=true Page URL
  3. https://u88469-drco.quins.us/ HTTP 302
    https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide HTTP 301
    https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://droplink.co/xHj1C HTTP 302
  • https://quins.us/ref.php?conf=i%2FqQQlXnLr1c8vf1m21ucLtUdA5Sp1iUV95FVicRwOA5PiZNdc9NF%2FjkXKK4AA5QYUfFVyv%2FmLlRFUrHQTUV8mwSuHGOgy5OS0FeD%2BZQqMTgac1zou9sslKn4%2F82NWaAnAPFGeqCPCxF%2FGZ1%2BEFNa%2FhGskmz1S5AKYXSlJG78MoVVx9j%2FdwMwZa5vGavPZdZVoO5g8EbiJUiqh0dXvQGZcVhfpi7FWvQKYtGTBl9itC7oerD6gp9ZXV6B3%2B28qBU6VlbM0ivvnlmuVtMayULa6M%2BuAfsG3klE9iqLnLOEcw%3D

46 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
ref.php
quins.us/
Redirect Chain
  • https://droplink.co/xHj1C
  • https://quins.us/ref.php?conf=i%2FqQQlXnLr1c8vf1m21ucLtUdA5Sp1iUV95FVicRwOA5PiZNdc9NF%2FjkXKK4AA5QYUfFVyv%2FmLlRFUrHQTUV8mwSuHGOgy5OS0FeD%2BZQqMTgac1zou9sslKn4%2F82NWaAnAPFGeqCPCxF%2FGZ1%2BEFNa%2Fh...
4 KB
2 KB
Document
General
Full URL
https://quins.us/ref.php?conf=i%2FqQQlXnLr1c8vf1m21ucLtUdA5Sp1iUV95FVicRwOA5PiZNdc9NF%2FjkXKK4AA5QYUfFVyv%2FmLlRFUrHQTUV8mwSuHGOgy5OS0FeD%2BZQqMTgac1zou9sslKn4%2F82NWaAnAPFGeqCPCxF%2FGZ1%2BEFNa%2FhGskmz1S5AKYXSlJG78MoVVx9j%2FdwMwZa5vGavPZdZVoO5g8EbiJUiqh0dXvQGZcVhfpi7FWvQKYtGTBl9itC7oerD6gp9ZXV6B3%2B28qBU6VlbM0ivvnlmuVtMayULa6M%2BuAfsG3klE9iqLnLOEcw%3D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.146.19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4c360a33db1b0e7ed860ed890500ba49aae618a58114ee336224d7ca4fc2e623

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8f1696f20c5bb15b-WAW
content-encoding
zstd
content-type
text/html; charset=UTF-8
date
Fri, 13 Dec 2024 14:19:31 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WUE2ekIupvj2%2BJJ1UnfOYwh2fbeAzBKgFvSUATeLRk%2FZzjEXbgczNFtdam18o%2BHJz4%2Biz7lz%2FvrkfKdRCgxcEeoRfP1lE5hl3pRaDzT9HiTB37o9pZLj4nQWBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=46911&min_rtt=46775&rtt_var=7493&sent=11&recv=10&lost=0&retrans=0&sent_bytes=4122&recv_bytes=4753&delivery_rate=389&cwnd=12000&unsent_bytes=0&cid=3d7997f6ed462ed2&ts=430&x=1" cfExtPri cfHdrFlush;dur=0
vary
Accept-Encoding
x-turbo-charged-by
LiteSpeed

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
8f1696ecbf9ac7eb-TLL
content-type
text/html; charset=UTF-8
date
Fri, 13 Dec 2024 14:19:31 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
https://quins.us/ref.php?conf=i%2FqQQlXnLr1c8vf1m21ucLtUdA5Sp1iUV95FVicRwOA5PiZNdc9NF%2FjkXKK4AA5QYUfFVyv%2FmLlRFUrHQTUV8mwSuHGOgy5OS0FeD%2BZQqMTgac1zou9sslKn4%2F82NWaAnAPFGeqCPCxF%2FGZ1%2BEFNa%2FhGskmz1S5AKYXSlJG78MoVVx9j%2FdwMwZa5vGavPZdZVoO5g8EbiJUiqh0dXvQGZcVhfpi7FWvQKYtGTBl9itC7oerD6gp9ZXV6B3%2B28qBU6VlbM0ivvnlmuVtMayULa6M%2BuAfsG3klE9iqLnLOEcw%3D
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x89DHljGkawVcaL1D3zCSD7n9YhOiNfTYmsoXtYj0O3tm0qouiZqsn%2BRpqGMFgHMsswYxCRfZh92JHHTW2a1mqIfJNoAtMHtTEHnGMo%2BQyppjI7ervfEYaZvn0FHiLuG2uOFFPeU0WjA4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=30881&min_rtt=30863&rtt_var=4893&sent=8&recv=11&lost=0&retrans=0&sent_bytes=4027&recv_bytes=2284&delivery_rate=130962&cwnd=253&unsent_bytes=0&cid=3b97f2432e4c843f&ts=776&x=0"
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN SAMEORIGIN
x-robots-tag
noindex, nofollow
x-xss-protection
1; mode=block
css2
fonts.googleapis.com/
846 B
856 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Poppins:wght@600&display=swap
Requested by
Host: quins.us
URL: https://quins.us/ref.php?conf=i%2FqQQlXnLr1c8vf1m21ucLtUdA5Sp1iUV95FVicRwOA5PiZNdc9NF%2FjkXKK4AA5QYUfFVyv%2FmLlRFUrHQTUV8mwSuHGOgy5OS0FeD%2BZQqMTgac1zou9sslKn4%2F82NWaAnAPFGeqCPCxF%2FGZ1%2BEFNa%2FhGskmz1S5AKYXSlJG78MoVVx9j%2FdwMwZa5vGavPZdZVoO5g8EbiJUiqh0dXvQGZcVhfpi7FWvQKYtGTBl9itC7oerD6gp9ZXV6B3%2B28qBU6VlbM0ivvnlmuVtMayULa6M%2BuAfsG3klE9iqLnLOEcw%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
4a007f84b241f4b5cd6376bd4ffd23964002ec13486aab9b433ae5361cda818b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Fri, 13 Dec 2024 14:19:32 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 13 Dec 2024 14:19:32 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Fri, 13 Dec 2024 14:08:32 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
ref.php
quins.us/
276 B
1 KB
Document
General
Full URL
https://quins.us/ref.php?conf=i%2FqQQlXnLr1c8vf1m21ucLtUdA5Sp1iUV95FVicRwOA5PiZNdc9NF%2FjkXKK4AA5QYUfFVyv%2FmLlRFUrHQTUV8mwSuHGOgy5OS0FeD%2BZQqMTgac1zou9sslKn4%2F82NWaAnAPFGeqCPCxF%2FGZ1%2BEFNa%2FhGskmz1S5AKYXSlJG78MoVVx9j%2FdwMwZa5vGavPZdZVoO5g8EbiJUiqh0dXvQGZcVhfpi7FWvQKYtGTBl9itC7oerD6gp9ZXV6B3%2B28qBU6VlbM0ivvnlmuVtMayULa6M%2BuAfsG3klE9iqLnLOEcw%3D&continue=true
Requested by
Host: quins.us
URL: https://quins.us/ref.php?conf=i%2FqQQlXnLr1c8vf1m21ucLtUdA5Sp1iUV95FVicRwOA5PiZNdc9NF%2FjkXKK4AA5QYUfFVyv%2FmLlRFUrHQTUV8mwSuHGOgy5OS0FeD%2BZQqMTgac1zou9sslKn4%2F82NWaAnAPFGeqCPCxF%2FGZ1%2BEFNa%2FhGskmz1S5AKYXSlJG78MoVVx9j%2FdwMwZa5vGavPZdZVoO5g8EbiJUiqh0dXvQGZcVhfpi7FWvQKYtGTBl9itC7oerD6gp9ZXV6B3%2B28qBU6VlbM0ivvnlmuVtMayULa6M%2BuAfsG3klE9iqLnLOEcw%3D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.146.19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate, max-age=0 post-check=0, pre-check=0
cf-cache-status
DYNAMIC
cf-ray
8f1696f658d8b15b-WAW
content-encoding
zstd
content-type
text/html; charset=UTF-8
date
Fri, 13 Dec 2024 14:19:32 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w4TqVLtxw%2FrsZta5fZe%2BzNV3WGOHPdvZzUtEIQMzUPVVsamMYGCIuAVjCyDmDJGKyW4afrg%2F0l8M%2FvfxZP%2FjrnUXGNFnNMsBmvSLMAL%2FKsEwuZfBHJv6DvbJdw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=46895&min_rtt=46775&rtt_var=5653&sent=14&recv=12&lost=0&retrans=0&sent_bytes=6466&recv_bytes=5443&delivery_rate=49593&cwnd=12000&unsent_bytes=0&cid=3d7997f6ed462ed2&ts=1183&x=1" cfExtPri cfHdrFlush;dur=0
vary
Accept-Encoding
x-turbo-charged-by
LiteSpeed
pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v22/
8 KB
8 KB
Font
General
Full URL
https://fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@600&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.206.67 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lhr35s11-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://quins.us
Referer
https://fonts.googleapis.com/

Response headers

age
277811
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 10 Dec 2025 09:09:21 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 10 Dec 2024 09:09:21 GMT
last-modified
Wed, 04 Dec 2024 06:53:31 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
8000
x-xss-protection
0
server
sffe
Primary Request /
u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Redirect Chain
  • https://u88469-drco.quins.us/
  • https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide
  • https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
256 KB
94 KB
Document
General
Full URL
https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Requested by
Host: quins.us
URL: https://quins.us/ref.php?conf=i%2FqQQlXnLr1c8vf1m21ucLtUdA5Sp1iUV95FVicRwOA5PiZNdc9NF%2FjkXKK4AA5QYUfFVyv%2FmLlRFUrHQTUV8mwSuHGOgy5OS0FeD%2BZQqMTgac1zou9sslKn4%2F82NWaAnAPFGeqCPCxF%2FGZ1%2BEFNa%2FhGskmz1S5AKYXSlJG78MoVVx9j%2FdwMwZa5vGavPZdZVoO5g8EbiJUiqh0dXvQGZcVhfpi7FWvQKYtGTBl9itC7oerD6gp9ZXV6B3%2B28qBU6VlbM0ivvnlmuVtMayULa6M%2BuAfsG3klE9iqLnLOEcw%3D&continue=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.146.19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e17f525aa93aa4b3dbce9d95bbd0ceb390e0faf38f76a0585354883af6b8cfa5

Request headers

Referer
https://quins.us/ref.php?conf=i%2FqQQlXnLr1c8vf1m21ucLtUdA5Sp1iUV95FVicRwOA5PiZNdc9NF%2FjkXKK4AA5QYUfFVyv%2FmLlRFUrHQTUV8mwSuHGOgy5OS0FeD%2BZQqMTgac1zou9sslKn4%2F82NWaAnAPFGeqCPCxF%2FGZ1%2BEFNa%2FhGskmz1S5AKYXSlJG78MoVVx9j%2FdwMwZa5vGavPZdZVoO5g8EbiJUiqh0dXvQGZcVhfpi7FWvQKYtGTBl9itC7oerD6gp9ZXV6B3%2B28qBU6VlbM0ivvnlmuVtMayULa6M%2BuAfsG3klE9iqLnLOEcw%3D&continue=true
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
8f1696fe8917b15b-WAW
content-encoding
zstd
content-type
text/html; charset=UTF-8
date
Fri, 13 Dec 2024 14:19:33 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
link
<https://u88469-drco.quins.us/wp-json/>; rel="https://api.w.org/" <https://u88469-drco.quins.us/wp-json/wp/v2/posts/1649>; rel="alternate"; title="JSON"; type="application/json" <https://u88469-drco.quins.us/?p=1649>; rel=shortlink
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B4MEm9yMepkx2oN%2Bc233Xg8VpHgPGhkXsobQvkeMIbYnTLwT1s9H75nF2gXND7306XErg827Wa%2BGI4KRXTIP%2B2NgNp%2FURqtSAuk5Ka9FgGWr0oSEKRXHeup0dJ7Ss7S8dFn9phThlg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=47353&min_rtt=46775&rtt_var=2458&sent=21&recv=18&lost=0&retrans=0&sent_bytes=9471&recv_bytes=6860&delivery_rate=16621&cwnd=12000&unsent_bytes=0&cid=3d7997f6ed462ed2&ts=2332&x=1" cfExtPri cfHdrFlush;dur=0
vary
Accept-Encoding
x-turbo-charged-by
LiteSpeed

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
8f1696fd5817b15b-WAW
content-type
text/html; charset=UTF-8
date
Fri, 13 Dec 2024 14:19:33 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sKaKeQ%2BwMbz47mBvbC0YFnj3lVQkdbQWdRbT9FKrVowEE0v42yXsHBW%2Bh6g4p6kMJXwyXeGuPpKC0bUWnqoR%2FVhjHoHhRQ901kxkifZV4mNdeT8FpykMINkJr%2BbhqGhWib0sNIs8NQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=47395&min_rtt=46775&rtt_var=3163&sent=19&recv=17&lost=0&retrans=0&sent_bytes=8615&recv_bytes=6406&delivery_rate=399&cwnd=12000&unsent_bytes=0&cid=3d7997f6ed462ed2&ts=2005&x=1" cfExtPri cfHdrFlush;dur=0
x-redirect-by
WordPress
x-turbo-charged-by
LiteSpeed
style.min.css
u88469-drco.quins.us/wp-includes/css/dist/block-library/
112 KB
17 KB
Stylesheet
General
Full URL
https://u88469-drco.quins.us/wp-includes/css/dist/block-library/style.min.css?ver=6.7.1
Requested by
Host: u88469-drco.quins.us
URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.146.19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3bb38d0f302677ff4104564454f60f495133579d6e6dfb722b3de850df596502

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"1c012-6733d239-1c4ed9de;br"
age
9019
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nWD0%2BObspBt5MpJiZBTDP%2BKm9gkKEM3ildwVAWqrHpfQQBqw8%2FCAKWIMDsuP3CTkK5iZU0NxzpeUV1zHMgpKJw4UvXRFbbxWSYsj9JwAC7keoMs1aMUOysjhxZ%2BObOnNzoCLuc0fsQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Fri, 20 Dec 2024 11:49:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=47322&min_rtt=46775&rtt_var=337&sent=47&recv=34&lost=0&retrans=0&sent_bytes=37438&recv_bytes=8917&delivery_rate=49254&cwnd=19200&unsent_bytes=0&cid=3d7997f6ed462ed2&ts=2444&x=1", cfExtPri, cfHdrFlush;dur=0
date
Fri, 13 Dec 2024 14:19:33 GMT
content-type
text/css
last-modified
Tue, 12 Nov 2024 22:10:01 GMT
vary
Accept-Encoding
priority
u=0,i=?0
cache-control
public, max-age=604800
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8f169700dba5b15b-WAW
x-turbo-charged-by
LiteSpeed
server
cloudflare
css
fonts.googleapis.com/
4 KB
856 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Noto+Serif%3A400+%7CLato%3A100%26subset%3Dcyrillic%2Ccyrillic
Requested by
Host: u88469-drco.quins.us
URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2d25825c89e9e42bf60463aacb87c38307e0279e6f6517de818bac6021080f15
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Fri, 13 Dec 2024 14:19:33 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 13 Dec 2024 14:19:33 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Fri, 13 Dec 2024 14:19:33 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
style.css
wp.quins.us/wp-content/themes/ad-mania/
275 KB
54 KB
Stylesheet
General
Full URL
https://wp.quins.us/wp-content/themes/ad-mania/style.css?ver=6.7.1
Requested by
Host: u88469-drco.quins.us
URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.146.19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f45ba6e591fdca93355b8a145c736f8eece478edfec3fd6d3e7c56de3a601005

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"44d72-672fca51-503c51cd;br"
age
2361
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n2J0R3Y%2FMrWm%2F5nu4C8WmLuD1pNQry4Jc6NOGui5BaYqDsNIBMdUKuNsvLsrIGRBuvlEBBk4S55NYTCYQCZp8o%2FpoJriNDfykaLc8%2BkJTzgh9YGrwMCAxPtzFGwwaw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Sat, 07 Dec 2024 13:20:29 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=47322&min_rtt=46775&rtt_var=337&sent=64&recv=34&lost=0&retrans=0&sent_bytes=56638&recv_bytes=8917&delivery_rate=49254&cwnd=19200&unsent_bytes=0&cid=3d7997f6ed462ed2&ts=2457&x=1", cfExtPri, cfHdrFlush;dur=35
date
Fri, 13 Dec 2024 14:19:33 GMT
content-type
text/css
last-modified
Sat, 09 Nov 2024 20:47:13 GMT
vary
Accept-Encoding
priority
u=0,i=?0
cache-control
public, max-age=604800
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8f169700ebb9b15b-WAW
x-turbo-charged-by
LiteSpeed
server
cloudflare
jquery.min.js
u88469-drco.quins.us/wp-includes/js/jquery/
86 KB
32 KB
Script
General
Full URL
https://u88469-drco.quins.us/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Requested by
Host: u88469-drco.quins.us
URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.146.19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"15601-672fca53-580f1eef;br"
age
789
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HBYMxgQsF2BRJQpPd%2FbbFfp837cYyb4KzA15D%2BIUwjeR3kL6OGAKwaf0h5Ivo90voOvJ%2BxNVBuDxJxSAjSFgu5pPT4UgSLIYE5opPBbhsnh8uHadvVIzzwuO4EdEr74pJSewp%2FDpww%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=47322&min_rtt=46775&rtt_var=337&sent=57&recv=34&lost=0&retrans=0&sent_bytes=49438&recv_bytes=8917&delivery_rate=49254&cwnd=19200&unsent_bytes=0&cid=3d7997f6ed462ed2&ts=2445&x=1", cfExtPri, cfHdrFlush;dur=0
date
Fri, 13 Dec 2024 14:19:33 GMT
content-type
text/javascript
last-modified
Sat, 09 Nov 2024 20:47:15 GMT
vary
Accept-Encoding
priority
u=1,i=?0
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8f169700dba8b15b-WAW
x-turbo-charged-by
LiteSpeed
server
cloudflare
jquery-migrate.min.js
u88469-drco.quins.us/wp-includes/js/jquery/
13 KB
6 KB
Script
General
Full URL
https://u88469-drco.quins.us/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Requested by
Host: u88469-drco.quins.us
URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.146.19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"3509-672fca53-580a021b;br"
age
789
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g2WiaLoLBiPU7KYgZNJ01wNR13y0AO6%2Bl44uNtA%2BWzFLFXT6o%2FiL2rA0j8ujo%2FhH%2Fp%2F62dBvgFgaj8BNahYubYtby5t2FlsMln73%2BMYSn%2F59zNiUzSqnCMbkD9D%2FJYniy%2FhEUIiNxw%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=47322&min_rtt=46775&rtt_var=337&sent=64&recv=34&lost=0&retrans=0&sent_bytes=56638&recv_bytes=8917&delivery_rate=49254&cwnd=19200&unsent_bytes=0&cid=3d7997f6ed462ed2&ts=2447&x=1", cfExtPri, cfHdrFlush;dur=45
date
Fri, 13 Dec 2024 14:19:33 GMT
content-type
text/javascript
last-modified
Sat, 09 Nov 2024 20:47:15 GMT
vary
Accept-Encoding
priority
u=1,i=?0
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8f169700dbaab15b-WAW
x-turbo-charged-by
LiteSpeed
server
cloudflare
js
www.googletagmanager.com/gtag/
323 KB
108 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-2C0YTSFLGP
Requested by
Host: u88469-drco.quins.us
URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
6d618c8f87237e1f20b8985f74f6aa7c3e103ff6740df7fdb87a55adb6c35ffd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Fri, 13 Dec 2024 14:19:34 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 13 Dec 2024 14:19:34 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
109798
x-xss-protection
0
server
Google Tag Manager
api.js
js.hcaptcha.com/1/
147 KB
47 KB
Script
General
Full URL
https://js.hcaptcha.com/1/api.js
Requested by
Host: u88469-drco.quins.us
URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.230.21 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
471b3a2fdebd0af1fe0dc65379c3126c1a09621001c7344e1f3e074c6414d9e2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
"b6d570cb6bbbb0aecdb3dbec52e8cc75"
age
0
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Fri, 13 Dec 2024 14:19:34 GMT
content-type
application/javascript
vary
Origin, Accept-Encoding
priority
u=3,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=300
cross-origin-resource-policy
cross-origin
cf-ray
8f1697027f3ff8b4-ARN
accept-ranges
bytes
content-length
48182
server
cloudflare
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/
87 KB
28 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js
Requested by
Host: u88469-drco.quins.us
URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://u88469-drco.quins.us
Referer
https://u88469-drco.quins.us/

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"5eb09ed3-15d84"
age
51707
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xPPkuJNfamPr4hECqQ0b29RbWuBOweF6Luut8EiYcB5eVKUdYYBE%2BJmtSnMd4pcvbkEgu6A6%2B4QYY4v9z4ztSE8dHm917BlzyeqRl7txKH8ZqM52y0DLudTJr7rS34be4%2FURU1F5"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Wed, 03 Dec 2025 14:19:33 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Fri, 13 Dec 2024 14:19:33 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 04 May 2020 23:01:39 GMT
vary
Accept-Encoding
priority
u=1,i=?0
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8f1697011dd72d6f-ARN
accept-ranges
bytes
access-control-allow-origin
*
content-length
27958
server
cloudflare
9447ae94-e2f0-42a3-bd67-de2ea876ab01
https://u88469-drco.quins.us/
0
0

7ed72ff64a688860389bd8b8f51295fa
secure.gravatar.com/avatar/
1 KB
1 KB
Image
General
Full URL
https://secure.gravatar.com/avatar/7ed72ff64a688860389bd8b8f51295fa?s=20&d=mm&r=g
Requested by
Host: u88469-drco.quins.us
URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d99a69bb4378e72447801980ad59e8a7a9aac03e840895f71559b25ddb92b749

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

link
<https://gravatar.com/avatar/7ed72ff64a688860389bd8b8f51295fa?s=20&d=mm&r=g>; rel="canonical"
cache-control
max-age=300
x-nc
HIT arn 2
expires
Fri, 13 Dec 2024 14:24:34 GMT
accept-ranges
bytes
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
1028
date
Fri, 13 Dec 2024 14:19:34 GMT
content-type
image/png
last-modified
Fri, 10 Apr 2020 14:47:13 GMT
server
nginx
content-disposition
inline; filename="7ed72ff64a688860389bd8b8f51295fa.png"
stub
cache.consentframework.com/js/pa/44627/c/8dmJy/
4 KB
2 KB
Script
General
Full URL
https://cache.consentframework.com/js/pa/44627/c/8dmJy/stub
Requested by
Host: u88469-drco.quins.us
URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4a69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3902986a7667133e8b20ceedb7967f3ce3b67021d0969bbae35a4b422931035
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

content-encoding
br
cf-cache-status
HIT
age
523
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tHY8nB%2FWQcgI%2Bjcq6CSxYDhiP2D2aNPhcpBCPPdrF1M0nnPL3N0Xwma2K%2BeAuKfnGfgbVC2z5i9Nj2csUNBhNj1i4fkYABVUgTaEBO1CM4YQ2DzvUVDVNnDccLub21Y9%2Bd5C7NBVyH2mOOYrPRqIhzFFIu6lxOqL"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods
GET,POST,OPTIONS
server-timing
cfL4;desc="?proto=TCP&rtt=30174&min_rtt=30151&rtt_var=6379&sent=7&recv=10&lost=0&retrans=0&sent_bytes=4005&recv_bytes=2231&delivery_rate=133902&cwnd=252&unsent_bytes=0&cid=cf57856b0d66a31d&ts=48&x=0"
date
Fri, 13 Dec 2024 14:19:34 GMT
content-type
text/javascript; charset=UTF-8
last-modified
Fri, 13 Dec 2024 14:10:51 GMT
vary
Accept-Encoding
access-control-allow-headers
Content-Type
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, max-age=3600
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8f1697030eb98d57-HEL
server
cloudflare
wp-emoji-release.min.js
u88469-drco.quins.us/wp-includes/js/
18 KB
6 KB
Script
General
Full URL
https://u88469-drco.quins.us/wp-includes/js/wp-emoji-release.min.js?ver=6.7.1
Requested by
Host: u88469-drco.quins.us
URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.146.19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/

Response headers

content-encoding
zstd
cf-cache-status
REVALIDATED
etag
W/"4926-672fca53-300b390b;br"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=81O9wVMcA4XfQW4xKj3X%2F%2FnU8VyD3NZG6MT%2BaZb1uMoQ14nx3C0B72YJJEe6fL3XvMM8UqvcfX58oUSwplY%2BoER33FkvtSSBqaT0bDe5MR3T5xZ4ljThswdOzEi9iz6BpL%2FbpArfPA%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=47498&min_rtt=46736&rtt_var=385&sent=209&recv=77&lost=0&retrans=0&sent_bytes=222677&recv_bytes=11144&delivery_rate=2007270&cwnd=96000&unsent_bytes=0&cid=3d7997f6ed462ed2&ts=3123&x=1", cfExtPri, cfHdrFlush;dur=0
date
Fri, 13 Dec 2024 14:19:34 GMT
content-type
text/javascript
last-modified
Sat, 09 Nov 2024 20:47:15 GMT
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8f169702cdd2b15b-WAW
x-turbo-charged-by
LiteSpeed
server
cloudflare
S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/
23 KB
23 KB
Font
General
Full URL
https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Noto+Serif%3A400+%7CLato%3A100%26subset%3Dcyrillic%2Ccyrillic
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.206.67 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lhr35s11-in-f3.1e100.net
Software
sffe /
Resource Hash
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://u88469-drco.quins.us
Referer
https://fonts.googleapis.com/

Response headers

age
277559
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 10 Dec 2025 09:13:35 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 10 Dec 2024 09:13:35 GMT
last-modified
Tue, 02 May 2023 15:17:22 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
23580
x-xss-protection
0
server
sffe
fa-solid-900.woff2
wp.quins.us/wp-content/themes/ad-mania/fonts/awesomeicons/
0
0

fa-solid-900.woff
wp.quins.us/wp-content/themes/ad-mania/fonts/awesomeicons/
0
0

cmp
choices.consentframework.com/js/pa/44627/c/8dmJy/
1 MB
306 KB
Script
General
Full URL
https://choices.consentframework.com/js/pa/44627/c/8dmJy/cmp
Requested by
Host: u88469-drco.quins.us
URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4a69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a7b9cd89c2f39f1c721da7e4e4db81cf3c1f99892000301ed95d568e8171e0cb
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

content-encoding
gzip
cf-cache-status
HIT
age
320
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BpKeqn7z6lKMQ3RiXyF6BPvtEfVLVVXtd5Rbb58Jw08IIiq7sYhtlJgzeIN9BpLoixdRGee%2BzNVUPdLHsFlnHCskycCho8UK493DUAwJpHWqGTCwjf4%2BSd7nJIw3Fb4rQdGVXBrEG%2BDWR9lzhpJGn6Zp0aTV%2FInB6P8%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods
GET,POST,OPTIONS
server-timing
cfL4;desc="?proto=TCP&rtt=35398&min_rtt=30151&rtt_var=13104&sent=12&recv=14&lost=0&retrans=0&sent_bytes=5910&recv_bytes=2350&delivery_rate=133902&cwnd=256&unsent_bytes=0&cid=cf57856b0d66a31d&ts=142&x=0"
date
Fri, 13 Dec 2024 14:19:34 GMT
content-type
text/javascript; charset=UTF-8
last-modified
Fri, 13 Dec 2024 14:14:14 GMT
vary
Accept-Encoding
access-control-allow-headers
Content-Type
strict-transport-security
max-age=15724800; includeSubDomains; preload
cache-control
public, max-age=3600
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8f169703af608d57-HEL
server
cloudflare
gpt.js
securepubads.g.doubleclick.net/tag/js/
104 KB
33 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: u88469-drco.quins.us
URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
cafe /
Resource Hash
59b7b182b48891b754265c7c1e45be3b1e81f3cff47735a5d551f2754992f9ac
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

content-encoding
br
etag
769 / 20070 / m202412090101 / config-hash: 16775640167977932469
x-content-type-options
nosniff
expires
Fri, 13 Dec 2024 14:19:34 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Fri, 13 Dec 2024 14:19:34 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
content-disposition
attachment; filename="f.txt"
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
33541
x-xss-protection
0
server
cafe
fi.json
newassets.hcaptcha.com/captcha/v1/94cdacf/static/i18n/
9 KB
4 KB
XHR
General
Full URL
https://newassets.hcaptcha.com/captcha/v1/94cdacf/static/i18n/fi.json
Requested by
Host: js.hcaptcha.com
URL: https://js.hcaptcha.com/1/api.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.229.21 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3154f631f6f80884d2f26d5629c6206c36ce3287660635a0e702aca110f007dd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

access-control-max-age
3000
content-encoding
gzip
cf-cache-status
MISS
etag
"f734aa0396f7ce187b67e63de41d73c6"
access-control-allow-methods
GET, HEAD
x-content-type-options
nosniff
expires
Fri, 13 Dec 2024 15:19:34 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Fri, 13 Dec 2024 14:19:34 GMT
content-type
application/json
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
priority
u=1,i
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=3600
cf-ray
8f16970409359908-ARN
accept-ranges
bytes
access-control-allow-origin
*
content-length
3509
server
cloudflare
fa-solid-900.ttf
wp.quins.us/wp-content/themes/ad-mania/fonts/awesomeicons/
0
0

consent-string
api.consentframework.com/api/v1/public/
534 B
922 B
Fetch
General
Full URL
https://api.consentframework.com/api/v1/public/consent-string
Requested by
Host: choices.consentframework.com
URL: https://choices.consentframework.com/js/pa/44627/c/8dmJy/cmp
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a01:4f8:fff2:10:: , Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),
Reverse DNS
Software
/
Resource Hash
d40b1b16872c36770d41f55e4891d304c79651623bc895a379966e4abf26d576
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://u88469-drco.quins.us/

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
Cache-Control
no-store
Connection
keep-alive
Access-Control-Allow-Methods
GET,POST,OPTIONS
Access-Control-Allow-Origin
https://u88469-drco.quins.us
Content-Length
534
Date
Fri, 13 Dec 2024 14:19:34 GMT
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Headers
Content-Type
user-action
api.consentframework.com/api/v1/public/
0
339 B
Fetch
General
Full URL
https://api.consentframework.com/api/v1/public/user-action
Requested by
Host: choices.consentframework.com
URL: https://choices.consentframework.com/js/pa/44627/c/8dmJy/cmp
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a01:4f8:fff2:10:: , Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://u88469-drco.quins.us/

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
Cache-Control
no-store
Connection
keep-alive
Access-Control-Allow-Methods
GET,POST,OPTIONS
Access-Control-Allow-Origin
https://u88469-drco.quins.us
Content-Length
0
Date
Fri, 13 Dec 2024 14:19:34 GMT
Access-Control-Allow-Headers
Content-Type
truncated
/
19 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
27fcf25fa0802f7d0de4af73b5300f7c7805df22f182e3f366adf029f4c51ce4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/
6 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d7050c434e454737459714e12822afe9873651b17ba910136a8088e1ea6ded5e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202412090101/
492 KB
153 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202412090101/pubads_impl.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
cafe /
Resource Hash
04d85fdaa240e9c6964c1b3afe75b8802720a8d9a98e6c35f346f599b1113af4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

content-encoding
br
etag
5395541545685299795
age
18196
x-content-type-options
nosniff
expires
Sat, 13 Dec 2025 09:16:18 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Fri, 13 Dec 2024 09:16:18 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
156760
x-xss-protection
0
server
cafe
prebid-bundle.js
cdn.profitsfly.com/prebid/
217 KB
69 KB
Script
General
Full URL
https://cdn.profitsfly.com/prebid/prebid-bundle.js?v=1734099574689
Requested by
Host: u88469-drco.quins.us
URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cd951a3f912898b54b76fa059241f8339362b7aec43009356541bd32c3fa88b4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

content-encoding
zstd
cf-cache-status
MISS
etag
W/"36341-674b36a2-3e1a7e15;br"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2h%2FlRLNCd2gWnGWpz8%2FFBi4x2kdh1Cjlb5W3A8lUaJBbsq%2FKZdfX58J4KZh9tSnw%2FC62Rf5UoNwdBETN8PKFxcwab5aUY8odJLPYh%2Bt1m1kneRqdXKc%2BuOkiw9PB8mFM5zi%2BaZg%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=47095&min_rtt=46830&rtt_var=7605&sent=11&recv=10&lost=0&retrans=0&sent_bytes=4140&recv_bytes=4394&delivery_rate=387&cwnd=12000&unsent_bytes=0&cid=cba7751995670a41&ts=669&x=1", cfExtPri, cfHdrFlush;dur=0
date
Fri, 13 Dec 2024 14:19:35 GMT
content-type
text/javascript
last-modified
Sat, 30 Nov 2024 16:00:34 GMT
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8f1697066f30ecbf-WAW
x-turbo-charged-by
LiteSpeed
server
cloudflare
collect
www.google-analytics.com/g/
0
0
Fetch
General
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-2C0YTSFLGP&gtm=45je4cb0v9198525174za200&_p=1734099574091&gcd=13l3l3l3l1l1&npa=0&dma=0&tcfd=10000&tag_exp=101925629~102067555~102067808~102081485~102123608~102198178&cid=993552474.1734099575&ul=fi-fi&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1734099574&sct=1&seg=0&dl=https%3A%2F%2Fu88469-drco.quins.us%2Fhow-to-find-the-best-hotels-in-canada-a-comprehensive-guide%2F&dt=How%20to%20Find%20the%20Best%20Hotels%20in%20Canada%3A%20A%20Comprehensive%20Guide%20%E2%80%93%20CryptedNews&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2019
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2C0YTSFLGP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://u88469-drco.quins.us
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 13 Dec 2024 14:19:34 GMT
content-type
text/plain
server
Golfe2
collect
www.google-analytics.com/g/
0
0
Fetch
General
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-2C0YTSFLGP&gtm=45je4cb0v9198525174za200&_p=1734099574091&gcs=G100&gcd=13q3q3q3q5l1&npa=1&dma_cps=-&dma=0&tcfd=10000&tag_exp=101925629~102067555~102067808~102081485~102123608~102198178&gdid=dOWE1OT&cid=1559930085.1734099575&ul=fi-fi&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=denied&_eu=AEA&_s=2&sid=1734099574&sct=1&seg=0&dl=https%3A%2F%2Fu88469-drco.quins.us%2Fhow-to-find-the-best-hotels-in-canada-a-comprehensive-guide%2F&dt=How%20to%20Find%20the%20Best%20Hotels%20in%20Canada%3A%20A%20Comprehensive%20Guide%20%E2%80%93%20CryptedNews&en=scroll&_fv=1&_nsi=1&_ss=1&epn.percent_scrolled=90&tfd=2046
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2C0YTSFLGP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://u88469-drco.quins.us
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 13 Dec 2024 14:19:34 GMT
content-type
text/plain
server
Golfe2
22195652661
fundingchoicesmessages.google.com/i/
197 KB
65 KB
Script
General
Full URL
https://fundingchoicesmessages.google.com/i/22195652661?ers=3
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202412090101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e23146b019ba1480229b97f53fb721a0a0c70af3e56b6e049f3dc9ec56d09337
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-_jpp4IuxQdOteJ5P6Z71nw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 13 Dec 2024 14:19:35 GMT
content-type
application/javascript; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmII1pBikPj6kkkNiJ3SZ7AGAHHrzXOsk4HYaO15VgcgTvp3nrUAiA0VLrHaA7Fj0SVWTyBW7bnEagzE99ddYn0OxB_qL7P-AOIZ5y-zLgDiIokrrA1AzPD1CisHEAtxc3xv-biLTeDAzYvxShpJ-YXxyfl5JUWZSaUl-UVpyWmpxalFZalF8UYGRiaGRoYGegZG8QVGAGGJRcM"
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-_jpp4IuxQdOteJ5P6Z71nw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control
no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin
*
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection
0
server
ESF
AGSKWxV_ltJ13K5RJeHs5KIA1Rk7UTmy6IOim6DxmpIaVfdTBYkCDg9-wB7Jt_e62rse0NWl3VlhQalZARhlcdwEB4PadCWP1BI2HAh4L4sIv7-qc__7g4o4FZmmYLQhsEk1WumnMUjfnA==
fundingchoicesmessages.google.com/f/
10 KB
5 KB
Script
General
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxV_ltJ13K5RJeHs5KIA1Rk7UTmy6IOim6DxmpIaVfdTBYkCDg9-wB7Jt_e62rse0NWl3VlhQalZARhlcdwEB4PadCWP1BI2HAh4L4sIv7-qc__7g4o4FZmmYLQhsEk1WumnMUjfnA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzM0MDk5NTc1LDQxMjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly91ODg0NjktZHJjby5xdWlucy51cy9ob3ctdG8tZmluZC10aGUtYmVzdC1ob3RlbHMtaW4tY2FuYWRhLWEtY29tcHJlaGVuc2l2ZS1ndWlkZS8iLG51bGwsW1s4LCJoQXYwWWpBVjItcyJdLFs5LCJmaSJdLFsxOSwiMiJdXV0
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.fi.hAv0YjAV2-s.es5.O/am=DAY/d=1/rs=AJlcJMw4Z1Ht8FL-slA-MzXp98HxK8WmpQ/m=kernel_loader,loader_js_executable
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c8d83ad288f724373128d60b64c2f37038d895783f3108f9ffeefa677c4b5df9
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-nzQEAnBlIDJpcbOj80piww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 13 Dec 2024 14:19:35 GMT
content-type
application/javascript; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmJw0ZBikPj6kkkNiJ3SZ7AGAHHrzXOsk4HYaO15VgcgTvp3nrUAiA0VLrHaA7Fj0SVWTyBW7bnEagzE99ddYn0OxB_qL7P-AOIZ5y-zLgDiIokrrA1AzPD1CisHEAvxcHxv-biLTWDFw3lvGZU0kvIL45Pz80qKMpNKS_KL0pLTUotTi8pSi-KNDIxMDI0MDfQMjOILjACcPkYB"
content-security-policy
script-src 'report-sample' 'nonce-nzQEAnBlIDJpcbOj80piww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control
no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin
*
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection
0
server
ESF
latest.json
cdn.jsdelivr.net/gh/prebid/currency-file@1/
2 KB
1 KB
Fetch
General
Full URL
https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json
Requested by
Host: cdn.profitsfly.com
URL: https://cdn.profitsfly.com/prebid/prebid-bundle.js?v=1734099574689
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
80d6f0f0bb6de64b443ca5d395b1536ce7599d0aea1c6d6d073db9d0a1a17245
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://u88469-drco.quins.us/

Response headers

access-control-expose-headers
*
content-encoding
br
etag
W/"639-mDBp8sQCw3eFURhTnqJX6T+4ZiE"
age
37119
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache
HIT, HIT
date
Fri, 13 Dec 2024 14:19:35 GMT
content-type
application/json; charset=utf-8
x-served-by
cache-fra-eddf8230103-FRA, cache-hel1410032-HEL
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=604800, s-maxage=43200
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
824
x-jsd-version
1.0.2268
cropped-android-chrome-192x192-1-32x32.png
wp.quins.us/wp-content/uploads/2024/03/
1 KB
2 KB
Other
General
Full URL
https://wp.quins.us/wp-content/uploads/2024/03/cropped-android-chrome-192x192-1-32x32.png
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.146.19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a298400cc6236a4a7439ff3511e3b4d6d9fa158d640b268b317e14bce2610fb5

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

cf-cache-status
HIT
etag
"430-672fca52-70b14cf9;;;"
age
3624
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ggEhH6BgIbjewmP23lb9W%2BvakVGVXcvWkY8qOGGsQxiKeTRypOggY3R%2B1orlU97KPLsS1nZDHiIGA2PxZnptw%2FmU%2BI4RgA7nw4levlf0vC%2B%2FK%2BnA8mufrNnPuOiz6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
Sat, 07 Dec 2024 14:55:37 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=47468&min_rtt=46736&rtt_var=348&sent=216&recv=79&lost=0&retrans=0&sent_bytes=228891&recv_bytes=11639&delivery_rate=14014&cwnd=96000&unsent_bytes=0&cid=3d7997f6ed462ed2&ts=4225&x=1", cfExtPri, cfHdrFlush;dur=0
date
Fri, 13 Dec 2024 14:19:35 GMT
content-type
image/png
last-modified
Sat, 09 Nov 2024 20:47:14 GMT
vary
Accept-Encoding
priority
u=1,i
cache-control
public, max-age=604800
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8f16970bff93b15b-WAW
accept-ranges
bytes
content-length
1072
x-turbo-charged-by
LiteSpeed
server
cloudflare
hb
cpm.revbid.net/
0
241 B
Fetch
General
Full URL
https://cpm.revbid.net/hb?zone=243133&v=1.7
Requested by
Host: cdn.profitsfly.com
URL: https://cdn.profitsfly.com/prebid/prebid-bundle.js?v=1734099574689
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
103.67.200.72 Singapore, Singapore, ASN60558 (SECUREDSERVERS-EU PHOENIX NAP, LLC., US),
Reverse DNS
1.cpm.ams1.wowcon.net
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://u88469-drco.quins.us/

Response headers

Access-Control-Allow-Origin
https://u88469-drco.quins.us
Cache-Control
no-store
Content-Length
0
Date
Fri, 13 Dec 2024 14:19:36 GMT
Server
nginx
Connection
close
Access-Control-Allow-Credentials
true
hb
cpm.fmlabsonline.com/
0
241 B
Fetch
General
Full URL
https://cpm.fmlabsonline.com/hb?zone=246305&v=1.7
Requested by
Host: cdn.profitsfly.com
URL: https://cdn.profitsfly.com/prebid/prebid-bundle.js?v=1734099574689
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
103.67.200.72 Singapore, Singapore, ASN60558 (SECUREDSERVERS-EU PHOENIX NAP, LLC., US),
Reverse DNS
1.cpm.ams1.wowcon.net
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://u88469-drco.quins.us/

Response headers

Access-Control-Allow-Origin
https://u88469-drco.quins.us
Cache-Control
no-store
Content-Length
0
Date
Fri, 13 Dec 2024 14:19:36 GMT
Server
nginx
Connection
close
Access-Control-Allow-Credentials
true
kantarmedia._468x60px_
fundingchoicesmessages.google.com/f/AGSKWxW-vJ66AczKNl163gRMy5a0qPnomDYTb6OxZ51-VoxH3poKzTx3P-GJqLIlpXmv2mzkzX5IjbR3L7QtzrDLlX5q8fvhMp5d94NC4GCFXk6NFidLZbscUEcKdM5I9CZT038WEsvf97InXlB4U_h5ksah7vVyb...
54 B
109 B
Script
General
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxW-vJ66AczKNl163gRMy5a0qPnomDYTb6OxZ51-VoxH3poKzTx3P-GJqLIlpXmv2mzkzX5IjbR3L7QtzrDLlX5q8fvhMp5d94NC4GCFXk6NFidLZbscUEcKdM5I9CZT038WEsvf97InXlB4U_h5ksah7vVyb7Juy-0bixtjab-cr80b3TZBrKK9Q67b/_/adblockpopup./adsbytenmax._admanager//kantarmedia._468x60px_
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.fi.hAv0YjAV2-s.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMxwOK9YL0KL7bw3XBAWV0jGCyhKdA/m=ad_blocking_detection_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.74.206 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s02-in-f14.1e100.net
Software
ESF /
Resource Hash
dab451f9c95ada9ee5229eefbff8e88fa49fa8a585fd56953271ec0164057a9f
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-kjxVdv8IUmL6zK_c_h0X4w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 13 Dec 2024 14:19:36 GMT
content-type
application/javascript; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjqtDikmJw0ZBiOHHrNtMFIJb4-pJJDYid0mewBgBx681zrJOB2GjteVYHIE76d561AIgNFS6x2gOxY9ElVk8gVu25xGoMxPfXXWJ9DsQf6i-z_gDiGecvsy4A4iKJK6wNQMzw9QorBxAL8XD8aPm4i03gxZFNqxmVNJLyC-OT8_NKijKTSkvyi9KS01KLU4vKUovijQyMTAyNDA30DIziC4wA5_5LBQ"
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-kjxVdv8IUmL6zK_c_h0X4w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection
0
server
ESF
rum.js
pagead2.googlesyndication.com/pagead/js/
70 KB
26 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/rum.js?fcd=true
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.fi.hAv0YjAV2-s.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMxwOK9YL0KL7bw3XBAWV0jGCyhKdA/m=ad_blocking_detection_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f162.1e100.net
Software
cafe /
Resource Hash
cf93db5f15fb6b90864ea934827bca87f92e75ad6a3aab83881b1f6777ee8929
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

content-encoding
br
etag
82456162888936996
age
3229
x-content-type-options
nosniff
expires
Fri, 13 Dec 2024 14:25:47 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Fri, 13 Dec 2024 13:25:47 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
26167
x-xss-protection
0
server
cafe
AGSKWxXk2lAZDxLEXOOZ7Nz2V8VDN7krxQWA7-VRlFLP1DMUtWlq4_On40ZV4oxa7LCTJGfZ-gehQO7OdIYIqHWllbaAQ_s5JcNsWzxv6rlWl_ZiBfrkKKLgA96ZHGg_hprRAWhf2hY5Qw==
fundingchoicesmessages.google.com/el/
0
28 B
XHR
General
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxXk2lAZDxLEXOOZ7Nz2V8VDN7krxQWA7-VRlFLP1DMUtWlq4_On40ZV4oxa7LCTJGfZ-gehQO7OdIYIqHWllbaAQ_s5JcNsWzxv6rlWl_ZiBfrkKKLgA96ZHGg_hprRAWhf2hY5Qw==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.fi.hAv0YjAV2-s.es5.O/am=DAY/d=1/rs=AJlcJMw4Z1Ht8FL-slA-MzXp98HxK8WmpQ/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.74.206 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s02-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-9iAc4PMgZqXBLPwpLhZV7A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://u88469-drco.quins.us/

Response headers

access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 13 Dec 2024 14:19:36 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmJw1ZBicEqfwRoCxB_qL7P-AGKGr1dYOYBYiIfjR8vHXWwCLy6cO8Wo5JKUXxifnJ9XkppXopuYUqwLYhdlJpWW5BehsFPLQCpy8tPTM_PS440MjEwMjQwN9QzM4wsMADXlK6Y"
content-security-policy
script-src 'report-sample' 'nonce-9iAc4PMgZqXBLPwpLhZV7A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin
https://u88469-drco.quins.us
content-length
0
x-xss-protection
0
server
ESF
AGSKWxXk2lAZDxLEXOOZ7Nz2V8VDN7krxQWA7-VRlFLP1DMUtWlq4_On40ZV4oxa7LCTJGfZ-gehQO7OdIYIqHWllbaAQ_s5JcNsWzxv6rlWl_ZiBfrkKKLgA96ZHGg_hprRAWhf2hY5Qw==
fundingchoicesmessages.google.com/el/
0
28 B
XHR
General
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxXk2lAZDxLEXOOZ7Nz2V8VDN7krxQWA7-VRlFLP1DMUtWlq4_On40ZV4oxa7LCTJGfZ-gehQO7OdIYIqHWllbaAQ_s5JcNsWzxv6rlWl_ZiBfrkKKLgA96ZHGg_hprRAWhf2hY5Qw==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.fi.hAv0YjAV2-s.es5.O/am=DAY/d=1/rs=AJlcJMw4Z1Ht8FL-slA-MzXp98HxK8WmpQ/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.74.206 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s02-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-IS5e4R6IVffZQMLOzkV7ig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://u88469-drco.quins.us/

Response headers

access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 13 Dec 2024 14:19:36 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmLw1pBicEqfwRoCxB_qL7P-AGKGr1dYOYBYiIfjR8vHXWwCB1btus2o5JKUXxifnJ9XkppXopuYUqwLYhdlJpWW5BehsFPLQCpy8tPTM_PS440MjEwMjQwN9QzM4wsMACDlK1s"
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-IS5e4R6IVffZQMLOzkV7ig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin
https://u88469-drco.quins.us
content-length
0
x-xss-protection
0
server
ESF
AGSKWxXk2lAZDxLEXOOZ7Nz2V8VDN7krxQWA7-VRlFLP1DMUtWlq4_On40ZV4oxa7LCTJGfZ-gehQO7OdIYIqHWllbaAQ_s5JcNsWzxv6rlWl_ZiBfrkKKLgA96ZHGg_hprRAWhf2hY5Qw==
fundingchoicesmessages.google.com/el/
0
28 B
XHR
General
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxXk2lAZDxLEXOOZ7Nz2V8VDN7krxQWA7-VRlFLP1DMUtWlq4_On40ZV4oxa7LCTJGfZ-gehQO7OdIYIqHWllbaAQ_s5JcNsWzxv6rlWl_ZiBfrkKKLgA96ZHGg_hprRAWhf2hY5Qw==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.fi.hAv0YjAV2-s.es5.O/am=DAY/d=1/rs=AJlcJMw4Z1Ht8FL-slA-MzXp98HxK8WmpQ/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.74.206 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s02-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-FNbZyrhlNvTLi0CiiBvxwg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://u88469-drco.quins.us/

Response headers

access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 13 Dec 2024 14:19:36 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmII1pBicEqfwRoCxB_qL7P-AGKGr1dYOYBYiIfjR8vHXWwCG46_WMik5JKUXxifnJ9XkppXopuYUqwLYhdlJpWW5BehsFPLQCpy8tPTM_PS440MjEwMjQwN9QzM4wsMACUsK2U"
content-security-policy
script-src 'report-sample' 'nonce-FNbZyrhlNvTLi0CiiBvxwg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin
https://u88469-drco.quins.us
content-length
0
x-xss-protection
0
server
ESF
AGSKWxXk2lAZDxLEXOOZ7Nz2V8VDN7krxQWA7-VRlFLP1DMUtWlq4_On40ZV4oxa7LCTJGfZ-gehQO7OdIYIqHWllbaAQ_s5JcNsWzxv6rlWl_ZiBfrkKKLgA96ZHGg_hprRAWhf2hY5Qw==
fundingchoicesmessages.google.com/el/
0
28 B
XHR
General
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxXk2lAZDxLEXOOZ7Nz2V8VDN7krxQWA7-VRlFLP1DMUtWlq4_On40ZV4oxa7LCTJGfZ-gehQO7OdIYIqHWllbaAQ_s5JcNsWzxv6rlWl_ZiBfrkKKLgA96ZHGg_hprRAWhf2hY5Qw==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.fi.hAv0YjAV2-s.es5.O/am=DAY/d=1/rs=AJlcJMw4Z1Ht8FL-slA-MzXp98HxK8WmpQ/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.74.206 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s02-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-2QT-5SpCPhBS83A6-WEYIg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://u88469-drco.quins.us/

Response headers

access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 13 Dec 2024 14:19:36 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmLw0pBicEqfwRoCxB_qL7P-AGKGr1dYOYBYiIfjR8vHXWwCOzYfW8qk5JKUXxifnJ9XkppXopuYUqwLYhdlJpWW5BehsFPLQCpy8tPTM_PS440MjEwMjQwN9QzM4wsMABU6KzI"
content-security-policy
script-src 'report-sample' 'nonce-2QT-5SpCPhBS83A6-WEYIg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin
https://u88469-drco.quins.us
content-length
0
x-xss-protection
0
server
ESF
AGSKWxWTIlLX3HDRmHh4e_daEkh8HqB8m-eKUrZcXYgaiNZjEVppg-FOpr_DqmMZYWxngIFqlPwyLN-xnWCdKqHl778Z4Tf5EHrEGnkkWlGCLwmPVkgP5Hmez2dD55xUYvPM6iT9xrs9QQ==
fundingchoicesmessages.google.com/f/
426 KB
63 KB
Script
General
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxWTIlLX3HDRmHh4e_daEkh8HqB8m-eKUrZcXYgaiNZjEVppg-FOpr_DqmMZYWxngIFqlPwyLN-xnWCdKqHl778Z4Tf5EHrEGnkkWlGCLwmPVkgP5Hmez2dD55xUYvPM6iT9xrs9QQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzM0MDk5NTc2LDU3MDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vdTg4NDY5LWRyY28ucXVpbnMudXMvaG93LXRvLWZpbmQtdGhlLWJlc3QtaG90ZWxzLWluLWNhbmFkYS1hLWNvbXByZWhlbnNpdmUtZ3VpZGUvIixudWxsLFtbOCwiaEF2MFlqQVYyLXMiXSxbOSwiZmkiXSxbMTksIjIiXV1d
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.fi.hAv0YjAV2-s.es5.O/am=DAY/d=1/rs=AJlcJMw4Z1Ht8FL-slA-MzXp98HxK8WmpQ/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.74.206 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s02-in-f14.1e100.net
Software
ESF /
Resource Hash
064b711123af2d34621a0cdf2034b48435146c6b6bb543435f1d80c676f141dd
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-yRKHVFUgEUyWcUdHn_EugA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 13 Dec 2024 14:19:36 GMT
content-type
application/javascript; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmJw1ZBikPj6kkkNiJ3SZ7AGAHHrzXOsk4HYaO15VgcgTvp3nrUAiA0VLrHaA7Fj0SVWTyBW7bnEagzE99ddYn0OxB_qL7P-AOIZ5y-zLgDiIokrrA1AzPD1CisHEAvxcPxo-biLTeDFpbXbmJQ0kvIL45Pz80qKMpNKS_KL0pLTUotTi8pSi-KNDIxMDI0MDfQMjOILjACff0YN"
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-yRKHVFUgEUyWcUdHn_EugA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control
no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin
*
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection
0
server
ESF
csi
csi.gstatic.com/
0
532 B
Ping
General
Full URL
https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=1~m4mu44qg&ctx=0&met.9=1.1jj~2.1qu
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/rum.js?fcd=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2800:3f0:4001:81a::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgcc:41:0"}],}
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgcc:41:0
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 13 Dec 2024 14:19:37 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
content-type
image/gif
server
Golfe2
ping
pagead2.googlesyndication.com/pagead/
0
0
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202412090101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f162.1e100.net
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://u88469-drco.quins.us/

Response headers

/
googleads.g.doubleclick.net/pagead/interaction/
0
0
Fetch
General
Full URL
https://googleads.g.doubleclick.net/pagead/interaction/
Requested by
Host: u88469-drco.quins.us
URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://u88469-drco.quins.us/

Response headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
u88469-drco.quins.us
URL
blob:https://u88469-drco.quins.us/9447ae94-e2f0-42a3-bd67-de2ea876ab01
Domain
wp.quins.us
URL
https://wp.quins.us/wp-content/themes/ad-mania/fonts/awesomeicons/fa-solid-900.woff2
Domain
wp.quins.us
URL
https://wp.quins.us/wp-content/themes/ad-mania/fonts/awesomeicons/fa-solid-900.woff
Domain
wp.quins.us
URL
https://wp.quins.us/wp-content/themes/ad-mania/fonts/awesomeicons/fa-solid-900.ttf

Verdicts & Comments Add Verdict or Comment

83 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| _wpemojiSettings function| $ function| jQuery function| gtag object| dataLayer object| k2211J7jf string| superSecretValue number| wT9882 boolean| isFirstClickDone string| wpSiteUrl function| _0x23f3 function| _0x2f51 boolean| assDidCkeDone function| k function| P function| u function| bY function| W function| bp function| s function| b function| y function| bd function| n function| ika88jjd object| swpfuncs number| checkAdInterval number| checkWindowFocusIntervalgg string| originalTitle boolean| focusCheckStarted function| startFocusCheckIntervalgg function| startCheckAdRedirInterval function| displayClickMessage object| Raven object| hcaptcha object| grecaptcha string| gtmDataLayerName object| uetq object| googletag function| __sdcmpapi function| __tcfapi object| SDDAN object| regeneratorRuntime object| Sddan object| google_tag_manager object| google_tag_data object| ggeac object| google_js_reporting_queue function| onYouTubeIframeAPIReady object| gaGlobal object| twemoji object| wp object| google_reactive_ads_global_state object| default_ContributorServingResponseClientJs object| _F_toggles object| __googlefc string| __fcInvoked string| __fcexpdef string| OGViNGFmYmI2NWI5ZmNkNGxvYWRlcl9qcw== string| OGViNGFmYmI2NWI5ZmNkNGNhY2hlZF9qcw== object| googlefc object| __fcInternalApiManager boolean| __fcInternalApiPostMessageReady function| __uspapi object| __uspapiManager boolean| __uspapiPostMessageReady object| __gppEventListeners function| __gpp object| __gppManager boolean| __gppPostMessageReady object| pbjs object| pfpbjs boolean| 5f7383fc-fa4f-4adb-9eda-2832995629bf number| google_srt object| _google_rum_ns_

7 Cookies

Domain/Path Name / Value
droplink.co/ Name: AppSession
Value: fae82a44f8323b7edc773ef8d9e0b8c1
droplink.co/ Name: csrfToken
Value: f623b1ecd139c79cf608a3256a4c1d47d4621d0123f0cf62b2cf1bdefcc8cd8d51a3be7452180acce5a249af212a039921e0c378932c0ccdd4f2cdde73a65158
droplink.co/ Name: app_visitor
Value: Q2FrZQ%3D%3D.MmM3NGY3OTczMWYyN2UyZjBjMzVjNGZmYjAwZmNhN2FiNWZmYzg5ODhhMmVjMDY5MGY2MTBkYjdiYTUyZGJjML6neeemfj9GT8wVCNHUXscmBqYG7WuCkoFlb3jPGa5U2qrB5je1sj9SjDoRQNAPSbjfskT3Wbuid7TrIxp4V7TWsGAmqpHwSjAWA8lsFJfR
quins.us/ Name: SWPSessionID
Value: 23ee1d391c0056fc912826de6db93eb1e25f3d33e6d346df58e1587ab2d02b02
u88469-drco.quins.us/ Name: PHPSESSID
Value: nl7c1dp9gsfaivuaj01dbv5mv5
.quins.us/ Name: _ga_2C0YTSFLGP
Value: GS1.1.1734099574.1.0.1734099574.0.0.0
.quins.us/ Name: _ga
Value: GA1.1.993552474.1734099575

8 Console Messages

Source Level URL
Text
javascript error URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Message:
Access to font at 'https://wp.quins.us/wp-content/themes/ad-mania/fonts/awesomeicons/fa-solid-900.woff2' from origin 'https://u88469-drco.quins.us' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://wp.quins.us/wp-content/themes/ad-mania/fonts/awesomeicons/fa-solid-900.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Message:
Access to font at 'https://wp.quins.us/wp-content/themes/ad-mania/fonts/awesomeicons/fa-solid-900.woff' from origin 'https://u88469-drco.quins.us' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://wp.quins.us/wp-content/themes/ad-mania/fonts/awesomeicons/fa-solid-900.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://u88469-drco.quins.us/how-to-find-the-best-hotels-in-canada-a-comprehensive-guide/
Message:
Access to font at 'https://wp.quins.us/wp-content/themes/ad-mania/fonts/awesomeicons/fa-solid-900.ttf' from origin 'https://u88469-drco.quins.us' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://wp.quins.us/wp-content/themes/ad-mania/fonts/awesomeicons/fa-solid-900.ttf
Message:
Failed to load resource: net::ERR_FAILED
javascript warning URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js(Line 10)
Message:
Failed to execute 'write' on 'Document': It isn't possible to write into a document from an asynchronously-loaded external script unless it is explicitly opened.
network error URL: https://googleads.g.doubleclick.net/pagead/interaction/
Message:
Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.consentframework.com
cache.consentframework.com
cdn.jsdelivr.net
cdn.profitsfly.com
cdnjs.cloudflare.com
choices.consentframework.com
cpm.fmlabsonline.com
cpm.revbid.net
csi.gstatic.com
droplink.co
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
googleads.g.doubleclick.net
js.hcaptcha.com
newassets.hcaptcha.com
pagead2.googlesyndication.com
quins.us
secure.gravatar.com
securepubads.g.doubleclick.net
u88469-drco.quins.us
wp.quins.us
www.google-analytics.com
www.googletagmanager.com
u88469-drco.quins.us
wp.quins.us
103.67.200.72
104.17.24.14
104.19.229.21
104.19.230.21
142.250.185.130
142.250.74.206
172.67.146.19
188.114.96.3
216.58.206.67
216.58.212.130
216.58.212.162
2606:4700:20::ac43:4a69
2606:4700:3032::ac43:b202
2800:3f0:4001:81a::2003
2a00:1450:4001:803::200e
2a00:1450:4001:811::2008
2a00:1450:4001:828::200a
2a00:1450:4001:829::200e
2a01:4f8:fff2:10::
2a04:4e42:600::485
2a04:fa87:fffe::c000:4902
04d85fdaa240e9c6964c1b3afe75b8802720a8d9a98e6c35f346f599b1113af4
064b711123af2d34621a0cdf2034b48435146c6b6bb543435f1d80c676f141dd
27fcf25fa0802f7d0de4af73b5300f7c7805df22f182e3f366adf029f4c51ce4
2d25825c89e9e42bf60463aacb87c38307e0279e6f6517de818bac6021080f15
3154f631f6f80884d2f26d5629c6206c36ce3287660635a0e702aca110f007dd
3bb38d0f302677ff4104564454f60f495133579d6e6dfb722b3de850df596502
471b3a2fdebd0af1fe0dc65379c3126c1a09621001c7344e1f3e074c6414d9e2
4a007f84b241f4b5cd6376bd4ffd23964002ec13486aab9b433ae5361cda818b
4c360a33db1b0e7ed860ed890500ba49aae618a58114ee336224d7ca4fc2e623
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
59b7b182b48891b754265c7c1e45be3b1e81f3cff47735a5d551f2754992f9ac
6d618c8f87237e1f20b8985f74f6aa7c3e103ff6740df7fdb87a55adb6c35ffd
80d6f0f0bb6de64b443ca5d395b1536ce7599d0aea1c6d6d073db9d0a1a17245
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
a298400cc6236a4a7439ff3511e3b4d6d9fa158d640b268b317e14bce2610fb5
a7b9cd89c2f39f1c721da7e4e4db81cf3c1f99892000301ed95d568e8171e0cb
c8d83ad288f724373128d60b64c2f37038d895783f3108f9ffeefa677c4b5df9
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
cd951a3f912898b54b76fa059241f8339362b7aec43009356541bd32c3fa88b4
cf93db5f15fb6b90864ea934827bca87f92e75ad6a3aab83881b1f6777ee8929
d3902986a7667133e8b20ceedb7967f3ce3b67021d0969bbae35a4b422931035
d40b1b16872c36770d41f55e4891d304c79651623bc895a379966e4abf26d576
d7050c434e454737459714e12822afe9873651b17ba910136a8088e1ea6ded5e
d99a69bb4378e72447801980ad59e8a7a9aac03e840895f71559b25ddb92b749
dab451f9c95ada9ee5229eefbff8e88fa49fa8a585fd56953271ec0164057a9f
e17f525aa93aa4b3dbce9d95bbd0ceb390e0faf38f76a0585354883af6b8cfa5
e23146b019ba1480229b97f53fb721a0a0c70af3e56b6e049f3dc9ec56d09337
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f45ba6e591fdca93355b8a145c736f8eece478edfec3fd6d3e7c56de3a601005
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d