www.rctheatres.com Open in urlscan Pro
44.219.53.183 Public Scan

Software

ESF /

Resource Hash

9448b754d9d8db7f387844ccb2c8d5cdfd78be2cec020aea3efcae4f9f1ae821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, max-age=300
content-encoding: gzip
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
x-content-type-options: nosniff
expires: Fri, 18 Oct 2024 22:28:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
date: Fri, 18 Oct 2024 22:28:42 GMT
x-xss-protection: 0
content-type: text/javascript; charset=utf-8
server: ESF
x-frame-options: SAMEORIGIN

GET
H3 200 ConfirmRewardRedemption-563e89d268b8fb6187a8.js Show response
cms-assets.webediamovies.pro/prod/rctheatres/6712a46ca753f18ed14fa767/public/ 1 KB
1 KB 36ms
36ms Script
application/javascript 104.18.41.205
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cms-assets.webediamovies.pro/prod/rctheatres/6712a46ca753f18ed14fa767/public/ConfirmRewardRedemption-563e89d268b8fb6187a8.js
Requested by: Host: cms-assets.webediamovies.pro
URL: https://cms-assets.webediamovies.pro/prod/rctheatres/6712a46ca753f18ed14fa767/public/webpack-runtime-61758baea7340ba7bb10.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.41.205 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f2c544783fa724099ce01f0736543dfa76e072e1e5c716d6c154824b7b1ae696

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type
x-goog-hash: crc32c=ZwStxQ==, md5=czDKJcZk9d8mHvUTUPIzPw==
cf-bgj: minify
etag: W/"7330ca25c664f5df261ef51350f2333f"
age: 14854
cf-cache-status: HIT
content-encoding: br
x-goog-stored-content-encoding: gzip
expires: Sat, 18 Oct 2025 18:21:08 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 681
date: Fri, 18 Oct 2024 22:28:42 GMT
content-type: application/javascript
last-modified: Fri, 18 Oct 2024 18:13:54 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY3LX0RhwEVtAeioVP5pXAo6NyEfk6W5VpJ9XfI8RpEP8NRhv4GSS4NebmDB0tvUbMCJNVGBRf7RSg
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
cf-ray: 8d4bf6859fc436cc-YYZ
access-control-allow-origin: *
x-goog-generation: 1729275234782653
server: cloudflare

GET
H3 200 ConfirmActivation-1b27d07ca6791fb1a86d.js Show response
cms-assets.webediamovies.pro/prod/rctheatres/6712a46ca753f18ed14fa767/public/ 1 KB
1 KB 39ms
37ms Script
application/javascript 104.18.41.205
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cms-assets.webediamovies.pro/prod/rctheatres/6712a46ca753f18ed14fa767/public/ConfirmActivation-1b27d07ca6791fb1a86d.js
Requested by: Host: cms-assets.webediamovies.pro
URL: https://cms-assets.webediamovies.pro/prod/rctheatres/6712a46ca753f18ed14fa767/public/webpack-runtime-61758baea7340ba7bb10.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.41.205 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7554f82a216ecd270c3852cea603dc274e3b9d200e2db539d084ae414c72c1cb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type
x-goog-hash: crc32c=nn+U7g==, md5=pxu29JdFuQSqqhXxobp+HQ==
cf-bgj: minify
etag: W/"a71bb6f49745b904aaaa15f1a1ba7e1d"
age: 14854
cf-cache-status: HIT
content-encoding: br
x-goog-stored-content-encoding: gzip
expires: Sat, 18 Oct 2025 18:21:08 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 807
date: Fri, 18 Oct 2024 22:28:42 GMT
content-type: application/javascript
last-modified: Fri, 18 Oct 2024 18:13:54 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY1r43W-B-IqAyJ4opb5Sw5lPIvEzcuKvqnhG5PGtsiDeqG1uvazGP5uOMbMv4a6Xrr8SLQm1KPk_w
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
cf-ray: 8d4bf685afc836cc-YYZ
access-control-allow-origin: *
x-goog-generation: 1729275234893911
server: cloudflare

GET
H3 200 ExpiryMessage-ec26a2f77115cc171d01.js Show response
cms-assets.webediamovies.pro/prod/rctheatres/6712a46ca753f18ed14fa767/public/ 573 B
862 B 41ms
40ms Script
application/javascript 104.18.41.205
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cms-assets.webediamovies.pro/prod/rctheatres/6712a46ca753f18ed14fa767/public/ExpiryMessage-ec26a2f77115cc171d01.js
Requested by: Host: cms-assets.webediamovies.pro
URL: https://cms-assets.webediamovies.pro/prod/rctheatres/6712a46ca753f18ed14fa767/public/webpack-runtime-61758baea7340ba7bb10.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.41.205 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b8dfbd183d4608be8944b4df9991f9df9947c27c56fa8e45ac4b9f556fdc595

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type
x-goog-hash: crc32c=UBPexA==, md5=d7f4ATlNSvzJFCsm2jG7VA==
cf-bgj: minify
etag: W/"77b7f801394d4afcc9142b26da31bb54"
age: 14854
cf-cache-status: HIT
content-encoding: br
x-goog-stored-content-encoding: gzip
expires: Sat, 18 Oct 2025 18:21:08 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 380
date: Fri, 18 Oct 2024 22:28:42 GMT
content-type: application/javascript
last-modified: Fri, 18 Oct 2024 18:13:55 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY2L8RXDcBlaYCDVBaCyrpXOZPR_2D19wQZDokJUb9lgwBbWGOH4I4CXco7joi9dl5awP2E
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
cf-ray: 8d4bf685afca36cc-YYZ
access-control-allow-origin: *
x-goog-generation: 1729275235079406
server: cloudflare

GET
H3 200 3a1f77998c6228cfe916f54f837250d8.png
cms-assets.webediamovies.pro/cdn-cgi/image/width=32,height=32,fit=contain,quality=100/production/2/ 3 KB
0 0ms
0ms Other
image/png 104.18.41.205
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cms-assets.webediamovies.pro/cdn-cgi/image/width=32,height=32,fit=contain,quality=100/production/2/3a1f77998c6228cfe916f54f837250d8.png

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.41.205 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d6b617668ee7bd62efa1a15dfad7f7c5e3c4a315684ce713d3357182ffad28f2

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cf-cache-status: HIT
etag: "cf7zLQvwBXOlZ5lZw63XQR_iTukD1mkuacYpz0j0G5DQ:167fa95f4e91934b3694270058b26b01"
cf-bgj: imgq:100,h2pri
cf-resized: internal=ok/h q=0 n=26+3 c=1+2 v=2024.10.0 l=3296 f=false
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 22:28:41 GMT
content-type: image/png
last-modified: Thu, 18 May 2023 17:35:04 GMT
vary: Accept, Accept-Encoding
priority: u=4;i=?0,cf-chb=(45;u=5;i=?0)
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: public, max-age=31536000
cf-ray: 8d4bf6819bb236cc-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3296
server: cloudflare

GET
H3 200 e45623c67523695a692c4aabb393d809.jpg
cms-assets.webediamovies.pro/cdn-cgi/image/dpr=1,fit=scale-down,gravity=auto,metadata=none,quality=85,width=2000/production/2/ 234 KB
235 KB 37ms
36ms Image
image/jpeg 104.18.41.205
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms-assets.webediamovies.pro/cdn-cgi/image/dpr=1,fit=scale-down,gravity=auto,metadata=none,quality=85,width=2000/production/2/e45623c67523695a692c4aabb393d809.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.41.205 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0805cc4bb4b535b90db1cff215ba9b86a49fbb79dc5db194395e1256acd70932

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cf-cache-status: HIT
etag: "cfpi4_BFfG44ldA2xPYb2rDpkkq_dVZkSri27Uu_wkDQ:c8a9d7a0247b60d412b0af676a9ce430"
cf-bgj: imgq:85,h2pri
cf-resized: internal=ok/h q=0 n=33+56 c=16+40 v=2024.10.0 l=239964 f=false
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 22:28:42 GMT
content-type: image/jpeg
last-modified: Tue, 08 Oct 2024 20:21:30 GMT
vary: Accept, Accept-Encoding
priority: u=1;i=?0,cf-chb=(267;u=3;i=?0 17684;u=5;i 142194;u=6;i)
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: public, max-age=31536000
cf-ray: 8d4bf686c8c336cc-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 239964
server: cloudflare

GET
H3 200 98d7baae31666ec0ff620df05973f817.jpg
cms-assets.webediamovies.pro/cdn-cgi/image/dpr=1,fit=scale-down,gravity=auto,metadata=none,quality=85,width=2000/production/2/ 196 KB
196 KB 56ms
54ms Image
image/jpeg 104.18.41.205
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms-assets.webediamovies.pro/cdn-cgi/image/dpr=1,fit=scale-down,gravity=auto,metadata=none,quality=85,width=2000/production/2/98d7baae31666ec0ff620df05973f817.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.41.205 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ee19e247775f1aecabb4ea9bfbf48906be603ee6c833a1fb251bcc8637d83ae3

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cf-cache-status: HIT
etag: "cfEXi61wntRJLOavrAsG_Tyj5uq_dVZkSri27Uu_wkDQ:585870b09b35cb84303f0c404f737930"
cf-bgj: imgq:85,h2pri
cf-resized: internal=ok/h q=0 n=27+77 c=21+56 v=2024.10.0 l=200450 f=false
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 22:28:42 GMT
content-type: image/jpeg
last-modified: Tue, 24 Sep 2024 11:34:49 GMT
vary: Accept, Accept-Encoding
priority: u=1;i=?0,cf-chb=(268;u=3;i=?0 20993;u=5;i 112246;u=6;i)
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: public, max-age=31536000
cf-ray: 8d4bf686c8c536cc-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 200450
server: cloudflare

GET
H3 200 7a7c80d231de9aa4103f5aabcd54639d.png
cms-assets.webediamovies.pro/cdn-cgi/image/dpr=1,fit=scale-down,gravity=auto,metadata=none,quality=85,width=2000/production/3179/ 208 KB
208 KB 57ms
55ms Image
image/jpeg 104.18.41.205
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms-assets.webediamovies.pro/cdn-cgi/image/dpr=1,fit=scale-down,gravity=auto,metadata=none,quality=85,width=2000/production/3179/7a7c80d231de9aa4103f5aabcd54639d.png

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.41.205 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e4e5ff31a8788877ab889a0b3158dfa591a01a5c99e9c3e81f8970e75c4c05b

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cf-cache-status: HIT
etag: "cfU7yNn2psbs5tdzFjRF8QypQWq_dVZkSri27Uu_wkDQ:52b7b8a105168208b525ca86437acb28"
cf-bgj: imgq:85,h2pri
cf-resized: internal=ok/h q=0 n=14+45 c=12+32 v=2024.10.0 l=212634 f=false
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 22:28:42 GMT
content-type: image/jpeg
last-modified: Thu, 17 Oct 2024 01:30:43 GMT
vary: Accept, Accept-Encoding
priority: u=1;i=?0,cf-chb=(268;u=3;i=?0 15845;u=5;i 126980;u=6;i)
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: public, max-age=31536000
cf-ray: 8d4bf686c8c736cc-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 212634
server: cloudflare

GET
H2 200 r_500_x
all.web.img.acsta.net/img/78/20/7820b9da018345c9e0cf173c8dbe7879.jpg/ 39 KB
40 KB 110ms
54ms Image
image/webp 104.18.42.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://all.web.img.acsta.net/img/78/20/7820b9da018345c9e0cf173c8dbe7879.jpg/r_500_x
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.42.229 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e4049486c6cf5fbf39c9dd96885881f0cd1fb9f6c967d2241917fd9d205d414

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-servername: WEBMEDIAS2
cf-bgj: imgq:85,h2pri
cf-cache-status: HIT
age: 866012
expires: Fri, 03 Oct 2025 18:23:34 GMT
cf-polished: qual=85, origFmt=jpeg, origSize=49290
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 22:28:42 GMT
last-modified: Wed, 02 Oct 2024 17:38:40 GMT
content-type: image/webp
vary: Accept
content-disposition: inline; filename=7820b9da018345c9e0cf173c8dbe7879.jpg-r_500_x-f_jpg-q_x-xxyxx.jpg
cache-control: public
x-aspnet-version: 4.0.30319
cf-ray: 8d4bf6872fb6aad0-YYZ
accept-ranges: bytes
content-length: 40238
server: cloudflare

GET
H2 200 r_500_x
all.web.img.acsta.net/img/26/d7/26d7320f6ad3e4f8871278f0d54feaa4.jpg/ 77 KB
77 KB 109ms
53ms Image
image/jpeg 104.18.42.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://all.web.img.acsta.net/img/26/d7/26d7320f6ad3e4f8871278f0d54feaa4.jpg/r_500_x
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.42.229 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3ea15977f9c59619da122d0cdda461ffbf62af1c11a71f79dd86a29277ccb050

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-servername: WEBMEDIAS1
cf-bgj: imgq:85,h2pri
cf-cache-status: HIT
age: 499218
expires: Fri, 19 Sep 2025 21:28:38 GMT
cf-polished: degrade=85, origSize=82174, status=webp_bigger
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 22:28:42 GMT
content-type: image/jpeg
content-disposition: inline; filename=26d7320f6ad3e4f8871278f0d54feaa4.jpg-r_500_x-f_jpg-q_x-xxyxx.jpg
vary: Accept-Encoding
last-modified: Thu, 12 Sep 2024 20:45:54 GMT
cache-control: public
x-aspnet-version: 4.0.30319
cf-ray: 8d4bf6872fb7aad0-YYZ
accept-ranges: bytes
content-length: 78674
server: cloudflare

GET
H2 200 r_500_x
all.web.img.acsta.net/img/48/bf/48bfb8b0f804d76ea05bb5d9642411f1.jpg/ 28 KB
28 KB 109ms
54ms Image
image/webp 104.18.42.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://all.web.img.acsta.net/img/48/bf/48bfb8b0f804d76ea05bb5d9642411f1.jpg/r_500_x
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.42.229 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 634cc27247b818c639728adf8bfad533d35f5810fb4883e0236cecaee4ee1e5c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-servername: WEBMEDIAS2
cf-bgj: imgq:85,h2pri
cf-cache-status: HIT
age: 2462245
expires: Wed, 03 Sep 2025 14:20:42 GMT
cf-polished: qual=85, origFmt=jpeg, origSize=39283
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 22:28:42 GMT
last-modified: Tue, 03 Sep 2024 14:20:42 GMT
content-type: image/webp
vary: Accept
content-disposition: inline; filename=48bfb8b0f804d76ea05bb5d9642411f1.jpg-r_500_x-f_jpg-q_x-xxyxx.jpg
cache-control: public
x-aspnet-version: 4.0.30319
cf-ray: 8d4bf6872fb4aad0-YYZ
accept-ranges: bytes
content-length: 28828
server: cloudflare

GET
H2 200 r_500_x
all.web.img.acsta.net/img/b3/2f/b32f53675706c50879e21b7457ddcf05.jpg/ 74 KB
74 KB 109ms
54ms Image
image/webp 104.18.42.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://all.web.img.acsta.net/img/b3/2f/b32f53675706c50879e21b7457ddcf05.jpg/r_500_x
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.42.229 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7fd3abab2fb674be642acfe2afebf8616f10de6db396d636705da801b569420c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-servername: WEBMEDIAS2
cf-bgj: imgq:85,h2pri
cf-cache-status: HIT
age: 1720707
expires: Thu, 18 Sep 2025 20:44:11 GMT
cf-polished: qual=85, origFmt=jpeg, origSize=78917
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 22:28:42 GMT
last-modified: Mon, 16 Sep 2024 17:41:22 GMT
content-type: image/webp
vary: Accept
content-disposition: inline; filename=b32f53675706c50879e21b7457ddcf05.jpg-r_500_x-f_jpg-q_x-xxyxx.jpg
cache-control: public
x-aspnet-version: 4.0.30319
cf-ray: 8d4bf6872fb8aad0-YYZ
accept-ranges: bytes
content-length: 75544
server: cloudflare

GET
H2 200 r_500_x
all.web.img.acsta.net/img/bd/81/bd8156043dcd74e79f1c78770f8c2ecd.jpg/ 104 KB
104 KB 86ms
32ms Image
image/jpeg 104.18.42.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://all.web.img.acsta.net/img/bd/81/bd8156043dcd74e79f1c78770f8c2ecd.jpg/r_500_x
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.42.229 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8720ea7284b3e2c0c622be338fcfcdfc43f0f12b66bb290f0324e8c0ed2e96c7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-servername: WEBMEDIAS2
cf-bgj: imgq:85,h2pri
cf-cache-status: HIT
age: 3898078
expires: Fri, 29 Aug 2025 17:29:30 GMT
cf-polished: degrade=85, origSize=112374, status=webp_bigger
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 22:28:42 GMT
content-type: image/jpeg
content-disposition: inline; filename=bd8156043dcd74e79f1c78770f8c2ecd.jpg-r_500_x-f_jpg-q_x-xxyxx.jpg
vary: Accept-Encoding
last-modified: Thu, 29 Aug 2024 17:29:29 GMT
cache-control: public
x-aspnet-version: 4.0.30319
cf-ray: 8d4bf6872fb2aad0-YYZ
accept-ranges: bytes
content-length: 106184
server: cloudflare

GET
H2 200 sdk.b2a3c17a678ea7062d171089b67919517c588d58.js Show response
sdk.privacy-center.org/sdk/b2a3c17a678ea7062d171089b67919517c588d58/modern/ 362 KB
94 KB 39ms
38ms Script
application/javascript 18.164.96.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.privacy-center.org/sdk/b2a3c17a678ea7062d171089b67919517c588d58/modern/sdk.b2a3c17a678ea7062d171089b67919517c588d58.js
Requested by: Host: sdk.privacy-center.org
URL: https://sdk.privacy-center.org/d7747b32-58b9-4d2d-b071-5f2922b7555c/loader.js?target_type=notice&target=9cmrz6JM
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-4.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e5f286a5113e6a94c2ad621e4ffba3f5b598896c744b9781af86782bff104580

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

vary: Accept-Encoding
cache-control: public, max-age=31536000
content-encoding: br
etag: W/"c48f84cdf5d9be4e5212c351f58d4c46-1"
age: 307643
via: 1.1 5ba825173b1f7429171e730e7ae12588.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: eA4ivRxj0HYyIYa0mPhLDVFAKGH8eEkJ2hED3HRWbMfn7pz7cNA06w==
date: Tue, 15 Oct 2024 09:01:20 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 15 Oct 2024 09:01:04 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P5
x-amz-server-side-encryption: AES256

GET
H3 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/lqsTZ5beIbCkK4uGEGv9JmUR/ 544 KB
216 KB 79ms
34ms Script
text/javascript 142.250.65.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/lqsTZ5beIbCkK4uGEGv9JmUR/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6Le6Sv4ZAAAAALmrkkSggPr7EvmORQfRxbfK-mxx&hl=en-US

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.195 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f3.1e100.net

Software

sffe /

Resource Hash

5ab8f962752071d61b4c1613f2126ead5a5969b0157509532cb1cc43d1c0486d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.rctheatres.com
Referer

Response headers

content-encoding: gzip
age: 261
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
x-content-type-options: nosniff
expires: Sat, 18 Oct 2025 22:24:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 22:24:21 GMT
last-modified: Mon, 14 Oct 2024 18:32:27 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
accept-ranges: bytes
access-control-allow-origin: *
content-length: 220736
x-xss-protection: 0
server: sffe

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 324 KB
80 KB 155ms
39ms Script
application/javascript 108.138.115.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.lib.getjad.io
URL: https://cdn.lib.getjad.io/library/9518146/WMP_US_WEB
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.115.149 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-115-149.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6fdb7c12792ebd6e785128456249178e9b508c9677a300df8fbc6e7520147baa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"907cbdd883935369790d45cc9bd9e8b7"
age: 3425
via: 1.1 6028cf6b68ccf308226eae7dc6c6af42.cloudfront.net (CloudFront), 1.1 6fde4eba6716c9f80db3b63d251f248c.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: X5k8PnPh_iTEIAauhkNa9f3kK3VSqwAjCD6ySU7ygYtcG4ikWcBmMQ==
date: Fri, 18 Oct 2024 21:31:38 GMT
content-type: application/javascript
last-modified: Wed, 28 Aug 2024 22:46:37 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P7, JFK50-P3
x-amz-server-side-encryption: AES256

GET
H3 404 ff.json Show response
cdn.lib.getjad.io/restrictedurl/0b/64/d7/4d/46/65/7f/67/6c/3f/a1/3c/be/8c/58/ 127 B
468 B 92ms
66ms XHR
application/xml 104.18.40.7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.lib.getjad.io/restrictedurl/0b/64/d7/4d/46/65/7f/67/6c/3f/a1/3c/be/8c/58/ff.json?t=2024-10-18
Requested by: Host: cdn.lib.getjad.io
URL: https://cdn.lib.getjad.io/library/9518146/WMP_US_WEB
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.40.7 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bde9c2949e64d059c18d8f93566a64dafc6d2e8e259a70322fb804831dfd0b5b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: public, max-age=3600, s-max-age=3600, stale-while-revalidate=3600, stale-if-error=7200
content-encoding: br
cf-cache-status: HIT
via: 1.1 google
cf-ray: 8d4bf687bedf36d3-YYZ
expires: Fri, 18 Oct 2024 22:12:09 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 22:28:42 GMT
content-type: application/xml; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
x-guploader-uploadid: AHmUCY0-K_Bhn5ow_0EAw6fgzQMV6No1hK1nhYoj60qfzH_Qp0UhI64WL-c5y2DL8WkRCu9Xzg

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 105 KB
33 KB 126ms
63ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.lib.getjad.io
URL: https://cdn.lib.getjad.io/library/9518146/WMP_US_WEB

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

62cdd166f316b8da730f8c3a1f6707a91360ff1537417581c568a107fc0e3500

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 949 / 20014 / 31088235 / config-hash: 11692946538183363636
x-content-type-options: nosniff
expires: Fri, 18 Oct 2024 22:28:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33305
x-xss-protection: 0
server: cafe

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 322 KB
108 KB 226ms
132ms Script
application/javascript 142.250.81.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WG3SK3P

Requested by

Host: cms-assets.webediamovies.pro
URL: https://cms-assets.webediamovies.pro/prod/rctheatres/6712a46ca753f18ed14fa767/public/app-4d86567a240c70af9e33.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.81.232 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

43f9a3d5f57dd2af3d2b4934a02e83af98d0baacb1caa233bcdedd18aa7acc82

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Fri, 18 Oct 2024 22:28:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 18 Oct 2024 21:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 109743
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 205 KB
73 KB 245ms
152ms Script
application/javascript 142.250.81.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5R8LC6F

Requested by

Host: cms-assets.webediamovies.pro
URL: https://cms-assets.webediamovies.pro/prod/rctheatres/6712a46ca753f18ed14fa767/public/app-4d86567a240c70af9e33.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.81.232 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9f78047f3415a0ceaf08aec886e7eac43a008a7e7acfb5ab762e8b76e532fd16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Fri, 18 Oct 2024 22:28:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 18 Oct 2024 21:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 74558
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 cloudflare Show response
cdn.lib.getjad.io/geoloc/ 0
715 B 54ms
53ms XHR
text/plain 104.18.40.7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.lib.getjad.io/geoloc/cloudflare
Requested by: Host: cdn.lib.getjad.io
URL: https://cdn.lib.getjad.io/library/9518146/WMP_US_WEB
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.40.7 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 1
x-wb-country: CA
x-goog-meta-goog-reserved-file-mtime: 1674137016
access-control-expose-headers: x-wb-city,x-wb-country,x-wb-lat,x-wb-lon,x-wb-postalcode
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
cf-cache-status: HIT
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-wb-city: Toronto
x-goog-stored-content-encoding: identity
expires: Fri, 18 Oct 2024 23:21:45 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 0
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: text/plain; charset=utf-8
last-modified: Tue, 14 May 2024 09:38:57 GMT
vary: Accept-Encoding
x-wb-postalcode: M5A
x-guploader-uploadid: ABPtcPqz0MsaSCQJJalzqw08Hod1qt6jAu5MpvLIL2okq4wxQ8fqdw35tQ0HYC-sZ1-0LhTrTDWfnmrcow
cache-control: public, max-age=3600, s-max-age=3600, stale-while-revalidate=3600, stale-if-error=7200
x-goog-storage-class: STANDARD
x-wb-lon: -79.36230
via: 1.1 google
x-wb-lat: 43.65470
cf-ray: 8d4bf689484536d3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1715679537785374
content-length: 0
server: cloudflare

GET
H2 200 loader.min.js Show response
cdn.first-id.fr/sdk/loader/ 2 KB
1 KB 206ms
81ms Script
text/javascript 23.219.82.32
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.first-id.fr/sdk/loader/loader.min.js
Requested by: Host: cdn.lib.getjad.io
URL: https://cdn.lib.getjad.io/library/9518146/WMP_US_WEB
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.219.82.32 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-219-82-32.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9aac17c9d66182dc3e173d7504edc2743a339e939a6e45d98ff4c23f9cac2f2b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=2086
content-encoding: gzip
etag: W/"d0a4ebb7c92f0a2f2a71466efe07c7dc"
alt-svc: h3=":443"; ma=93600
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729290523164_400249438_512016010_39_1382_32_96_146";dur=1
content-length: 1027
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: text/javascript
last-modified: Tue, 15 Oct 2024 17:53:37 GMT
vary: Accept-Encoding

GET
H2 200 otToken.js Show response
storage.googleapis.com/fledge-tests/ 413 B
896 B 153ms
33ms Script
application/x-javascript 142.250.64.123
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/fledge-tests/otToken.js
Requested by: Host: cdn.lib.getjad.io
URL: https://cdn.lib.getjad.io/library/9518146/WMP_US_WEB
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.64.123 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s31-in-f27.1e100.net
Software: UploadServer /
Resource Hash: 9a0be1678fb27836fba9453a29914702070cc954f5f04e6983b7dce6cd78d7aa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 2
x-goog-hash: crc32c=4ZqF4w==, md5=SDdJ69084wsBZxPlYkoL+A==
etag: "483749ebdd3ce30b016713e5624a0bf8"
age: 1158
x-goog-stored-content-encoding: identity
expires: Fri, 18 Oct 2024 23:09:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 413
date: Fri, 18 Oct 2024 22:09:25 GMT
last-modified: Tue, 08 Nov 2022 10:42:35 GMT
content-type: application/x-javascript
x-guploader-uploadid: AHmUCY1NAqXUvF89QXAD9yNQWmsRaNvmd9hyvbK8alyA5_iCLEm7Ry0XekIQX0hrTt3F7-ByB18
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
accept-ranges: bytes
x-goog-generation: 1667904155021583
content-length: 413
server: UploadServer

GET
H2 200 wmp_us_web Show response
cdn.lib.getjad.io/dmp/9518146/ 0
292 B 33ms
32ms Script
application/javascript 104.18.40.7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.lib.getjad.io/dmp/9518146/wmp_us_web
Requested by: Host: cdn.lib.getjad.io
URL: https://cdn.lib.getjad.io/library/9518146/WMP_US_WEB
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.40.7 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 2
x-goog-hash: crc32c=jjWMTQ==, md5=e5ke/wekp0fVI5jmrNaxGw==
cf-bgj: minify
etag: "7b991eff07a4a747d52398e6acd6b11b"
age: 23
cf-cache-status: HIT
x-goog-stored-content-encoding: identity
expires: Fri, 18 Oct 2024 22:02:11 GMT
alt-svc: h3=":443"; ma=86400
cf-polished: origSize=31
x-goog-stored-content-length: 31
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 2024 06:00:36 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY15NJAMicebl_2xjLXmBsTgmYgZGsE-B8OqzN9RZq355oRe61BmVgBu0yDoy6H7ge7gww_5bLvV0w
cache-control: public, max-age=7200, s-max-age=7200, stale-while-revalidate=7200, stale-if-error=14400
x-goog-storage-class: STANDARD
via: 1.1 google
cf-ray: 8d4bf6895b6e36c4-YYZ
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1729231236165006
content-length: 0
server: cloudflare

GET
H2 200 tag.js Show response
a.teads.tv/analytics/ 11 KB
4 KB 243ms
68ms Script
text/javascript 104.126.113.138
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/analytics/tag.js
Requested by: Host: cdn.lib.getjad.io
URL: https://cdn.lib.getjad.io/library/9518146/WMP_US_WEB
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.126.113.138 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-126-113-138.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 06ed0d809178333c4cc4e1442b50e1f2e076b947466c4a204202fc90df34f833

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-amz-id-2: if71UmRFP9DJqrDDP/lp9kU8sYt6lpX2lHji6pVi9DP8SqDuL+s69h/pzlpYa3+9s1t6LW8Kfqg=
cache-control: private, max-age=3600
content-encoding: br
etag: "d86492df4bad2a485597bfa437c78ad2"
x-amz-version-id: IwRCxZF1T4gMT4TMeNkDrOCkruVfKfAe
x-amz-request-id: EEGWA8J1NW079B25
accept-ranges: bytes
content-length: 3393
date: Fri, 18 Oct 2024 22:28:43 GMT
last-modified: Wed, 28 Feb 2024 14:26:38 GMT
content-type: text/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H3 200 anchor
www.google.com/recaptcha/api2/ Frame 7EA8 0
0 144ms
70ms Document
text/html 142.250.65.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le6Sv4ZAAAAALmrkkSggPr7EvmORQfRxbfK-mxx&co=aHR0cHM6Ly93d3cucmN0aGVhdHJlcy5jb206NDQz&hl=en&v=lqsTZ5beIbCkK4uGEGv9JmUR&size=invisible&cb=dxt4j8c05kh4

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/lqsTZ5beIbCkK4uGEGv9JmUR/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.164 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-GXzca9kdSS3BKJyRcyEx8w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-GXzca9kdSS3BKJyRcyEx8w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 22:28:43 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 anchor
www.google.com/recaptcha/api2/ Frame 5FB1 0
0 139ms
74ms Document
text/html 142.250.65.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/lqsTZ5beIbCkK4uGEGv9JmUR/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.164 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-kOKbCLA_Ve1bitBsqHQPAA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-kOKbCLA_Ve1bitBsqHQPAA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 22:28:43 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 313 KB
105 KB 181ms
180ms Script
application/javascript 142.250.81.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-DXQ9G6D1M4&l=ga4DataLayer

Requested by

Host: cms-assets.webediamovies.pro
URL: https://cms-assets.webediamovies.pro/prod/rctheatres/6712a46ca753f18ed14fa767/public/app-4d86567a240c70af9e33.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.81.232 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9d211198a618aedbc85d2d7f33572c7790435d892b7217efc017f97caa468327

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 18 Oct 2024 22:28:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 106937
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 3309 Show response
config.aps.amazon-adsystem.com/configs/ 531 B
799 B 174ms
33ms Script
application/javascript 108.138.106.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/3309
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.106.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-106-59.jfk50.r.cloudfront.net
Software: CloudFront /
Resource Hash: d793102b658f88a03283d06c43803964d20c3c87b00d2d8ef1f0d7a2cdb06dc5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=3600
age: 1088
via: 1.1 264f765d2ad734b490f4728d6de8ce04.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 531
x-amz-cf-id: F0ndd8Jxo8hEEKS3ZIOt58u_LwME-Ey-y_XQI5yOihFwlD2BqxK8aw==
date: Fri, 18 Oct 2024 22:10:35 GMT
content-type: application/javascript
x-amz-cf-pop: JFK50-P3
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 792 B
1 KB 43ms
43ms XHR
application/json 108.138.115.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3309&u=https%3A%2F%2Fwww.rctheatres.com
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.115.149 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-115-149.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 980b10211307da4cbffe276d79995e9e0cc6ec9ad1d949b9ac2ead0afa8ba904

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 20678
access-control-allow-credentials: true
via: 1.1 6fde4eba6716c9f80db3b63d251f248c.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.rctheatres.com
x-cache: Hit from cloudfront
content-length: 792
x-amz-cf-id: PCnu8dIzIxpPhYHh21vS924iQ40AKywRMVwAwSnHEoQ_2EBxx436pg==
date: Fri, 18 Oct 2024 16:44:04 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK50-P3
server: Server

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 170ms
34ms XHR
application/javascript 108.138.115.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.115.149 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-115-149.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 31725
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: 8zHQtHOaS2w-6XRZJYndCScbp6HxYph4eet14gU-Y2Mz3S0N32EtUA==
date: Fri, 18 Oct 2024 13:39:59 GMT
content-type: application/javascript
vary: Accept-Encoding,Origin
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 153c5cd2b3e635613d0a2fa0f107993a.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410170101/ 480 KB
149 KB 35ms
34ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410170101/pubads_impl.js?cb=31088235

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

916a3cdac03baac007633a6ef2b6824372a2f43bb9c1f25a29832995134db667

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 3246870745169537564
age: 2166
x-content-type-options: nosniff
expires: Sat, 18 Oct 2025 21:52:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 18 Oct 2024 21:52:37 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 152590
x-xss-protection: 0
server: cafe

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 66 B
68 B 123ms
57ms XHR
application/json 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.rctheatres.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

182ade32fa82fef82aeb19f22850c67e514dc1e5bd4ce9d744626dfc418c6eef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 18 Oct 2024 22:28:43 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 44
date: Fri, 18 Oct 2024 22:28:43 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 192ms
102ms Script
application/javascript 23.201.174.84
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: www.rctheatres.com
URL: https://www.rctheatres.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.201.174.84 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-201-174-84.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Fri, 18 Oct 2024 22:43:43 GMT
accept-ranges: bytes
content-length: 17407
date: Fri, 18 Oct 2024 22:28:43 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 98 KB
29 KB 95ms
35ms Script
text/javascript 104.22.52.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: www.rctheatres.com
URL: https://www.rctheatres.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.22.52.86 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a7c35a58c1ad79d4fc96dad3bf9ef24b49d9d439ad3fb9b454cdcfe7c445724

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-amz-id-2: xEUYTWOZzByN1PCuvhKCsBssirtimyYIxC443jsmaILr/NjbMcxLsLtUZm6p65+C3isqbZL72zjJpThovtIm4pOSzzeqjuqnasGgkAM3LOI=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"f24286e1b73c01841e789906d50ce23f"
age: 2905
x-amz-request-id: 9T8V53D12YXN4XTY
cf-ray: 8d4bf68b0eeb36fb-YYZ
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: text/javascript;charset=utf-8
last-modified: Wed, 02 Oct 2024 12:26:13 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK fpc Show response
at.teads.tv/ 0
370 B 205ms
46ms Fetch
text/plain 23.51.57.155
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://at.teads.tv/fpc?analytics_tag_id=PUB_11041&tfpvi=&gdpr_status=0&gdpr_reason=0&gdpr_consent=&ccpa_consent=1---&shared_ids=&sv=90769f5&
Requested by: Host: a.teads.tv
URL: https://a.teads.tv/analytics/tag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.51.57.155 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-155.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Connection: keep-alive
Access-Control-Allow-Credentials: true
Observe-Browsing-Topics: ?1
Expires: Fri, 18 Oct 2024 22:28:43 GMT
Access-Control-Allow-Origin: https://www.rctheatres.com
Content-Length: 0
Date: Fri, 18 Oct 2024 22:28:43 GMT
Content-Type: text/plain; charset=UTF-8

GET
H2 200 sdk-1.9.1.min.js Show response
cdn.first-id.fr/sdk/script/ 17 KB
5 KB 106ms
105ms Script
text/javascript 23.219.82.32
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.first-id.fr/sdk/script/sdk-1.9.1.min.js
Requested by: Host: cdn.first-id.fr
URL: https://cdn.first-id.fr/sdk/loader/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.219.82.32 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-219-82-32.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: b91e8b41b4bd428ec7b2abcd471becafaf807c06b5189e48853a585632d06aa1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31260751
content-encoding: gzip
etag: W/"a8d734960293cb81c8a77f0a80553e5b"
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729290523457_400249438_512016438_883_1075_32_0_146";dur=1
content-length: 4606
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: text/javascript
last-modified: Tue, 15 Oct 2024 17:53:22 GMT
vary: Accept-Encoding

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame 773A 0
0 99ms
34ms Document
text/html 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410170101/pubads_impl.js?cb=31088235

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 875
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29415
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 22:14:08 GMT
expires: Fri, 18 Oct 2024 23:04:08 GMT
last-modified: Mon, 14 Oct 2024 19:44:52 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 17 KB
13 KB 134ms
65ms XHR
application/json 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202410170101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410170101/pubads_impl.js?cb=31088235

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

e354b8ad8a4b473739e7a1b34dc59b57cd1231c45a0c9b0abcbd8763fef2ca24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 12896
date: Fri, 18 Oct 2024 22:28:43 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 856 B
438 B 89ms
89ms Fetch
text/plain 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2374191710585013&correlator=1553694597806728&eid=31083342%2C31088235%2C31087830&output=ldjh&gdfp_req=1&vrg=202410170101&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&iu_parts=9518146%2CWMP_US_WEB%2Callads%2Crc-theatres&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1729290523493&lmt=1729290523&adxs=0&adys=0&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.rctheatres.com%2F&vis=1&psz=1600x6572&msz=1600x0&fws=4&ohw=1600&td=1&tan=5e592cac-c835-4940-bff8-459d6756a9b5&tdf=2&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1729290521480&idt=1950&prev_scp=position%3Dinterstitial%26pos%3Dinterstitial%26hb_safeframe%3Dyes%26jad_divId%3DInterstitialContainer%26jad_pf%3Ddisabled%26jad_call%3Dfirst%26optiyield%3Ddisabled&cust_params=amznbid%3D0%26amznp%3D0%26jad%3Dtrue%26wbads%3Dtrue%26notARefresh%3Dtrue%26jad_rendering%3D1%26wbads_rendering%3D1%26page%3DHome%26adType%3Dcaptif-et-hors-captif%26websiteID%3D1dec0d9f-4f48-48ae-bee5-8d1eaf8256c2%26domain%3Dwww.rctheatres.com%26currentPath%3D%252F%26urlOrigin%3Dhttps%253A%252F%252Fwww.rctheatres.com%26theater%3D%26theaterID%3D%26theaterGroup%3DRC%2520Theatres%26theaterGroupID%3D100225%26moviePermalinkPath%3D%252Fpermalink%252Fmovie%252F%26moviePermalinkOrigin%3Dhttps%253A%252F%252Fwww.rctheatres.com%252Fpermalink%252Fmovie%252F%26fledge%3Dtrue&adks=581988231&frm=20&eoidce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410170101/pubads_impl.js?cb=31088235

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

xx-fbcdn-shv-02-lga3.fbcdn.net

Software

cafe /

Resource Hash

2f18b89c5de89b24c7c185ae963eb87d279aedd7da2c0d34a94c8ada18b9688a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.rctheatres.com
content-length: 408
x-xss-protection: 0
server: cafe

GET
H2 200 container.html
4e4edc6d51042e1edb401126972f66db.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 8954 0
0 147ms
47ms Document
text/html 142.250.65.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4e4edc6d51042e1edb401126972f66db.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410170101/pubads_impl.js?cb=31088235

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.161 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f1.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 22:28:43 GMT
expires: Fri, 18 Oct 2024 22:28:43 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 227 KB
58 KB 80ms
37ms Script
application/x-javascript 157.240.241.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.rctheatres.com
URL: https://www.rctheatres.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.241.1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f4cfd4a5b95dfb31c47cd567d9719fc12a0453f6ff27e2872147a9740e4b9e56

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=34, rtx=0, c=23, mss=1232, tbw=4455, tp=9, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: oat7nHSUhMwhgaSaDGCjA9rMIrBDJF6VLpg752D8n+E1MM7zT7NWnlaIaU4DFbnC5yPlTq97AQWde3cgmBhY0g==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 59352
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/MBK4OQUUBRFMVOM2LQCTVZ/ 103 KB
30 KB 156ms
78ms Script
text/javascript 108.139.47.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/MBK4OQUUBRFMVOM2LQCTVZ/roundtrip.js
Requested by: Host: www.rctheatres.com
URL: https://www.rctheatres.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.47.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-47-59.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 600ff1d2ec451bf632fa932c6fbc0ba95c10044724d86b3b4f5ece0641ab49d1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Access-Control-Max-Age: 600
Content-Encoding: gzip
X-Amz-Version-Id: XI2dhSMJhBrnnOqCnw5L1EhxuOScN3CR
Etag: W/"6e16b3503cdf10923b9f043a13921b5e"
Age: 3082
Access-Control-Allow-Methods: GET
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: e06cL6MA4DC6Crv7btsBfUCp81QOz7ty1goQq0anYbUhaleSAqD5Eg==
Date: Fri, 18 Oct 2024 21:37:22 GMT
Content-Type: text/javascript; charset=utf-8
Vary: Accept-Encoding
Last-Modified: Wed, 16 Oct 2024 12:51:34 GMT
Access-Control-Allow-Headers: *
Transfer-Encoding: chunked
Cache-Control: max-age=3600, must-revalidate
Connection: keep-alive
Access-Control-Allow-Credentials: false
Via: 1.1 008cd6752eb718142dfefe2f7e847982.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: JFK50-P1
Server: AmazonS3
X-Amz-Server-Side-Encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 298 KB
100 KB 63ms
61ms Script
application/javascript 142.250.81.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-ZGRNH1VBTE&l=ga4DataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DXQ9G6D1M4&l=ga4DataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.81.232 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

xx-fbcdn-shv-02-lga3.fbcdn.net

Software

Google Tag Manager /

Resource Hash

e034c37e12a3985668fda7500b3c764d82d842a2ee6c82c8390795b4f2081468

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 18 Oct 2024 22:28:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 102491
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 155ms
66ms Fetch
text/plain 216.239.36.178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-DXQ9G6D1M4&gtm=45je4ah0v9101307359za200&_p=1729290523175&gcs=G111&gcd=13t3t3t3t6l1&npa=0&dma=0&tcfd=10000&tag_exp=101686685&cid=755389556.1729290524&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&dt=Home%20-%20RC%20Theatres&dl=https%3A%2F%2Fwww.rctheatres.com%2F&dp=%2F&sid=1729290523&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.anonymize_ip=false&ep.page_hash=&tfd=2551
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DXQ9G6D1M4&l=ga4DataLayer
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.36.178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.rctheatres.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 18 KB
7 KB 446ms
100ms Script
text/javascript 142.251.41.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410170101/pubads_impl.js?cb=31088235

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.1 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s40-in-f1.1e100.net

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Fri, 18 Oct 2024 22:28:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 22:28:44 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

POST
H2 204 collect
analytics.google.com/g/ 0
0 123ms
45ms Fetch
text/plain 216.239.36.181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-ZGRNH1VBTE&gtm=45je4ah0v9125422090za200zb9101307359&_p=1729290523175&_gaz=1&gcs=G111&gcd=13t3t3t3t6l1&npa=0&dma=0&tcfd=10000&tag_exp=101686685~101823848&cid=755389556.1729290524&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&dt=Home%20-%20RC%20Theatres&dl=https%3A%2F%2Fwww.rctheatres.com%2F&dp=%2F&sid=1729290523&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&ep.anonymize_ip=false&ep.page_hash=&tfd=2729
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZGRNH1VBTE&l=ga4DataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.36.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.rctheatres.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
556 B 135ms
48ms Ping
text/plain 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-ZGRNH1VBTE&cid=755389556.1729290524&gtm=45je4ah0v9125422090za200zb9101307359&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t6l1&npa=0&frm=0&tag_exp=101686685~101823848
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZGRNH1VBTE&l=ga4DataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.115.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bg-in-f156.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.rctheatres.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame 54D1 0
0 223ms
56ms Document
text/html 142.251.35.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-ZGRNH1VBTE&gacid=755389556.1729290524&gtm=45je4ah0v9125422090za200zb9101307359&dma=0&gcs=G111&gcd=13t3t3t3t6l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101686685~101823848&z=2114953175

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZGRNH1VBTE&l=ga4DataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 22:28:44 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 206ms
159ms Image
image/gif 142.250.64.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-ZGRNH1VBTE&cid=755389556.1729290524&gtm=45je4ah0v9125422090za200zb9101307359&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t6l1&npa=0&frm=0&tag_exp=101686685~101823848&tag_exp=101686685~101823848&z=2032545573

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.99 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s31-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 18 Oct 2024 22:28:43 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 425167697047124 Show response
connect.facebook.net/signals/config/ 74 KB
15 KB 36ms
36ms Script
application/x-javascript 157.240.241.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/425167697047124?v=2.9.172&r=stable&domain=www.rctheatres.com&hme=d82868061a8c707cd31395a3055e7449daa03bd520872727258c39e6af34523e&ex_m=70%2C120%2C106%2C110%2C61%2C4%2C99%2C69%2C16%2C96%2C88%2C51%2C54%2C171%2C174%2C186%2C182%2C183%2C185%2C29%2C100%2C53%2C77%2C184%2C166%2C169%2C179%2C180%2C187%2C130%2C41%2C34%2C142%2C15%2C50%2C193%2C192%2C132%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C92%2C17%2C14%2C95%2C91%2C90%2C107%2C52%2C109%2C39%2C108%2C30%2C93%2C26%2C167%2C170%2C139%2C85%2C56%2C83%2C33%2C73%2C0%2C94%2C32%2C28%2C82%2C87%2C47%2C46%2C86%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C101%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C103%2C102%2C104%2C97%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C89%2C81%2C44%2C35%2C84%2C2%2C36%2C63%2C42%2C105%2C45%2C79%2C68%2C111%2C60%2C59%2C31%2C98%2C58%2C55%2C49%2C78%2C72%2C24%2C112

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.241.1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4b95a4b5617d521be8dd4d406dc77dff70b472d4ba4a40ad090c77f58ab84503

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=34, rtx=9, c=74, mss=1232, tbw=78607, tp=73, tpl=9, uplat=1, ullat=-1
pragma: public
x-fb-debug: yTsbRgHUSFIFNtHdDZrVHKWAfLkfv3JR2xOCMk6HX411LJ743IewNHEkivbdbkJcrvw1hA40V5+y4DeQRJkRGQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 14924
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 MBK4OQUUBRFMVOM2LQCTVZ Show response
d.adroll.com/consent/check/ 593 B
1 KB 153ms
58ms Script
application/javascript 52.201.207.5
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/MBK4OQUUBRFMVOM2LQCTVZ?flg=1&pv=71981939401.75269&arrfrr=https%3A%2F%2Fwww.rctheatres.com%2F&_s=bb6eb60b3b8529d215c8574c4792b0f2&_b=2
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/MBK4OQUUBRFMVOM2LQCTVZ/roundtrip.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.201.207.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-201-207-5.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash: f361092f484eb5cc2f050a254d5d0115c576a17e9c6a758a7f6f9daea462ffba

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-store, no-cache, must-revalidate
content-length: 593
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
date: Fri, 18 Oct 2024 22:28:43 GMT
pragma: no-cache
content-type: application/javascript
server: nginx/1.22.1

GET
H2 200 /
www.facebook.com/tr/ 0
274 B 111ms
34ms Image
text/plain 157.240.241.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=425167697047124&ev=PageView&dl=https%3A%2F%2Fwww.rctheatres.com%2F&rl=&if=false&ts=1729290523894&sw=1600&sh=1200&v=2.9.172&r=stable&ec=0&o=4126&fbp=fb.1.1729290523892.998571722522104260&cs_est=true&ler=empty&cdl=API_unavailable&it=1729290523841&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.241.35 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=34, rtx=0, c=10, mss=1316, tbw=2959, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 331ms
254ms Image
image/png 157.240.241.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=425167697047124&ev=PageView&dl=https%3A%2F%2Fwww.rctheatres.com%2F&rl=&if=false&ts=1729290523894&sw=1600&sh=1200&v=2.9.172&r=stable&ec=0&o=4126&fbp=fb.1.1729290523892.998571722522104260&cs_est=true&ler=empty&cdl=API_unavailable&it=1729290523841&coo=false&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.241.35 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

ns3203256.ip-141-95-33.eu

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7427246245946429188"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 22:28:44 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: ZDja7L4FQv/cuxvjtipUIDr6SOgE2By35xyrYlVvyb/A/6wHhCqhlHTRH+cdC+FZ+xGQmyPPuXvdmq4mX9aQZA==
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7427246245946429188", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=40, rtx=0, c=14, mss=1316, tbw=3277, tp=-1, tpl=-1, uplat=98, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H2 200 bounce Show response
id5-sync.com/ 29 B
456 B 365ms
121ms Fetch
text/plain 141.95.33.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

aca701811d62eb608d12b174231be1ceae3449fe0f4bc847469ff22aab8ca9a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://www.rctheatres.com
p3p: CP="CAO PSA OUR"
date: Fri, 18 Oct 2024 22:28:44 GMT
content-type: text/plain;charset=utf-8
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
290 B 362ms
118ms Fetch
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

f06d921be08368f855d34d3cf3bb9dfa11a6f002d214dff82cc21bca6e5036ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.rctheatres.com
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 RBIZ6XMEV5D77AEHY34MPX Show response
d.adroll.com/segment/MBK4OQUUBRFMVOM2LQCTVZ/ 42 B
2 KB 40ms
40ms XHR
image/gif 52.201.207.5
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/segment/MBK4OQUUBRFMVOM2LQCTVZ/RBIZ6XMEV5D77AEHY34MPX?adroll_fpc=59da4bf060bcf8af0b71b23789032aa8-1729290524001&flg=1&pv=71981939401.75269&arrfrr=https%3A%2F%2Fwww.rctheatres.com%2F&cookie=&adroll_s_ref=&keyw=&p0=2257&adroll_external_data=&adroll_version=2.0
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/MBK4OQUUBRFMVOM2LQCTVZ/roundtrip.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.201.207.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-201-207-5.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-rule-type: p
access-control-expose-headers: X-Advertisable-Eid, X-Attribution-Url, X-Segment-Eid, X-Segment-Display-Name, X-Segment-Name, X-Conversion-Currency, X-Conversion-Value, X-Rule, X-Rule-Type, X-Organization-Eid, X-Pixel-Eid
x-organization-eid: MGQ3FVLC6JF6JK2ZZLHGLR
access-control-allow-methods: GET
x-segment-eid: BTS2D2JFFREIHNDE3NPNZP
x-advertisable-eid: MBK4OQUUBRFMVOM2LQCTVZ
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
date: Fri, 18 Oct 2024 22:28:44 GMT
x-pixel-eid: RBIZ6XMEV5D77AEHY34MPX
content-type: image/gif
x-attribution-url: https%3A%2F%2Fx.adroll.com%2Fattribution%2Ftrigger%3Ffpc%3D59da4bf060bcf8af0b71b23789032aa8%26advertisable_eid%3DMBK4OQUUBRFMVOM2LQCTVZ%26conversion_type%3DPageView%26conversion_value%3D0.0%26currency%3DUSC%26flg%3D1%26pv%3D71981939401.75269%26arrfrr%3Dhttps%253A%252F%252Fwww.rctheatres.com%252F
access-control-allow-headers: Content-Type, *
x-segment-display-name: Visitors to Unsegmented Pages
cache-control: no-store, no-cache, must-revalidate
access-control-request-methods: GET
pragma: no-cache
x-conversion-currency
access-control-allow-credentials: true
x-conversion-value: 0.0
access-control-allow-origin: https://www.rctheatres.com
x-segment-name: *
content-length: 42
server: nginx/1.22.1
x-rule: *

GET
H2

200

sync
x.bidswitch.net/
Redirect Chain

https://d.adroll.com/cm/b/out?adroll_fpc=59da4bf060bcf8af0b71b23789032aa8-1729290524001&flg=1&pv=71981939401.75269&arrfrr=https%3A%2F%2Fwww.rctheatres.com%2F&advertisable=MBK4OQUUBRFMVOM2LQCTVZ
https://x.bidswitch.net/sync?dsp_id=44&user_id=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI

43 B
183 B

436ms
49ms

Image
image/gif

35.211.202.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=44&user_id=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI
Protocol: H2
Server: 35.211.202.130 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Fri, 18 Oct 2024 22:28:44 GMT
content-type: image/gif

Redirect headers

cache-control: no-store, no-cache, must-revalidate
location: https://x.bidswitch.net/sync?dsp_id=44&user_id=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI
content-length: 96
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
date: Fri, 18 Oct 2024 22:28:44 GMT
pragma: no-cache
server: nginx/1.22.1

GET
H3

200

receive
pixel.tapad.com/idsync/ex/
Redirect Chain

https://d.adroll.com/cm/experian/out?adroll_fpc=59da4bf060bcf8af0b71b23789032aa8-1729290524001&flg=1&pv=71981939401.75269&arrfrr=https%3A%2F%2Fwww.rctheatres.com%2F&advertisable=MBK4OQUUBRFMVOM2LQCTVZ
https://pixel.tapad.com/idsync/ex/receive?partner_id=3521&partner_device_id=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3521&partner_device_id=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=c4edf530-0186-4dce-8b6e-967a41b462ba%252C%252C&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=c4edf530-0186-4dce-8b6e-967a41b462ba%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=81114153-4eee-446a-a9ce-d11d2b923e81&ttd_puid=c4edf530-0186-4dce-8b6e-967a41b462ba%2C%2C

95 B
124 B

58ms
58ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=81114153-4eee-446a-a9ce-d11d2b923e81&ttd_puid=c4edf530-0186-4dce-8b6e-967a41b462ba%2C%2C

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Fri, 18 Oct 2024 22:28:44 GMT
content-type: image/png
server: Jetty(11.0.13)

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=81114153-4eee-446a-a9ce-d11d2b923e81&ttd_puid=c4edf530-0186-4dce-8b6e-967a41b462ba%2C%2C
content-length: 359
date: Fri, 18 Oct 2024 22:28:44 GMT
server: Kestrel

GET
H2

200

in
d.adroll.com/cm/g/
Redirect Chain

https://d.adroll.com/cm/g/out?adroll_fpc=59da4bf060bcf8af0b71b23789032aa8-1729290524001&flg=1&pv=71981939401.75269&arrfrr=https%3A%2F%2Fwww.rctheatres.com%2F&advertisable=MBK4OQUUBRFMVOM2LQCTVZ
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=EuBeA6-6-hcPufgtfP7TSw
https://d.adroll.com/cm/g/in

42 B
821 B

41ms
41ms

Image
image/gif

52.201.207.5
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/g/in
Protocol: H2
Server: 52.201.207.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-201-207-5.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
x-result: g.-1.-1.-1
content-length: 42
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
date: Fri, 18 Oct 2024 22:28:44 GMT
content-type: image/gif
server: nginx/1.22.1

Redirect headers

cache-control: no-cache, must-revalidate
location: https://d.adroll.com/cm/g/in
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 225
date: Fri, 18 Oct 2024 22:28:44 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://d.adroll.com/cm/index/out?adroll_fpc=59da4bf060bcf8af0b71b23789032aa8-1729290524001&flg=1&pv=71981939401.75269&arrfrr=https%3A%2F%2Fwww.rctheatres.com%2F&advertisable=MBK4OQUUBRFMVOM2LQCTVZ
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&expiration=1760826524
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&expiration=1760826524&C=1

43 B
730 B

112ms
111ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&expiration=1760826524&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ve5OeWCpx3%2FPQ5nDOdFPZDtiGvkJj2xvLEC2vshLFCxROwMDcP1mbGp4pTAv1zGwchfIFjQ8c4XSXt5ootVDMOPqzmMYLOuQGrd7hTge4fKaWWNV39QmgyChDWvft952OnKbWZvm1dS7WA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d4bf6900f683981-YYZ
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 18 Oct 2024 22:28:44 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache
location: /rum?cm_dsp_id=105&external_user_id=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&expiration=1760826524&C=1
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KbcLObgWGAVN5A1yJbujEmYq%2BRloA2N35zUuOkY%2Bd5SUTJjw1uIyGVYYD%2B0TD04NXW5qLixEgTZOtkqwRPk2EtwyQ3kss4LOPMVXJvQF1pYA5AHXsAlLENTrzy6bnpy1ej5GzvfASdARuw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d4bf68faedd3981-YYZ
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 18 Oct 2024 22:28:44 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2

200

sync
pippio.com/api/
Redirect Chain

https://d.adroll.com/cm/l/out?adroll_fpc=59da4bf060bcf8af0b71b23789032aa8-1729290524001&flg=1&pv=71981939401.75269&arrfrr=https%3A%2F%2Fwww.rctheatres.com%2F&advertisable=MBK4OQUUBRFMVOM2LQCTVZ
https://idsync.rlcdn.com/377928.gif?partner_uid=12e05e03afbafa170fb9f82d7cfed34b
https://idsync.rlcdn.com/1000.gif?memo=CMiIFxIrCicIARDqIhogMTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGIQABoNCJzCy7gGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=d2228f2cd67a350ba1b65a0215990476351a037a50e921d2527c3945ee22e2a5791426b5417dce21&_=2

42 B
569 B

95ms
48ms

Image
image/gif

107.178.254.65
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pippio.com/api/sync?pid=5324&it=1&iv=d2228f2cd67a350ba1b65a0215990476351a037a50e921d2527c3945ee22e2a5791426b5417dce21&_=2
Protocol: H2
Server: 107.178.254.65 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Fri, 18 Oct 2024 22:28:44 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://pippio.com/api/sync?pid=5324&it=1&iv=d2228f2cd67a350ba1b65a0215990476351a037a50e921d2527c3945ee22e2a5791426b5417dce21&_=2
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Fri, 18 Oct 2024 22:28:44 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://d.adroll.com/cm/n/out?adroll_fpc=59da4bf060bcf8af0b71b23789032aa8-1729290524001&flg=1&pv=71981939401.75269&arrfrr=https%3A%2F%2Fwww.rctheatres.com%2F&advertisable=MBK4OQUUBRFMVOM2LQCTVZ
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&expires=365

42 B
1 KB

122ms
41ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&expires=365
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0228ab361cece0438ff9eb16e4e5890e
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, must-revalidate
location: https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&expires=365
content-length: 124
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
date: Fri, 18 Oct 2024 22:28:44 GMT
pragma: no-cache
server: nginx/1.22.1

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://d.adroll.com/cm/o/out?adroll_fpc=59da4bf060bcf8af0b71b23789032aa8-1729290524001&flg=1&pv=71981939401.75269&arrfrr=https%3A%2F%2Fwww.rctheatres.com%2F&advertisable=MBK4OQUUBRFMVOM2LQCTVZ
https://us-u.openx.net/w/1.0/sd?id=537103138&val=12e05e03afbafa170fb9f82d7cfed34b&gdpr=0&gdpr_consent=
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=12e05e03afbafa170fb9f82d7cfed34b&gdpr=0&gdpr_consent=

43 B
171 B

33ms
32ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=12e05e03afbafa170fb9f82d7cfed34b&gdpr=0&gdpr_consent=
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: image/gif
vary: Accept
server: OXGW/0.0.0

Redirect headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=12e05e03afbafa170fb9f82d7cfed34b&gdpr=0&gdpr_consent=
p3p: CP="CUR ADM OUR NOR STA NID"
content-length: 0
date: Fri, 18 Oct 2024 22:28:43 GMT
server: OXGW/0.0.0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/
Redirect Chain

https://d.adroll.com/cm/outbrain/out?adroll_fpc=59da4bf060bcf8af0b71b23789032aa8-1729290524001&flg=1&pv=71981939401.75269&arrfrr=https%3A%2F%2Fwww.rctheatres.com%2F&advertisable=MBK4OQUUBRFMVOM2LQCTVZ
https://sync.outbrain.com/cookie-sync?p=adroll&uid=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&gdpr=0&gdpr_consent=&us_privacy=1---

0
360 B

124ms
36ms

Image
text/plain

70.42.32.223
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.outbrain.com/cookie-sync?p=adroll&uid=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&gdpr=0&gdpr_consent=&us_privacy=1---

Protocol

HTTP/1.1

Server

70.42.32.223 , United States, ASN13789 (INTERNAP-BLK3, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache
content-length: 0
date: Fri, 18 Oct 2024 22:28:44 GMT
x-traceid: d2ffd62881d61652615a3347643c29ea

Redirect headers

cache-control: no-store, no-cache, must-revalidate
location: https://sync.outbrain.com/cookie-sync?p=adroll&uid=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&gdpr=0&gdpr_consent=&us_privacy=1---
content-length: 137
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
date: Fri, 18 Oct 2024 22:28:44 GMT
pragma: no-cache
server: nginx/1.22.1

GET
H2

200

Pug
image2.pubmatic.com/AdServer/
Redirect Chain

https://d.adroll.com/cm/pubmatic/out?adroll_fpc=59da4bf060bcf8af0b71b23789032aa8-1729290524001&flg=1&pv=71981939401.75269&arrfrr=https%3A%2F%2Fwww.rctheatres.com%2F&advertisable=MBK4OQUUBRFMVOM2LQCTVZ
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&gdpr=0&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXy...

42 B
587 B

125ms
37ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&gdpr=0&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 18 Oct 2024 22:28:43 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-store, no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&gdpr=0&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
content-length: 212
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
date: Fri, 18 Oct 2024 22:28:44 GMT
pragma: no-cache
server: nginx/1.22.1

GET

sync
ups.analytics.yahoo.com/ups/55980/
Redirect Chain

https://d.adroll.com/cm/r/out?adroll_fpc=59da4bf060bcf8af0b71b23789032aa8-1729290524001&flg=1&pv=71981939401.75269&arrfrr=https%3A%2F%2Fwww.rctheatres.com%2F&advertisable=MBK4OQUUBRFMVOM2LQCTVZ
https://ups.analytics.yahoo.com/ups/55980/sync?_origin=1&uid=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
https://ups.analytics.yahoo.com/ups/55980/sync?_origin=1&uid=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&gdpr=0&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true

0
0

GET
H2

204

rtb-h
sync.taboola.com/sg/adroll-network/1/
Redirect Chain

https://d.adroll.com/cm/taboola/out?adroll_fpc=59da4bf060bcf8af0b71b23789032aa8-1729290524001&flg=1&pv=71981939401.75269&arrfrr=https%3A%2F%2Fwww.rctheatres.com%2F&advertisable=MBK4OQUUBRFMVOM2LQCTVZ
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI

0
364 B

121ms
36ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-fastly-to-nlb-rtt: 35763
date: Fri, 18 Oct 2024 22:28:44 GMT
server: nginx
access-control-allow-credentials: true

Redirect headers

cache-control: no-store, no-cache, must-revalidate
location: https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI
content-length: 111
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
date: Fri, 18 Oct 2024 22:28:44 GMT
pragma: no-cache
server: nginx/1.22.1

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://d.adroll.com/cm/triplelift/out?adroll_fpc=59da4bf060bcf8af0b71b23789032aa8-1729290524001&flg=1&pv=71981939401.75269&arrfrr=https%3A%2F%2Fwww.rctheatres.com%2F&advertisable=MBK4OQUUBRFMVOM2L...
https://eb2.3lift.com/xuid?mid=4714&xuid=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&dongle=c85e
https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&dongle=c85e&gdpr=0&cmp_cs=&us_privacy=

37 B
476 B

44ms
43ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&dongle=c85e&gdpr=0&cmp_cs=&us_privacy=
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 18 Oct 2024 22:28:44 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: /xuid?ld=1&mid=4714&xuid=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI&dongle=c85e&gdpr=0&cmp_cs=&us_privacy=
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Fri, 18 Oct 2024 22:28:44 GMT

GET
H2

200

bounce
ib.adnxs.com/
Redirect Chain

https://d.adroll.com/cm/x/out?adroll_fpc=59da4bf060bcf8af0b71b23789032aa8-1729290524001&flg=1&pv=71981939401.75269&arrfrr=https%3A%2F%2Fwww.rctheatres.com%2F&advertisable=MBK4OQUUBRFMVOM2LQCTVZ
https://ib.adnxs.com/setuid?entity=172&code=MTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DMTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI

43 B
1 KB

35ms
34ms

Image
image/gif

68.67.160.114
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DMTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI

Protocol

Server

68.67.160.114 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 149.88.16.244; 149.88.16.244; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 1cfddd3a-2796-462e-b3d3-21beddac59f4
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Oct 2024 22:28:44 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DMTJlMDVlMDNhZmJhZmExNzBmYjlmODJkN2NmZWQzNGI
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 149.88.16.244; 149.88.16.244; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 9d78bd33-2e7a-4eec-8ce4-007e166ffdb4
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 18 Oct 2024 22:28:44 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 trigger
x.adroll.com/attribution/ 2 B
467 B 229ms
114ms Image
text/plain 44.205.185.222
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.adroll.com/attribution/trigger?fpc=59da4bf060bcf8af0b71b23789032aa8&advertisable_eid=MBK4OQUUBRFMVOM2LQCTVZ&conversion_type=PageView&conversion_value=0.0&currency=USC&flg=1&pv=71981939401.75269&arrfrr=https%3A%2F%2Fwww.rctheatres.com%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.205.185.222 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-205-185-222.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-length: 2
date: Fri, 18 Oct 2024 22:28:44 GMT
attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0","priority":"0","deduplication_key":"16255128227185606901","filters":{"source_type":["event"]}},{"trigger_data":"0","priority":"0","deduplication_key":"16255128227185606901","filters":{"source_type":["navigation"]}}],"debug_key":"7281935465974109599","debug_reporting":true,"filters":{"0":["MBK4OQUUBRFMVOM2LQCTVZ"]}}
content-type: text/plain; charset=utf-8

GET
H3 200 268671477788726 Show response
connect.facebook.net/signals/config/ 24 KB
3 KB 38ms
37ms Script
application/x-javascript 157.240.241.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/268671477788726?v=2.9.172&r=stable&domain=www.rctheatres.com&hme=d82868061a8c707cd31395a3055e7449daa03bd520872727258c39e6af34523e&ex_m=70%2C120%2C106%2C110%2C61%2C4%2C99%2C69%2C16%2C96%2C88%2C51%2C54%2C171%2C174%2C186%2C182%2C183%2C185%2C29%2C100%2C53%2C77%2C184%2C166%2C169%2C179%2C180%2C187%2C130%2C41%2C34%2C142%2C15%2C50%2C193%2C192%2C132%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C92%2C17%2C14%2C95%2C91%2C90%2C107%2C52%2C109%2C39%2C108%2C30%2C93%2C26%2C167%2C170%2C139%2C85%2C56%2C83%2C33%2C73%2C0%2C94%2C32%2C28%2C82%2C87%2C47%2C46%2C86%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C101%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C103%2C102%2C104%2C97%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C89%2C81%2C44%2C35%2C84%2C2%2C36%2C63%2C42%2C105%2C45%2C79%2C68%2C111%2C60%2C59%2C31%2C98%2C58%2C55%2C49%2C78%2C72%2C24%2C112%2C199%2C198%2C200%2C205%2C206%2C207%2C203%2C195%2C131%2C133%2C162%2C194%2C196%2C121%2C156%2C144%2C150%2C188%2C189%2C128%2C231%2C115%2C125%2C126%2C232%2C164%2C118%2C234%2C165%2C135%2C122%2C153%2C147%2C127

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.241.1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-lga3.fbcdn.net

Software

Resource Hash

1644df05fea3fa7a08b3301cb12bfcba286b95848492fcd2bcab42a6f22b7cc2

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 22:28:44 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=33, rtx=9, c=87, mss=1232, tbw=94591, tp=90, tpl=9, uplat=1, ullat=-1
pragma: public
x-fb-debug: hxwvAHRXKFVbo2yq7vGJqlwF4Fx4I6nMsairH5vwFzPzTRJ8sf1IkJRr8hNdjJ5NKywG2CPlU/7rmz/b4kB+Lg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 2922
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/232/ Frame C4F1 0
0 201ms
126ms Document
text/html 142.251.41.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/232/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.1 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s40-in-f1.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1829
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 21:58:15 GMT
expires: Fri, 18 Oct 2024 22:48:15 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame 3F4A 0
0 61ms
59ms Document
text/html 142.250.65.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.164 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-6dXE884WlR7DvUTlTPJxHw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-6dXE884WlR7DvUTlTPJxHw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Fri, 18 Oct 2024 22:28:44 GMT
expires: Fri, 18 Oct 2024 22:28:44 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 /
www.facebook.com/tr/ 0
102 B 71ms
70ms Image
text/plain 157.240.241.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=268671477788726&ev=PageView&dl=https%3A%2F%2Fwww.rctheatres.com%2F&rl=&if=false&ts=1729290524155&cd[segment_eid]=BTS2D2JFFREIHNDE3NPNZP&sw=1600&sh=1200&v=2.9.172&r=stable&ec=0&o=4125&fbp=fb.1.1729290523892.998571722522104260&ler=empty&cdl=API_unavailable&it=1729290523841&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.241.35 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=38, rtx=0, c=14, mss=1316, tbw=6578, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Fri, 18 Oct 2024 22:28:44 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
882 B 104ms
103ms Image
image/png 157.240.241.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=268671477788726&ev=PageView&dl=https%3A%2F%2Fwww.rctheatres.com%2F&rl=&if=false&ts=1729290524155&cd[segment_eid]=BTS2D2JFFREIHNDE3NPNZP&sw=1600&sh=1200&v=2.9.172&r=stable&ec=0&o=4125&fbp=fb.1.1729290523892.998571722522104260&ler=empty&cdl=API_unavailable&it=1729290523841&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.241.35 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS