revert-cheet-3898-ontariofarmer.gdev.postmedia.digital Open in urlscan Pro
34.95.11.30 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Effective URL:
https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Submission: On February 22 via api (February 22nd 2022, 1:51:05 am UTC) from CA — Scanned from CA

Summary HTTP 228 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 66 IPs in 5 countries across 66 domains to perform 228 HTTP transactions. The main IP is 34.95.11.30, located in Montreal, Canada and belongs to GOOGLE-PRIVATE-CLOUD, US. The main domain is revert-cheet-3898-ontariofarmer.gdev.postmedia.digital.
TLS certificate: Issued by R3 on February 22nd 2022. Valid for: 3 months.

This is the only time revert-cheet-3898-ontariofarmer.gdev.postmedia.digital was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 19	34.95.11.30 34.95.11.30	396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD)
6	142.251.40.130 142.251.40.130	15169 (GOOGLE) (GOOGLE)
4	52.85.63.179 52.85.63.179	16509 (AMAZON-02) (AMAZON-02)
2 15	104.16.68.69 104.16.68.69	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.85.61.15 52.85.61.15	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4006:822::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700:303... 2606:4700:3037::6815:3c3f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:10:... 2606:4700:10::6816:49e8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.85.61.89 52.85.61.89	16509 (AMAZON-02) (AMAZON-02)
3	52.95.146.203 52.95.146.203	16509 (AMAZON-02) (AMAZON-02)
5	52.85.61.25 52.85.61.25	16509 (AMAZON-02) (AMAZON-02)
3	2607:f8b0:400... 2607:f8b0:4006:807::2003	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:824::2008	15169 (GOOGLE) (GOOGLE)
2 6	52.85.61.28 52.85.61.28	16509 (AMAZON-02) (AMAZON-02)
6	2a04:4e42:200... 2a04:4e42:200::645	54113 (FASTLY) (FASTLY)
9	151.101.66.133 151.101.66.133	54113 (FASTLY) (FASTLY)
1	52.4.137.218 52.4.137.218	14618 (AMAZON-AES) (AMAZON-AES)
6	34.149.157.221 34.149.157.221	15169 (GOOGLE) (GOOGLE)
7 22	142.250.176.194 142.250.176.194	15169 (GOOGLE) (GOOGLE)
2	2600:141b:13:... 2600:141b:13::17d7:82d2	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f01... 2a03:2880:f012:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
1	146.75.36.157 146.75.36.157	54113 (FASTLY) (FASTLY)
2	99.83.154.140 99.83.154.140	16509 (AMAZON-02) (AMAZON-02)
1 2	2607:f8b0:400... 2607:f8b0:4006:823::2002	15169 (GOOGLE) (GOOGLE)
1	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
1	104.244.42.69 104.244.42.69	13414 (TWITTER) (TWITTER)
4 5	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	108.174.10.24 108.174.10.24	14413 (LINKEDIN) (LINKEDIN)
1 2	104.18.101.194 104.18.101.194	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	199.38.167.128 199.38.167.128	54312 (ROCKETFUEL) (ROCKETFUEL)
6 11	34.195.153.99 34.195.153.99	14618 (AMAZON-AES) (AMAZON-AES)
5 5	151.101.130.49 151.101.130.49	54113 (FASTLY) (FASTLY)
1	35.231.227.177 35.231.227.177	15169 (GOOGLE) (GOOGLE)
4 4	54.85.186.77 54.85.186.77	14618 (AMAZON-AES) (AMAZON-AES)
2 2	185.184.10.30 185.184.10.30	203690 (RTB-HOUSE...) (RTB-HOUSE-ASH)
2	2a03:2880:f11... 2a03:2880:f112:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1 5	2607:f8b0:400... 2607:f8b0:4006:822::2004	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:823::2003	15169 (GOOGLE) (GOOGLE)
5 5	34.231.116.207 34.231.116.207	14618 (AMAZON-AES) (AMAZON-AES)
12	107.22.254.227 107.22.254.227	14618 (AMAZON-AES) (AMAZON-AES)
1 4	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
1 1	23.209.184.224 23.209.184.224	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	34.232.192.29 34.232.192.29	14618 (AMAZON-AES) (AMAZON-AES)
3 3	74.121.140.14 74.121.140.14	30419 (MEDIAMATH...) (MEDIAMATH-INC)
1 3	34.235.23.231 34.235.23.231	14618 (AMAZON-AES) (AMAZON-AES)
1	156.154.202.36 156.154.202.36	19907 (NEUSTAR-AS6) (NEUSTAR-AS6)
3 3	23.54.68.240 23.54.68.240	16625 (AKAMAI-AS) (AKAMAI-AS)
3 3	35.71.139.29 35.71.139.29	16509 (AMAZON-02) (AMAZON-02)
1 12	209.54.177.54 209.54.177.54	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4006:80a::2002	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:80b::2002	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4006:80c::2001	15169 (GOOGLE) (GOOGLE)
1	104.16.190.66 104.16.190.66	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	23.54.68.197 23.54.68.197	16625 (AKAMAI-AS) (AKAMAI-AS)
2	23.57.136.222 23.57.136.222	16625 (AKAMAI-AS) (AKAMAI-AS)
1 5	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
4 4	68.67.179.135 68.67.179.135	29990 (ASN-APPNEX) (ASN-APPNEX)
1 2	63.251.86.49 63.251.86.49	10913 (INTERNAP-BLK) (INTERNAP-BLK)
2 2	207.198.113.179 207.198.113.179	13768 (COGECO-PEER1) (COGECO-PEER1)
6 6	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
7 10	8.43.72.98 8.43.72.98	26667 (RUBICONPR...) (RUBICONPROJECT)
1	104.36.115.113 104.36.115.113	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	2600:1f18:4e9... 2600:1f18:4e9:5a01:82b8:89c9:c55a:66d8	14618 (AMAZON-AES) (AMAZON-AES)
5	63.251.114.136 63.251.114.136	12181 (INTERNAP-...) (INTERNAP-2BLK)
2 2	2620:116:800b... 2620:116:800b:21:ea23:7677:128a:8c9c	14618 (AMAZON-AES) (AMAZON-AES)
1 1	54.243.110.155 54.243.110.155	14618 (AMAZON-AES) (AMAZON-AES)
1 1	198.148.27.139 198.148.27.139	19189 (PULSEPOINT) (PULSEPOINT)
2 2	35.207.24.140 35.207.24.140	15169 (GOOGLE) (GOOGLE)
2 3	185.167.164.39 185.167.164.39	198622 (ADFORM) (ADFORM)
3	8.28.7.83 8.28.7.83	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2 2	107.178.254.65 107.178.254.65	15169 (GOOGLE) (GOOGLE)
1 1	34.98.67.3 34.98.67.3	15169 (GOOGLE) (GOOGLE)
1	8.28.7.84 8.28.7.84	62713 (AS-PUBMATIC) (AS-PUBMATIC)
3	104.36.115.109 104.36.115.109	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	108.168.159.145 108.168.159.145	36351 (SOFTLAYER) (SOFTLAYER)
1 1	2620:112:f002... 2620:112:f002:bbbb::21	6336 (TURN-US-ASN) (TURN-US-ASN)
1	2001:4998:14:... 2001:4998:14:800::1001	14777 (YAHOO) (YAHOO)
10	2607:f8b0:400... 2607:f8b0:4006:81d::2002	15169 (GOOGLE) (GOOGLE)
1	2600:9000:220... 2600:9000:2209:0:7:75d4:e40:93a1	16509 (AMAZON-02) (AMAZON-02)
11	2607:f8b0:400... 2607:f8b0:4006:80d::2001	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:80f::2003	15169 (GOOGLE) (GOOGLE)
4	2607:f8b0:400... 2607:f8b0:4006:806::200e	15169 (GOOGLE) (GOOGLE)
4	2607:f8b0:400... 2607:f8b0:4006:809::200e	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:81e::200e	15169 (GOOGLE) (GOOGLE)
1 2	2606:4700::68... 2606:4700::6812:c05	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	3.208.70.15 3.208.70.15	14618 (AMAZON-AES) (AMAZON-AES)
3 3	199.127.204.147 199.127.204.147	26120 (RHYTHMONE) (RHYTHMONE)
1 1	199.187.193.179 199.187.193.179	47043 (SMARTADSE...) (SMARTADSERVER)
1 1	35.169.10.7 35.169.10.7	14618 (AMAZON-AES) (AMAZON-AES)
1	104.36.115.114 104.36.115.114	62713 (AS-PUBMATIC) (AS-PUBMATIC)
228	66

19 34.95.11.30 (Montreal, Canada) 1 redirects

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: 30.11.95.34.bc.googleusercontent.com

revert-cheet-3898-ontariofarmer.gdev.postmedia.digital	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.251.40.130 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s80-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.85.63.179 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-63-179.ewr53.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 104.16.68.69 (None, ) 2 redirects

ASN13335 (CLOUDFLARENET, US)

hb.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dmx.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.85.61.15 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-15.ewr53.r.cloudfront.net

cdn.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:822::200a (Queens, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3037::6815:3c3f (United States)

ASN13335 (CLOUDFLARENET, US)

www.npttech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:49e8 (United States)

ASN13335 (CLOUDFLARENET, US)

auth.lrcontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.85.61.89 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-89.ewr53.r.cloudfront.net

ak.sail-horizon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.95.146.203 (Montreal, Canada)

ASN16509 (AMAZON-02, US)
PTR: s3-w.ca-central-1.amazonaws.com

pmd-dev-frontend-modules.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 52.85.61.25 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-25.ewr53.r.cloudfront.net

smartcdn.prod.postmedia.digital	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:807::2003 (Queens, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:824::2008 (Queens, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.85.61.28 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-28.ewr53.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a04:4e42:200::645 (United States)

ASN54113 (FASTLY, US)

jssdkcdns.mparticle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
identity.mparticle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
jssdks.mparticle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 151.101.66.133 (United States)

ASN54113 (FASTLY, US)

cdn.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
consumer.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.4.137.218 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-4-137-218.compute-1.amazonaws.com

pixel.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.149.157.221 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 221.157.149.34.bc.googleusercontent.com

smartcdn.gprod.postmedia.digital	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 142.250.176.194 (United States) 7 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s37-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:141b:13::17d7:82d2 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:8:face:b00c:0:1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.36.157 (Reston, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.83.154.140 (United States)

ASN16509 (AMAZON-02, US)
PTR: aa7557bb34ea5624b.awsglobalaccelerator.com

api.sail-personalize.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:823::2002 (Queens, United States) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.69 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.174.10.24 (United States) 1 redirects

ASN14413 (LINKEDIN, US)
PTR: 108-174-10-24.fwd.linkedin.com

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.101.194 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

p.adsymptotic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.38.167.128 (United States) 1 redirects

ASN54312 (ROCKETFUEL, US)

p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 34.195.153.99 (Ashburn, United States) 6 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-195-153-99.compute-1.amazonaws.com

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.130.49 (United States) 5 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.231.227.177 (North Charleston, United States)

ASN15169 (GOOGLE, US)
PTR: 177.227.231.35.bc.googleusercontent.com

dmx.us-east-33.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.85.186.77 (Ashburn, United States) 4 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-85-186-77.compute-1.amazonaws.com

sync.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.184.10.30 (Poland) 2 redirects

ASN203690 (RTB-HOUSE-ASH, PL)
PTR: ip-185-184-10-30.rtbhouse.net

us.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f112:83:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:822::2004 (Queens, United States) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:823::2003 (Queens, United States)

ASN15169 (GOOGLE, US)

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.231.116.207 (Ashburn, United States) 5 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-231-116-207.compute-1.amazonaws.com

usermatch.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 107.22.254.227 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-107-22-254-227.compute-1.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.190.60.146 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.209.184.224 (Secaucus, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-209-184-224.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.232.192.29 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-232-192-29.compute-1.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 74.121.140.14 (Reston, United States) 3 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.235.23.231 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-235-23-231.compute-1.amazonaws.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 156.154.202.36 (United States)

ASN19907 (NEUSTAR-AS6, US)

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.54.68.240 (Piscataway, United States) 3 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-54-68-240.deploy.static.akamaitechnologies.com

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.71.139.29 (United States) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 209.54.177.54 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80a::2002 (Queens, United States)

ASN15169 (GOOGLE, US)

adservice.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80b::2002 (Queens, United States)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:80c::2001 (Queens, United States)

ASN15169 (GOOGLE, US)

1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.190.66 (None, )

ASN13335 (CLOUDFLARENET, US)

dmx.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.54.68.197 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-54-68-197.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.57.136.222 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-57-136-222.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.98.64.218 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 68.67.179.135 (Secaucus, United States) 4 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 550.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.251.86.49 (United States) 1 redirects

ASN10913 (INTERNAP-BLK, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 207.198.113.179 (Herndon, United States) 2 redirects

ASN13768 (COGECO-PEER1, CA)

pixel-sync.sitescout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 3.33.220.150 (United States) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
data.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 8.43.72.98 (United States) 7 redirects

ASN26667 (RUBICONPROJECT, US)

pixel-us-east.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.36.115.113 (United States)

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1f18:4e9:5a01:82b8:89c9:c55a:66d8 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 63.251.114.136 (United States)

ASN12181 (INTERNAP-2BLK, US)

ce.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800b:21:ea23:7677:128a:8c9c (United States) 2 redirects

ASN14618 (AMAZON-AES, US)

pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.243.110.155 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-243-110-155.compute-1.amazonaws.com

aorta.clickagy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.148.27.139 (New York, United States) 1 redirects

ASN19189 (PULSEPOINT, US)

bh.contextweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.207.24.140 (North Charleston, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 140.24.207.35.bc.googleusercontent.com

rtb.mfadsrvr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.167.164.39 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 8.28.7.83 (United States)

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 107.178.254.65 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 65.254.178.107.bc.googleusercontent.com

pippio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.67.3 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 3.67.98.34.bc.googleusercontent.com

tags.rd.linksynergy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.28.7.84 (United States)

ASN62713 (AS-PUBMATIC, US)

image4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.36.115.109 (United States)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.168.159.145 (Dallas, United States) 1 redirects

ASN36351 (SOFTLAYER, US)
PTR: 91.9f.a86c.ip4.static.sl-reverse.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:112:f002:bbbb::21 (United States) 1 redirects

ASN6336 (TURN-US-ASN, US)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4998:14:800::1001 (United States)

ASN14777 (YAHOO, US)

ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2607:f8b0:4006:81d::2002 (Queens, United States)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2209:0:7:75d4:e40:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.ribn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2607:f8b0:4006:80d::2001 (Queens, United States)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80f::2003 (Queens, United States)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:806::200e (Queens, United States)

ASN15169 (GOOGLE, US)

encrypted-tbn3.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:809::200e (Queens, United States)

ASN15169 (GOOGLE, US)

encrypted-tbn2.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:81e::200e (Queens, United States)

ASN15169 (GOOGLE, US)

encrypted-tbn1.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:c05 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.208.70.15 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-208-70-15.compute-1.amazonaws.com

rtb.adentifi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 199.127.204.147 (United States) 3 redirects

ASN26120 (RHYTHMONE, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.187.193.179 (Canada) 1 redirects

ASN47043 (SMARTADSERVER, CA)

ssbsync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.169.10.7 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-169-10-7.compute-1.amazonaws.com

ads.yieldmo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.36.115.114 (United States)

ASN62713 (AS-PUBMATIC, US)

simage4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
30	postmedia.digital 1 redirects revert-cheet-3898-ontariofarmer.gdev.postmedia.digital smartcdn.prod.postmedia.digital — Cisco Umbrella Rank: 178808 smartcdn.gprod.postmedia.digital — Cisco Umbrella Rank: 68899	585 KB
28	doubleclick.net 8 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 159 googleads.g.doubleclick.net — Cisco Umbrella Rank: 37 cm.g.doubleclick.net — Cisco Umbrella Rank: 175	233 KB
26	krxd.net 5 redirects cdn.krxd.net — Cisco Umbrella Rank: 1228 consumer.krxd.net — Cisco Umbrella Rank: 1569 usermatch.krxd.net — Cisco Umbrella Rank: 981 beacon.krxd.net — Cisco Umbrella Rank: 371	186 KB
22	googlesyndication.com 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 92 tpc.googlesyndication.com — Cisco Umbrella Rank: 120	79 KB
17	districtm.io 2 redirects hb.districtm.io — Cisco Umbrella Rank: 70016 cdn.districtm.io — Cisco Umbrella Rank: 1644 dmx.districtm.io — Cisco Umbrella Rank: 1164 dmx.us-east-33.districtm.io — Cisco Umbrella Rank: 14113	20 KB
16	amazon-adsystem.com 1 redirects c.amazon-adsystem.com — Cisco Umbrella Rank: 263 s.amazon-adsystem.com — Cisco Umbrella Rank: 266	50 KB
15	gstatic.com fonts.gstatic.com www.gstatic.com encrypted-tbn3.gstatic.com encrypted-tbn2.gstatic.com encrypted-tbn1.gstatic.com	369 KB
12	rubiconproject.com 7 redirects eus.rubiconproject.com — Cisco Umbrella Rank: 512 pixel-us-east.rubiconproject.com — Cisco Umbrella Rank: 935 token.rubiconproject.com — Cisco Umbrella Rank: 593 pixel.rubiconproject.com — Cisco Umbrella Rank: 288	15 KB
11	pubmatic.com ads.pubmatic.com — Cisco Umbrella Rank: 429 image6.pubmatic.com — Cisco Umbrella Rank: 582 simage2.pubmatic.com — Cisco Umbrella Rank: 552 image4.pubmatic.com — Cisco Umbrella Rank: 738 image2.pubmatic.com — Cisco Umbrella Rank: 752 simage4.pubmatic.com — Cisco Umbrella Rank: 1024	26 KB
11	sharethrough.com 6 redirects match.sharethrough.com — Cisco Umbrella Rank: 561	3 KB
7	lijit.com 1 redirects ap.lijit.com — Cisco Umbrella Rank: 598 ce.lijit.com — Cisco Umbrella Rank: 696	8 KB
6	adsrvr.org 6 redirects match.adsrvr.org — Cisco Umbrella Rank: 295 data.adsrvr.org — Cisco Umbrella Rank: 4772	3 KB
6	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2 adservice.google.com — Cisco Umbrella Rank: 59	2 KB
6	linkedin.com 5 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 439 www.linkedin.com — Cisco Umbrella Rank: 602 px4.ads.linkedin.com — Cisco Umbrella Rank: 5087	4 KB
6	mparticle.com jssdkcdns.mparticle.com — Cisco Umbrella Rank: 5051 identity.mparticle.com — Cisco Umbrella Rank: 2515 jssdks.mparticle.com — Cisco Umbrella Rank: 4790	48 KB
6	scorecardresearch.com 2 redirects sb.scorecardresearch.com — Cisco Umbrella Rank: 129	3 KB
5	openx.net 1 redirects u.openx.net — Cisco Umbrella Rank: 636 us-u.openx.net — Cisco Umbrella Rank: 322	1 KB
5	everesttech.net 5 redirects sync-tm.everesttech.net — Cisco Umbrella Rank: 491	990 B
4	adnxs.com 4 redirects ib.adnxs.com — Cisco Umbrella Rank: 210	4 KB
4	rlcdn.com 1 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 283 id.rlcdn.com — Cisco Umbrella Rank: 548	814 B
4	stackadapt.com 4 redirects sync.srv.stackadapt.com — Cisco Umbrella Rank: 768	1 KB
3	adform.net 2 redirects c1.adform.net — Cisco Umbrella Rank: 529	2 KB
3	yahoo.com 1 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 419 ads.yahoo.com — Cisco Umbrella Rank: 835	2 KB
3	3lift.com 3 redirects eb2.3lift.com — Cisco Umbrella Rank: 356	1 KB
3	casalemedia.com 3 redirects ssum-sec.casalemedia.com — Cisco Umbrella Rank: 463 ssum.casalemedia.com — Cisco Umbrella Rank: 1125	2 KB
3	ml314.com 1 redirects ml314.com — Cisco Umbrella Rank: 1357	13 KB
3	mathtag.com 3 redirects sync.mathtag.com — Cisco Umbrella Rank: 387	2 KB
3	google.ca www.google.ca — Cisco Umbrella Rank: 8810 adservice.google.ca — Cisco Umbrella Rank: 12901	1 KB
3	amazonaws.com pmd-dev-frontend-modules.s3.amazonaws.com	303 KB
2	1rx.io 2 redirects sync.1rx.io — Cisco Umbrella Rank: 480	2 KB
2	adentifi.com rtb.adentifi.com — Cisco Umbrella Rank: 931	176 B
2	tribalfusion.com 1 redirects a.tribalfusion.com — Cisco Umbrella Rank: 683 s.tribalfusion.com — Cisco Umbrella Rank: 1640	1 KB
2	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 146	76 KB
2	pippio.com 2 redirects pippio.com — Cisco Umbrella Rank: 692	849 B
2	mfadsrvr.com 2 redirects rtb.mfadsrvr.com — Cisco Umbrella Rank: 740	775 B
2	quantserve.com 2 redirects pixel.quantserve.com — Cisco Umbrella Rank: 374 cms.quantserve.com — Cisco Umbrella Rank: 927	1001 B
2	sitescout.com 2 redirects pixel-sync.sitescout.com — Cisco Umbrella Rank: 542	911 B
2	bidr.io 2 redirects match.prod.bidr.io — Cisco Umbrella Rank: 444	1 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 97	424 B
2	creativecdn.com 2 redirects us.creativecdn.com — Cisco Umbrella Rank: 2383	697 B
2	adsymptotic.com 1 redirects p.adsymptotic.com — Cisco Umbrella Rank: 497	539 B
2	sail-personalize.com api.sail-personalize.com — Cisco Umbrella Rank: 2482	474 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 126	115 KB
2	licdn.com snap.licdn.com — Cisco Umbrella Rank: 830	3 KB
2	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 99	16 KB
2	adsafeprotected.com cdn.adsafeprotected.com — Cisco Umbrella Rank: 3336 pixel.adsafeprotected.com — Cisco Umbrella Rank: 519	9 KB
1	yieldmo.com 1 redirects ads.yieldmo.com — Cisco Umbrella Rank: 633	462 B
1	smartadserver.com 1 redirects ssbsync.smartadserver.com — Cisco Umbrella Rank: 1193	457 B
1	unrulymedia.com 1 redirects sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 821	697 B
1	ribn.com assets.ribn.com — Cisco Umbrella Rank: 44469	4 KB
1	turn.com 1 redirects ad.turn.com — Cisco Umbrella Rank: 653	518 B
1	simpli.fi 1 redirects um.simpli.fi — Cisco Umbrella Rank: 691	656 B
1	linksynergy.com 1 redirects tags.rd.linksynergy.com — Cisco Umbrella Rank: 3850	358 B
1	contextweb.com 1 redirects bh.contextweb.com — Cisco Umbrella Rank: 516	678 B
1	clickagy.com 1 redirects aorta.clickagy.com — Cisco Umbrella Rank: 2029	657 B
1	agkn.com aa.agkn.com — Cisco Umbrella Rank: 388	680 B
1	bluekai.com 1 redirects stags.bluekai.com — Cisco Umbrella Rank: 447	712 B
1	rfihub.com 1 redirects p.rfihub.com — Cisco Umbrella Rank: 615	741 B
1	t.co t.co — Cisco Umbrella Rank: 456	336 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 468	458 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 539	6 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 50	111 KB
1	sail-horizon.com ak.sail-horizon.com — Cisco Umbrella Rank: 2571	43 KB
1	lrcontent.com auth.lrcontent.com — Cisco Umbrella Rank: 37875	47 KB
1	npttech.com www.npttech.com — Cisco Umbrella Rank: 4023	3 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	1 KB
228	66

	Domain	Requested by
20	cm.g.doubleclick.net	7 redirects u.openx.net s.amazon-adsystem.com 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
19	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital	1 redirects revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
12	s.amazon-adsystem.com	1 redirects c.amazon-adsystem.com s.amazon-adsystem.com match.sharethrough.com u.openx.net ap.lijit.com eus.rubiconproject.com cdn.districtm.io ads.pubmatic.com
12	beacon.krxd.net	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital cdn.krxd.net
11	tpc.googlesyndication.com	securepubads.g.doubleclick.net 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com tpc.googlesyndication.com
11	match.sharethrough.com	6 redirects s.amazon-adsystem.com match.sharethrough.com
10	dmx.districtm.io	1 redirects hb.districtm.io cdn.districtm.io revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
8	pagead2.googlesyndication.com	securepubads.g.doubleclick.net 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com tpc.googlesyndication.com www.googletagservices.com
6	smartcdn.gprod.postmedia.digital	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
6	cdn.krxd.net	pmd-dev-frontend-modules.s3.amazonaws.com cdn.krxd.net
6	sb.scorecardresearch.com	2 redirects pmd-dev-frontend-modules.s3.amazonaws.com revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
6	securepubads.g.doubleclick.net	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital securepubads.g.doubleclick.net
5	token.rubiconproject.com	5 redirects
5	ce.lijit.com	ap.lijit.com
5	match.adsrvr.org	5 redirects
5	usermatch.krxd.net	5 redirects
5	www.google.com	1 redirects revert-cheet-3898-ontariofarmer.gdev.postmedia.digital 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com tpc.googlesyndication.com
5	sync-tm.everesttech.net	5 redirects
5	cdn.districtm.io	1 redirects hb.districtm.io cdn.districtm.io s.amazon-adsystem.com
5	smartcdn.prod.postmedia.digital	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
4	encrypted-tbn2.gstatic.com	1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
4	encrypted-tbn3.gstatic.com	1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
4	ib.adnxs.com	4 redirects
4	sync.srv.stackadapt.com	4 redirects
4	px.ads.linkedin.com	3 redirects s.amazon-adsystem.com
4	identity.mparticle.com	jssdkcdns.mparticle.com
4	c.amazon-adsystem.com	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital c.amazon-adsystem.com
3	pixel.rubiconproject.com	s.amazon-adsystem.com
3	image2.pubmatic.com	ads.pubmatic.com
3	simage2.pubmatic.com	ads.pubmatic.com
3	c1.adform.net	2 redirects ads.pubmatic.com
3	us-u.openx.net	u.openx.net
3	1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
3	eb2.3lift.com	3 redirects
3	ml314.com	1 redirects revert-cheet-3898-ontariofarmer.gdev.postmedia.digital ml314.com
3	sync.mathtag.com	3 redirects
3	idsync.rlcdn.com	1 redirects revert-cheet-3898-ontariofarmer.gdev.postmedia.digital ads.pubmatic.com
3	consumer.krxd.net	cdn.krxd.net
3	fonts.gstatic.com	fonts.googleapis.com
3	pmd-dev-frontend-modules.s3.amazonaws.com	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital pmd-dev-frontend-modules.s3.amazonaws.com
2	sync.1rx.io	2 redirects
2	rtb.adentifi.com	1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
2	encrypted-tbn1.gstatic.com	1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
2	www.gstatic.com	1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
2	www.googletagservices.com	1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
2	pippio.com	2 redirects
2	rtb.mfadsrvr.com	2 redirects
2	pr-bh.ybp.yahoo.com	1 redirects u.openx.net
2	pixel-us-east.rubiconproject.com	2 redirects
2	pixel-sync.sitescout.com	2 redirects
2	ap.lijit.com	1 redirects s.amazon-adsystem.com
2	u.openx.net	1 redirects s.amazon-adsystem.com
2	eus.rubiconproject.com	s.amazon-adsystem.com eus.rubiconproject.com
2	ads.pubmatic.com	s.amazon-adsystem.com ads.pubmatic.com
2	ssum-sec.casalemedia.com	2 redirects
2	match.prod.bidr.io	2 redirects
2	www.google.ca	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
2	www.facebook.com	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
2	us.creativecdn.com	2 redirects
2	p.adsymptotic.com	1 redirects revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
2	googleads.g.doubleclick.net	1 redirects www.googleadservices.com
2	api.sail-personalize.com	ak.sail-horizon.com
2	connect.facebook.net	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital connect.facebook.net
2	snap.licdn.com	www.googletagmanager.com snap.licdn.com
2	www.googleadservices.com	www.googletagmanager.com www.googleadservices.com
1	jssdks.mparticle.com	jssdkcdns.mparticle.com
1	simage4.pubmatic.com	ads.pubmatic.com
1	ads.yieldmo.com	1 redirects
1	cms.quantserve.com	1 redirects
1	ssbsync.smartadserver.com	1 redirects
1	sync.targeting.unrulymedia.com	1 redirects
1	s.tribalfusion.com
1	a.tribalfusion.com	1 redirects
1	assets.ribn.com	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
1	id.rlcdn.com	s.amazon-adsystem.com
1	ads.yahoo.com	s.amazon-adsystem.com
1	ad.turn.com	1 redirects
1	um.simpli.fi	1 redirects
1	image4.pubmatic.com	ads.pubmatic.com
1	tags.rd.linksynergy.com	1 redirects
1	bh.contextweb.com	1 redirects
1	aorta.clickagy.com	1 redirects
1	pixel.quantserve.com	1 redirects
1	data.adsrvr.org	1 redirects
1	image6.pubmatic.com	ads.pubmatic.com
1	ssum.casalemedia.com	1 redirects
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.ca	securepubads.g.doubleclick.net
1	aa.agkn.com	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
1	stags.bluekai.com	1 redirects
1	dmx.us-east-33.districtm.io	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
1	p.rfihub.com	1 redirects
1	px4.ads.linkedin.com	1 redirects
1	www.linkedin.com	1 redirects
1	t.co	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
1	analytics.twitter.com	static.ads-twitter.com
1	static.ads-twitter.com	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
1	pixel.adsafeprotected.com	cdn.adsafeprotected.com
1	jssdkcdns.mparticle.com	pmd-dev-frontend-modules.s3.amazonaws.com
1	www.googletagmanager.com	pmd-dev-frontend-modules.s3.amazonaws.com
1	ak.sail-horizon.com	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
1	auth.lrcontent.com	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
1	www.npttech.com	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
1	fonts.googleapis.com	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
1	cdn.adsafeprotected.com	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
1	hb.districtm.io	revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
228	106

This site contains links to these domains. Also see Links.

Domain
ofoffers.ca
www.remembering.ca
shopping.ontariofarmer.com
www.businesswire.com
www.newsfilecorp.com
www.globenewswire.com
7c1e077b.flowpaper.com
www.facebook.com
twitter.com
www.postmediasolutions.com
adregistry.postmedia.com
www.postmedia.com

Subject Issuer	Validity	Valid
revert-cheet-3898-driving.gdev.postmedia.digital R3	`2022-02-22` - `2022-05-23`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2021-07-06` - `2022-06-27`	a year	crt.sh
districtm.io Cloudflare Inc ECC CA-3	`2021-06-02` - `2022-06-01`	a year	crt.sh
*.adsafeprotected.com Amazon	`2021-07-21` - `2022-08-19`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-05` - `2022-07-04`	a year	crt.sh
ak.sail-horizon.com Amazon	`2022-01-06` - `2023-02-02`	a year	crt.sh
*.s3.amazonaws.com Amazon	`2021-12-15` - `2022-12-03`	a year	crt.sh
*.prod.postmedia.digital Amazon	`2022-01-15` - `2023-02-13`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
*.scorecardresearch.com Amazon	`2022-01-29` - `2023-02-27`	a year	crt.sh
jssdkcdns.mparticle.com R3	`2021-12-27` - `2022-03-27`	3 months	crt.sh
cdn.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2021-12-30` - `2022-12-29`	a year	crt.sh
fw.adsafeprotected.com Amazon	`2021-08-11` - `2022-09-09`	a year	crt.sh
smartcdn.gprod.postmedia.digital GTS CA 1D4	`2022-02-12` - `2022-05-13`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2021-07-15` - `2022-07-20`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-12-01` - `2022-03-01`	3 months	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-21` - `2022-07-26`	a year	crt.sh
identity.mparticle.com Go Daddy Secure Certificate Authority - G2	`2021-07-07` - `2022-08-08`	a year	crt.sh
consumer.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2021-07-13` - `2022-07-12`	a year	crt.sh
api.sail-personalize.com Amazon	`2021-06-24` - `2022-07-23`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2022-02-22` - `2023-02-22`	a year	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2022-02-22` - `2023-02-22`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
*.google.ca GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
*.ml314.com Amazon	`2021-12-17` - `2023-01-14`	a year	crt.sh
s.amazon-adsystem.com Amazon	`2021-07-14` - `2022-06-27`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
*.sharethrough.com Amazon	`2021-08-13` - `2022-09-11`	a year	crt.sh
*.pubmatic.com DigiCert SHA2 Secure Server CA	`2022-02-04` - `2023-02-03`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2021-04-01` - `2022-04-04`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2021-03-11` - `2022-04-12`	a year	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-01-18` - `2022-07-13`	6 months	crt.sh
track.adform.net DigiCert TLS RSA SHA256 2020 CA1	`2021-09-06` - `2022-10-07`	a year	crt.sh
beacon.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2021-11-03` - `2022-11-02`	a year	crt.sh
*.ribn.com Amazon	`2021-09-20` - `2022-10-19`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
adentifi.com Amazon	`2021-09-04` - `2022-10-03`	a year	crt.sh
jssdks.mparticle.com R3	`2021-12-27` - `2022-03-27`	3 months	crt.sh

This page contains 26 frames:

Primary Page: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Frame ID: 51C35EBA8064C815FE796C80BEAE50C0
Requests: 88 HTTP requests in this frame

Frame: https://pmd-dev-frontend-modules.s3.amazonaws.com/AA-606-0c8bf33/xd.html
Frame ID: A3DE26C6DDEF73C6A28BF85E84772620
Requests: 2 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: 13DF9464D8945D34E66E063B48BEC757
Requests: 9 HTTP requests in this frame

Frame: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
Frame ID: 8EC468A6AA25659E1F6324DAA597CA8C
Requests: 19 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&dcc=t
Frame ID: EBD034698FE79B667E52F65137A1806B
Requests: 1 HTTP requests in this frame

Frame: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 31494238494B164B6B1F7F71B4871CF9
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Frame ID: 561BF5D0207EB15EC007F8FD9C21E9F4
Requests: 1 HTTP requests in this frame

Frame: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Frame ID: 596519D86AF3EFEBE07F67F4B59101B3
Requests: 6 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Frame ID: 525C11796F56F8FE488ED98CDE12C4CB
Requests: 11 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Frame ID: C202124503A9DDA1E09689C37ED8C4D0
Requests: 11 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Frame ID: 43808BF2A3F1C7E7333B51F800305DFC
Requests: 7 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?id=3270471530205738017&ex=districtm
Frame ID: 8C40935DF4051D978944F67B43A160F0
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?id=1032252883967861238&ex=appnexus.com
Frame ID: 3CC5CDE1DEBD97271BA6AE1DF1314160
Requests: 1 HTTP requests in this frame

Frame: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Frame ID: 1DD178A174B75FD869100206CE936F49
Requests: 7 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D
Frame ID: A8D5F896EDE7B08A20197EDA8D4D0E0A
Requests: 3 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=1084003074738852891507
Frame ID: 8357C4E1435CA2E684F3783A07127D70
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: B1350A79CA2DC3296D738922B20FB568
Requests: 1 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=F5442E89-17F3-44B7-B527-DBDE7BA68DD7
Frame ID: F322001DD5B399E8B09D40EF166AD44C
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YhRBggAH9Y6JOwAy&gdpr=0&gdpr_consent=
Frame ID: 46F3031C3CCB599AE86AA4BD32AA0057
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?id=F5442E89-17F3-44B7-B527-DBDE7BA68DD7&ex=pubmatic.com
Frame ID: DCBEE9853C29A27583850CC4B92BEE6F
Requests: 1 HTTP requests in this frame

Frame: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 1937DFD4C0E7DB0662B810096BE0C606
Requests: 16 HTTP requests in this frame

Frame: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 8F8611AFDFD799F62BA3ED4F927F61D9
Requests: 16 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: ACA22A42B5D8D73520042DF6B6707A37
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: A9BFA80F68C2AE7FFC6F30ED00B0202C
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: C1B9EF9B0DAC727A3BAD4F4169F25C9A
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 6B2D30D3E14B2677B1368F1A0EFD93F4
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Home | Ontario FarmerOntario Farmer

Page URL History Show full URLs

http://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/ HTTP 308
https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

comScore (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon

Page Statistics

228
Requests

74 %
HTTPS

31 %
IPv6

66
Domains

106
Subdomains

66
IPs

5
Countries

2373 kB
Transfer

6175 kB
Size

109
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://ofoffers.ca/
Title: Subscribe

Search URL Search Domain Scan URL

URL: http://www.remembering.ca/about/
Title: Obituaries

Search URL Search Domain Scan URL

URL: https://shopping.ontariofarmer.com/
Title: London

Search URL Search Domain Scan URL

URL: https://www.businesswire.com/
Title: Promoted By Business Wire

Search URL Search Domain Scan URL

URL: https://www.newsfilecorp.com/
Title: Promoted By Newsfile

Search URL Search Domain Scan URL

URL: https://www.globenewswire.com/
Title: Promoted By GlobeNewswire

Search URL Search Domain Scan URL

URL: https://7c1e077b.flowpaper.com/Shopper/
Title: Ontario Farmer Shopper November 9, 2021

Search URL Search Domain Scan URL

URL: https://www.facebook.com/OntFarmerNews/

Search URL Search Domain Scan URL

URL: https://twitter.com/OntFarmerNews

Search URL Search Domain Scan URL

URL: https://www.postmediasolutions.com/contact-us/
Title: Advertise With Us

Search URL Search Domain Scan URL

URL: https://adregistry.postmedia.com/
Title: Digital Ad Registry

Search URL Search Domain Scan URL

URL: https://www.postmedia.com/brands

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/ HTTP 308
https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 60

https://sb.scorecardresearch.com/b?c1=2&c2=10276888&ns__t=1645494657803&ns_c=UTF-8&c8=Home%20%7C%20Ontario%20Farmer&c7=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&c9= HTTP 302
https://sb.scorecardresearch.com/b2?c1=2&c2=10276888&ns__t=1645494657803&ns_c=UTF-8&c8=Home%20%7C%20Ontario%20Farmer&c7=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&c9=

Request Chain 79

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1747836&time=1645494657978&url=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1747836&time=1645494657978&url=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1747836%26time%3D1645494657978%26url%3Dhttps%253A%252F%252Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1747836&time=1645494657978&url=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1747836&time=1645494657978&url=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&cookiesTest=true&liSync=true&e_ipv6=AQLHo31iVwftPwAAAX8fH-UaOxBC93IMNi8xSWMOdi1WSbzDmyjvc7RyXFJ4rCOiCHXApdMl HTTP 302
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=0a1a0b4c-4091-4d5c-8c01-2a6297267836 HTTP 302
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=0a1a0b4c-4091-4d5c-8c01-2a6297267836&_expected_cookie=4f38d581827d609c7356f94be1ac2da5

Request Chain 80

https://p.rfihub.com/cm?pub=36496&in=1 HTTP 302
https://dmx.districtm.io/s/10056/968062827794341354

Request Chain 81

https://match.sharethrough.com/1PQ8qgv7/v1/ HTTP 302
https://dmx.districtm.io/s/10059/37f25f47-fcb4-47fc-96ef-7ef38cff4262

Request Chain 82

https://sync-tm.everesttech.net/upi/pid/1477?redir=https%3A//dmx.us-east-33.districtm.io/s/10016/$%7BTM_USER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/1477?redir=https%3A//dmx.us-east-33.districtm.io/s/10016/$%7BTM_USER_ID%7D&_test=YhRBggAH9Y6JOwAy HTTP 302
https://dmx.us-east-33.districtm.io/s/10016/YhRBggAH9Y6JOwAy&_test=YhRBggAH9Y6JOwAy

Request Chain 83

https://sync.srv.stackadapt.com/sync?nid=132 HTTP 302
https://dmx.districtm.io/s/10026/jz3vfA4wQhJ2neqoOdQylpU4mbc

Request Chain 84

https://us.creativecdn.com/cm-notify?pi=districtm HTTP 302
https://us.creativecdn.com/cm-notify?pi=districtm&tc=1 HTTP 302
https://dmx.districtm.io/s/10027/5BNFHJJ9IAgWdjiYNVgr?pi=districtm&tc=1

Request Chain 87

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/580448699/?random=1263551499&cv=9&fst=1645494657960&num=1&value=0&label=FmJTCMOu_N8BELvj45QC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg2g0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&tiba=Home%20%7C%20Ontario%20Farmer&auid=1585089914.1645494658&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=gkEUYpegAeOMoPMPu52EyAw&sscte=1&crd=&eitems=ChEIgI3NkAYQvqPU5vTIysiHARIdAKnWO2suy_JEL5IxNsOnc7fGLWKr60fEV99sRKo HTTP 302
https://www.google.com/pagead/1p-conversion/580448699/?random=1263551499&cv=9&fst=1645494657960&num=1&value=0&label=FmJTCMOu_N8BELvj45QC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg2g0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&tiba=Home%20%7C%20Ontario%20Farmer&auid=1585089914.1645494658&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=gkEUYpegAeOMoPMPu52EyAw&cid=CAQSKQCNIrLMHjpdPQOX6a3AtcZq54zuNvQhZXjP8VK64UJl2Al7pLb9X-3y&eitems=ChEIgI3NkAYQvqPU5vTIysiHARIdAKnWO2vmmI3bpkkWSOPyHbyf6gcVCt3DMRUcfm0&random=1525386978&resp=GooglemKTybQhCsO HTTP 302
https://www.google.ca/pagead/1p-conversion/580448699/?random=1263551499&cv=9&fst=1645494657960&num=1&value=0&label=FmJTCMOu_N8BELvj45QC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg2g0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&tiba=Home%20%7C%20Ontario%20Farmer&auid=1585089914.1645494658&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=gkEUYpegAeOMoPMPu52EyAw&cid=CAQSKQCNIrLMHjpdPQOX6a3AtcZq54zuNvQhZXjP8VK64UJl2Al7pLb9X-3y&eitems=ChEIgI3NkAYQvqPU5vTIysiHARIdAKnWO2vmmI3bpkkWSOPyHbyf6gcVCt3DMRUcfm0&random=1525386978&resp=GooglemKTybQhCsO&ipr=y&prhg=0

Request Chain 90

https://usermatch.krxd.net/um/v2?partner=google HTTP 302
https://cm.g.doubleclick.net/pixel?google_cm&google_nid=krux_digital&google_hm=T3JVWC1zeTI HTTP 302
https://beacon.krxd.net/usermatch.gif?google_gid=CAESEEJvJLDAW88FhJfRcHwQVpU&google_cver=1

Request Chain 91

https://cm.g.doubleclick.net/pixel?google_nid=krux_digital&google_cm&google_hm=T3JVWC1zeTI HTTP 302
https://beacon.krxd.net/usermatch.gif?google_gid=CAESEEJvJLDAW88FhJfRcHwQVpU&google_cver=1

Request Chain 93

https://stags.bluekai.com/site/26357?id=OrUX-sy2&redir=https://beacon.krxd.net/usermatch.gif?_kuid%3DOrUX-sy2%26partner%3Dbluekai%26bk_uuid%3D%24_BK_UUID HTTP 302
https://beacon.krxd.net/usermatch.gif?_kuid=OrUX-sy2&partner=bluekai&bk_uuid=$_BK_UUID

Request Chain 95

https://sync-tm.everesttech.net/upi/pid/NC4WTmcy?redir=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner_id%3Dcb276571-e0d9-4438-9fd4-80a1ff034b01%26puid%3D%24%7BTM_USER_ID%7D HTTP 302
https://beacon.krxd.net/usermatch.gif?partner_id=cb276571-e0d9-4438-9fd4-80a1ff034b01&puid=YhRBggAH9Y6JOwAy

Request Chain 96

https://usermatch.krxd.net/um/v2?partner=beeswax HTTP 302
https://match.prod.bidr.io/cookie-sync/krux?partner_user_id=OrUX-sy2 HTTP 303
https://match.prod.bidr.io/cookie-sync/krux?partner_user_id=OrUX-sy2&_bee_ppp=1 HTTP 303
https://beacon.krxd.net/usermatch.gif?partner=beeswax&partner_uid=AADHsE7EKIMAAH5eVhizbg

Request Chain 97

https://usermatch.krxd.net/um/v2?partner=mediamath HTTP 302
https://sync.mathtag.com/sync/img?mt_exid=10031&mt_exuid=OrUX-sy2&redirect=https://beacon.krxd.net/usermatch.gif?partner%3Dmediamath%26partner_id%3D%5BMM_UUID%5D HTTP 302
https://beacon.krxd.net/usermatch.gif?partner=mediamath&partner_id=2d386214-4182-4d00-a150-6a33a1aba1d8

Request Chain 99

https://usermatch.krxd.net/um/v2?partner=neustar HTTP 302
https://aa.agkn.com/adscores/g.js?sid=9212244187&_kdpid=OrUX-sy2

Request Chain 100

https://ssum-sec.casalemedia.com/usermatchredir?s=183716&cb=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dcasale%26partner_uid%3D__UID__ HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dcasale%26partner_uid%3D__UID__&s=183716&C=1 HTTP 302
https://beacon.krxd.net/usermatch.gif?partner=casale&partner_uid=YhRBgtM0cBpKPoSUl4Qz5QAA%26042

Request Chain 101

https://sync.srv.stackadapt.com/sync?nid=salesforce HTTP 302
https://beacon.krxd.net/usermatch.gif?partner=stackadapt&partner_uid=jz3vfA4wQhJ2neqoOdQylpU4mbc

Request Chain 102

https://usermatch.krxd.net/um/v2?partner=triplelift&gdpr=0&cmp_cs=&us_privacy=undefined HTTP 302
https://eb2.3lift.com/xuid?mid=3587&xuid=OrUX-sy2&dongle=13b2&rdir=https://beacon.krxd.net/usermatch.gif?partner%3Dtriplelift%26partner_uid%3D$UID&gdpr=0&cmp_cs=&us_privacy=undefined HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=3587&xuid=OrUX-sy2&dongle=13b2&gdpr=0&cmp_cs=&us_privacy=undefined&rdir=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dtriplelift%26partner_uid%3D%24UID HTTP 302
https://beacon.krxd.net/usermatch.gif?partner=triplelift&partner_uid=1084003074738852891507

Request Chain 103

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift HTTP 302
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&dcc=t

Request Chain 111

https://ml314.com/csync.ashx?fp=OrUX-sy2&person_id=3625308949374304293&eid=748&return=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dmadisonlogic%26partner_uid%3D3625308949374304293 HTTP 302
https://beacon.krxd.net/usermatch.gif?partner=madisonlogic&partner_uid=3625308949374304293

Request Chain 116

https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D HTTP 302
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D

Request Chain 117

https://ib.adnxs.com/getuid?https://s.amazon-adsystem.com/ecm3?id=$UID&ex=districtm HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID%26ex%3Ddistrictm HTTP 302
https://s.amazon-adsystem.com/ecm3?id=3270471530205738017&ex=districtm

Request Chain 118

https://ib.adnxs.com/getuid?https://s.amazon-adsystem.com/ecm3?id=$UID&ex=appnexus.com HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID%26ex%3Dappnexus.com HTTP 302
https://s.amazon-adsystem.com/ecm3?id=1032252883967861238&ex=appnexus.com

Request Chain 119

https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com HTTP 302
https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1

Request Chain 120

https://cdn.districtm.io/ids/?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D HTTP 301
https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D

Request Chain 121

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=1084003074738852891507

Request Chain 123

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1 HTTP 302
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=97 HTTP 302
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=97 HTTP 302
https://match.sharethrough.com/sync/v1?source_id=gBgkxrVErPj9wqivTDd2AmVY&source_user_id=c76cc6fd-c0a8-4e5c-bb32-40044772f910-62144182-4341&gdpr=0&gdpr_consent=

Request Chain 124

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1 HTTP 302
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=25982a9f-10af-4049-96e3-31137c201343&gdpr=0&gdpr_consent=

Request Chain 125

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3 HTTP 302
https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=18694 HTTP 302
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=KZXH18GE-1W-1EA2

Request Chain 126

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4 HTTP 302
https://ssum.casalemedia.com/usermatchredir?s=186046&cb=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DGM7HYz3VFjuymbiqnJLyjuPy%26source_user_id%3D__UID__ HTTP 302
https://match.sharethrough.com/sync/v1?source_id=GM7HYz3VFjuymbiqnJLyjuPy&source_user_id=YhRBgtM0cBpKPoSUl4Qz5QAA%26042

Request Chain 131

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YhRBggAH9Y6JOwAy

Request Chain 133

https://match.adsrvr.org/track/cmf/openx?oxid=a7300b75-33be-3f1f-536b-0081baaa4dfe&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072971&val=25982a9f-10af-4049-96e3-31137c201343&ttd_puid=a7300b75-33be-3f1f-536b-0081baaa4dfe

Request Chain 135

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEB3zuYhEXL4AuR5qP9qHstQ&google_cver=1

Request Chain 137

https://data.adsrvr.org/track/cmf/generic?ttd_pid=federatedmedia&gdpr=0&gdpr_consent= HTTP 302
https://ce.lijit.com/merge?pid=27&3pid=25982a9f-10af-4049-96e3-31137c201343&gdpr=0&gdpr_consent=

Request Chain 138

https://pixel.quantserve.com/pixel/p-CXt61zNBpKUt1.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=ja_3JY-s_iOW_PV13qnrc96v8HWWr6IpjKXQsrg9

Request Chain 139

https://aorta.clickagy.com/pixel.gif?ch=185&cm=da7ec15180eaa86010a10906&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent= HTTP 302
https://ce.lijit.com/merge?pid=84&3pid=c:a643638e815cf4bb0d313e32e48c12ab

Request Chain 140

https://bh.contextweb.com/bh/rtset?pid=558511&ev=1&rurl=https%3A%2F%2Fce.lijit.com/merge?pid=49&3pid=%%VGUID%%&gdpr=0&gdpr_consent= HTTP 302
https://ce.lijit.com/merge?pid=49&3pid=f6fydBPfVMDA&ev=1&pid=558511&gdpr_consent=&gdpr=0

Request Chain 141

https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent= HTTP 302
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=sovrn&gdpr=0&gdpr_consent= HTTP 302
https://ce.lijit.com/merge?pid=87&3pid=5eee8e08-b4d2-47c8-8287-d54394a5c299

Request Chain 142

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=KZXH18GE-1W-1EA2 HTTP 302
https://s.amazon-adsystem.com/ecm3?id=KZXH18GE-1W-1EA2&ex=d-rubiconproject.com&status=ok

Request Chain 144

https://dmx.districtm.io/s/v1/users/10002 HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=dmx.com&id=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOjEwMDAyLCJ1c3IiOiJxZ1llc2dZYk1qVlNaamhGTTNGR1ZXVjZNRUYxVFdWSE1EVkhla0ZKVldGdiJ9.8PZJyw-P0tRPNSlIdp7cqjzdbGhN84KpUwx97Drn6PTecpEodMik8yW2NI5g4KXJaZwcHFPRD_12THUipYsiMg

Request Chain 145

https://c1.adform.net/serving/cookie/match?party=14&cid=F5442E89-17F3-44B7-B527-DBDE7BA68DD7 HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=F5442E89-17F3-44B7-B527-DBDE7BA68DD7

Request Chain 146

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YhRBggAH9Y6JOwAy&gdpr=0&gdpr_consent=

Request Chain 148

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=9UQuiRfzRLe1J9vee6aN1w%3D%3D HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

Request Chain 149

https://idsync.rlcdn.com/420486.gif?partner_uid=F5442E89-17F3-44B7-B527-DBDE7BA68DD7 HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=82c1247234cc368950cd699276b3e03448c65554540528962d0bc1b86d240ac8791426b5417dce21&_=2 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA4MmMxMjQ3MjM0Y2MzNjg5NTBjZDY5OTI3NmIzZTAzNDQ4YzY1NTU0NTQwNTI4OTYyZDBiYzFiODZkMjQwYWM4NzkxNDI2YjU0MTdkY2UyMRAAGgwIgoPRkAYSBAgCEABCAEoA HTTP 302
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA4MmMxMjQ3MjM0Y2MzNjg5NTBjZDY5OTI3NmIzZTAzNDQ4YzY1NTU0NTQwNTI4OTYyZDBiYzFiODZkMjQwYWM4NzkxNDI2YjU0MTdkY2UyMRAAGgwIgoPRkAYSBAgCEABCAEoA&google_gid=CAESEEG3kHQD4H-26w5-OUJ-nqY&google_cver=1 HTTP 307
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3= HTTP 303
https://idsync.rlcdn.com/458249.gif?partner_uid=71ae591f-056f-461a-851c-4f2962414785

Request Chain 150

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=2d386214-4182-4d00-a150-6a33a1aba1d8

Request Chain 151

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjU0NDJFODktMTdGMy00NEI3LUI1MjctREJERTdCQTY4REQ3&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 152

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEGOWN_jMTikL_CdbmFUi3lM&google_cver=1

Request Chain 153

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:4DC78985468648D4B1B4F7DEDE93899D

Request Chain 154

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7255204550680405259&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 155

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=25982a9f-10af-4049-96e3-31137c201343

Request Chain 156

https://token.rubiconproject.com/token?pid=25470 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pYSDE4R0UtMVctMUVBMg==

Request Chain 157

https://token.rubiconproject.com/token?pid=26594 HTTP 302
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KZXH18GE-1W-1EA2&sigv=1&esig=2~4ace4d71fddf952a09d3520845d7442f669f32fb

Request Chain 158

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1 HTTP 302
https://pr-bh.ybp.yahoo.com/sync/rubicon/wUr2VdDB7fzExvUSdOLWmcn5EUdSAgOZEtemQ7w0kco?csrc= HTTP 302
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6483038817428292933

Request Chain 159

https://token.rubiconproject.com/token?pid=36584 HTTP 302
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=KZXH18GE-1W-1EA2

Request Chain 161

https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D HTTP 302
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=2d386214-4182-4d00-a150-6a33a1aba1d8&expires=28

Request Chain 162

https://token.rubiconproject.com/token?pid=2249&pt=n HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MmY4YjJiNjBhNGI4OWQ3M2ViOTc4MWZlZjUxZDg5YTc5MDNmNTAyYQ

Request Chain 163

https://match.adsrvr.org/track/cmf/rubicon HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=25982a9f-10af-4049-96e3-31137c201343&gdpr=0&gdpr_consent=&expires=30

Request Chain 169

https://sb.scorecardresearch.com/c2/10276888/cs.js HTTP 302
https://sb.scorecardresearch.com/internal-c2/default/cs.js

Request Chain 209

https://a.tribalfusion.com/i.match?p=b6&u=CAESEMKbeOLaGcFnJa9ag3dJ6Wc&google_cver=1&google_push=AYg5qPKJzYa0PYfYp9wPj_WBMVRL88Afx8Pgs3aQjt0cVpb198Gt3nns6Ws73PLipH-E0rb1lxl-F3EdF-JoaaCXy5k3VojNIY2R&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPKJzYa0PYfYp9wPj_WBMVRL88Afx8Pgs3aQjt0cVpb198Gt3nns6Ws73PLipH-E0rb1lxl-F3EdF-JoaaCXy5k3VojNIY2R%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEMKbeOLaGcFnJa9ag3dJ6Wc&google_cver=1&google_push=AYg5qPKJzYa0PYfYp9wPj_WBMVRL88Afx8Pgs3aQjt0cVpb198Gt3nns6Ws73PLipH-E0rb1lxl-F3EdF-JoaaCXy5k3VojNIY2R&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPKJzYa0PYfYp9wPj_WBMVRL88Afx8Pgs3aQjt0cVpb198Gt3nns6Ws73PLipH-E0rb1lxl-F3EdF-JoaaCXy5k3VojNIY2R%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 211

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEJqvSApMhOz4M1AgsAu11Og&google_cver=1&google_push=AYg5qPJZ5WH6tsQWl6cDLWzbsF_qNjBA3V_nbrUgH6GC6cPRRYo-wQoJ2QYkeTDprXIWl7TyLPp3P3A-lB-l3yvrEATsTkmSNm3P HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=jz3vfA4wQhJ2neqoOdQylpU4mbc&google_push=AYg5qPJZ5WH6tsQWl6cDLWzbsF_qNjBA3V_nbrUgH6GC6cPRRYo-wQoJ2QYkeTDprXIWl7TyLPp3P3A-lB-l3yvrEATsTkmSNm3P

Request Chain 212

https://match.360yield.com/match/ebda?google_gid=CAESELUeKXb95YsN1Q2ZzmSDWSk&google_cver=1&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESELUeKXb95YsN1Q2ZzmSDWSk&google_cver=1&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE

Request Chain 213

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEAuuQmryB3tV7RNXe0_UrR0&google_cver=1&google_push=AYg5qPL_PWukON-QKCD5MBhz0QX-aDXWAB5byMmA-Ctt1-8VF1SevmTc-ii1OSwEwttZsAogfw9VHZ9kox2pIJ128AOFXCEPD61t HTTP 302
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=AYg5qPL_PWukON-QKCD5MBhz0QX-aDXWAB5byMmA-Ctt1-8VF1SevmTc-ii1OSwEwttZsAogfw9VHZ9kox2pIJ128AOFXCEPD61t&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&cb=1645494659903 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-673dd3f2-f25b-4f39-982b-68ec1dae7252-005?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAYg5qPL_PWukON-QKCD5MBhz0QX-aDXWAB5byMmA-Ctt1-8VF1SevmTc-ii1OSwEwttZsAogfw9VHZ9kox2pIJ128AOFXCEPD61t%26google_hm%3DBWc90_LyW085mCto7B2uclI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPL_PWukON-QKCD5MBhz0QX-aDXWAB5byMmA-Ctt1-8VF1SevmTc-ii1OSwEwttZsAogfw9VHZ9kox2pIJ128AOFXCEPD61t&google_hm=BWc90_LyW085mCto7B2uclI

Request Chain 214

https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEMRFSnHscxOjp4_o150gNrY&google_cver=1&google_push=AYg5qPKnwBAooDOsLL7Ph_V7GNZ3WB4-EAE4daKBmL3zzNA95ndgddG9OQs7oqVNysrX1qdiIhGR6ijFBVF3KELdG--Vkh2SA7pl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPKnwBAooDOsLL7Ph_V7GNZ3WB4-EAE4daKBmL3zzNA95ndgddG9OQs7oqVNysrX1qdiIhGR6ijFBVF3KELdG--Vkh2SA7pl&google_hm=MjI5MTIwMDI0MTkyNDYyNDE1Mw%3D%3D

Request Chain 215

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEPWzLHnPNxANe-HSYMWCJ4k&google_cver=1&google_push=AYg5qPKNlGV_xlLEtMeclfQWPOaChigfVk4nrJGu9RTsi7H1jOvEDnaVSsusTgzPkl2YIg0jIYn5TXuqEzfVu8cubaEJpYvcs89E8g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MzdmMjVmNDctZmNiNC00N2ZjLTk2ZWYtN2VmMzhjZmY0MjYy&google_push=AYg5qPKNlGV_xlLEtMeclfQWPOaChigfVk4nrJGu9RTsi7H1jOvEDnaVSsusTgzPkl2YIg0jIYn5TXuqEzfVu8cubaEJpYvcs89E8g

Request Chain 217

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEDA_ikeK12kWgXwxF9mYRU8&google_cver=1&google_push=AYg5qPJHSTNPtcSFiGaERIJlytRXHiJo2YqKU6a2l67ME75i0t0kzzt0y9tYgn1Hi7gIucIYZJezjmnzrNNSwNiLQ0hzBFj9NpqE HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AYg5qPJHSTNPtcSFiGaERIJlytRXHiJo2YqKU6a2l67ME75i0t0kzzt0y9tYgn1Hi7gIucIYZJezjmnzrNNSwNiLQ0hzBFj9NpqE&google_hm=9NSVRZjINeOUJwklYMfdUg

Request Chain 219

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEGZCl21SKlC5tpNuyI4NdgM&google_cver=1&google_push=AYg5qPLCIxluxAFN4qqhxDF1Ll99JRY9S7ZJzOH08lIgT-vqNjY-yscyUeBy6-rh5oG5u1smstTuLUeGXIOudccQ1_bN-JE5Mx0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTQ2Njk5NjIwMDYyMDc5MTU2&google_push=AYg5qPLCIxluxAFN4qqhxDF1Ll99JRY9S7ZJzOH08lIgT-vqNjY-yscyUeBy6-rh5oG5u1smstTuLUeGXIOudccQ1_bN-JE5Mx0

Request Chain 220

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEJqvSApMhOz4M1AgsAu11Og&google_cver=1&google_push=AYg5qPK1B_u3mYjdDdMP6TLs1eiLZ-GsfN6xZL0LWuKxeXYvuIwVWAKDRD8LevMCBAce5NhVOzl-MYyLKPG9vSMVa-IYYgNqlq3x HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=jz3vfA4wQhJ2neqoOdQylpU4mbc&google_push=AYg5qPK1B_u3mYjdDdMP6TLs1eiLZ-GsfN6xZL0LWuKxeXYvuIwVWAKDRD8LevMCBAce5NhVOzl-MYyLKPG9vSMVa-IYYgNqlq3x

Request Chain 221

https://onetag-sys.com/sync/i,19/?google_gid=CAESEFWBgVV1OEvDQTnebVFvutw&google_cver=1&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ

Request Chain 222

https://ads.yieldmo.com/exptsync?google_gid=CAESECdLDKyTVQeTa-RuvFx-aA0&google_cver=1&google_push=AYg5qPLOsDqy-eUShripw8CA4nLyXutUhbec0zti8hV1kSVauCiObQJbuQPdpM_E_BMr0UmYWCR0TlLkmrSxO3g-BJvg9y1CS2gr HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AYg5qPLOsDqy-eUShripw8CA4nLyXutUhbec0zti8hV1kSVauCiObQJbuQPdpM_E_BMr0UmYWCR0TlLkmrSxO3g-BJvg9y1CS2gr&google_hm=Zzg2ZTA0ODYyYTllNmFlZDEwYzM=

228 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Redirect Chain

http://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

619 KB
189 KB

6452ms
6425ms

Document
text/html

34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

ea785267c1fb17f52f19fb3f2e95507c31dc5e1078248861cad28bdabc364a7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding user-agent
expires: Tue, 22 Feb 2022 01:55:56 GMT
cache-control: max-age=300
x-frame-options: SAMEORIGIN
x-pmd-backend: cheetah-nginx
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains

Redirect headers

Date: Tue, 22 Feb 2022 01:50:50 GMT
Content-Type: text/html
Content-Length: 164
Connection: keep-alive
Location: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 82 KB
27 KB 92ms
40ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

sffe /

Resource Hash

a98e42e3eb993cc80c926236bbdcbfbd4c531f23bc794d51c0f09c74a526f746

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27502
x-xss-protection: 0
server: sffe
etag: "1139 / 950 of 1000 / last-modified: 1645225517"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 22 Feb 2022 01:50:57 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 134 KB
36 KB 97ms
21ms Script
application/javascript 52.85.63.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.63.179 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-63-179.ewr53.r.cloudfront.net
Software: Server /
Resource Hash: 238a7b88a5b7237a3fde744d5b7a0d8deafbe118e52453771e9e1872cac1b41f

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 21 Feb 2022 18:37:34 GMT
content-encoding: gzip
age: 26002
x-cache: Hit from cloudfront
timing-allow-origin: *
server: Server
x-amz-rid: 1DA6TGKSF9F7C92KN4ER
etag: f1657332112584c2a291a2c0cf3f7f54
vary: Accept-Encoding
x-amz-version-id: dkyGJfcqQKWqvk5dcRyDTiDXR6RVq2hW
via: 1.1 35c803afef083002d824403342d4c62e.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: EWR53-P1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: Hz6C1LOJSSXL0k68_QjfP-C0Twvc__6oGwCfvjcqXzNh-RBfo9vZ-g==

GET
H2 200 all.postmedia.js Show response
hb.districtm.io/prod/100549/ 36 KB
13 KB 91ms
37ms Script
application/javascript 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.districtm.io/prod/100549/all.postmedia.js
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d5f7c1c0cbec2c27d4165db4cd06b7780f477fc9161008bde67c7a9d62b223aa

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
via: 1.1 957a0e737a088bdc07cb5cc9dcc9e826.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 2177
x-cache: Miss from cloudfront
cf-bgj: minify
content-encoding: br
last-modified: Thu, 10 Dec 2020 10:37:54 GMT
server: cloudflare
etag: W/"5f2e83162e71fb84bb30df8f49e91eee"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=43200
x-amz-cf-pop: EWR53-P1
cf-ray: 6e1491076b9f8cab-EWR
x-amz-cf-id: bFT4I-il0g34Vmaug37LHdj2gLNzmqX_Ynexnpd0hhpO4_cj828KOg==
expires: Tue, 22 Feb 2022 13:50:57 GMT

GET
H/1.1 200
OK iasPET.1.js Show response
cdn.adsafeprotected.com/ 22 KB
7 KB 106ms
18ms Script
application/javascript 52.85.61.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adsafeprotected.com/iasPET.1.js
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-15.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2afcabe2eb6314148dfd9dfdec1333b973d97d0780cc08fddab8501afbb013e9

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 17:55:56 GMT
Content-Encoding: gzip
Connection: keep-alive
Last-Modified: Wed, 02 Jun 2021 17:38:57 GMT
Server: AmazonS3
Age: 287702
ETag: W/"51636de3ce868a2172f9e6996c2934e0"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 c4460641b6e6b194f0c11732a1b10d1c.cloudfront.net (CloudFront)
Cache-Control: max-age=604800
Transfer-Encoding: chunked
X-Amz-Cf-Pop: EWR53-P1
X-Amz-Cf-Id: 10i_Ya4N0YVm0gkR8cm1TZ08ThqApTW5VrGIlWqyDIrQFGG594crWQ==

GET
H2 200 css
fonts.googleapis.com/ 7 KB
1 KB 84ms
33ms Stylesheet
text/css 2607:f8b0:4006:822::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Condensed:700%7CRoboto:400,700&display=swap

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::200a Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aa8c4f5924fd06cbaf5c65fac729f0c3207d1f70534b07fc0915948c41b29d6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 22 Feb 2022 00:46:57 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 22 Feb 2022 01:50:57 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 22 Feb 2022 01:50:57 GMT

GET
H2 200 advertising.js Show response
www.npttech.com/ 7 KB
3 KB 67ms
20ms Script
application/javascript 2606:4700:3037::6815:3c3f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.npttech.com/advertising.js
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6815:3c3f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7538e8f23fac8278c6027d8865bd1240514a3ff64b2c0af3b8ed3583e8ecce6b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 426
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: JNMEQGQ9NJ9E6X1S
x-amz-id-2: fxImh/8M8kos4PfArLZQ66EMsMP9XUBIudAFPFkNaHH9tQrUf3+tzsmbOphXS4daZ7ig6eUbrKc=
last-modified: Wed, 19 Jun 2019 08:25:01 GMT
server: cloudflare
etag: W/"3d6f80c860866175f58a84bbbc9217c6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9dXAf%2FVROo6eA3uhyZ9mjXoZv4vG9Ocq%2Bl4rvuLhI%2BhYzxQD5ta%2BbBumz6i9u20aYMsjz5bDvKHJ2Rfg%2FNwv2DrGbG9OKc3k3mqKb6uHgCUGLFjrOpWIM5TJMUVaK0bJQH%2F3aMWIoarOsTQs1E0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=28800
x-amz-version-id: hXQWgdpwSBM26VgKOeTSlm.4VT89.h9w
cf-ray: 6e149107ee84713e-YUL

GET
H2 200 LoginRadiusV2.js Show response
auth.lrcontent.com/v2/js/ 199 KB
47 KB 63ms
20ms Script
application/javascript 2606:4700:10::6816:49e8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.lrcontent.com/v2/js/LoginRadiusV2.js

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:49e8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

68a335c0d87dce935fee1811892070e78c514828d50bfe2ae21fde739ec1002c

Security Headers

Name	Value
Strict-Transport-Security	max-age= 63072000; includeSubdomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
via: 1.1 c1c976b1b60b605adb44f62da9e0bb8a.cloudfront.net (CloudFront)
vary: Accept-Encoding
cf-cache-status: HIT
age: 1141
cf-polished: origSize=1238069
x-cache: Miss from cloudfront
content-encoding: gzip
last-modified: Mon, 13 Dec 2021 05:19:58 GMT
server: cloudflare
etag: W/"ae3463c4a59ae100b160ed4dd5dbf4b8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age= 63072000; includeSubdomains; preload
content-type: application/javascript
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C3
cf-ray: 6e1491075aba7150-YUL
x-amz-cf-id: UKx_SLTr25mJR9OxZ3Jl1iZpjZMyCaPjbVBPFMpyn7yVrNt_E6CAIg==
cf-bgj: minify

GET
H2 200 spm.v1.min.js Show response
ak.sail-horizon.com/spm/ 121 KB
43 KB 86ms
22ms Script
application/javascript 52.85.61.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ak.sail-horizon.com/spm/spm.v1.min.js
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.89 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-89.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d06ae5e97e495832fc4526c3e93d7e9440f1faf5f77669b41678c9d564a25faf

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:49:37 GMT
content-encoding: gzip
last-modified: Tue, 08 Jun 2021 04:22:34 GMT
server: AmazonS3
age: 81
etag: W/"b22b4f4738e8722be1636447be239da2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 19e58616339f974c22a3a07f8f637718.cloudfront.net (CloudFront)
cache-control: max-age=600; must-revalidate
x-amz-cf-pop: EWR53-P1
x-amz-cf-id: rzQcS5ZmRHoYRje9KAJIkuYGfNAjDLHQiSwpIbDap9_S8sV4G1ZKYA==

GET
H/1.1 200
OK fem.js Show response
pmd-dev-frontend-modules.s3.amazonaws.com/AA-606-0c8bf33/ 265 KB
265 KB 116ms
62ms Script
application/javascript 52.95.146.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pmd-dev-frontend-modules.s3.amazonaws.com/AA-606-0c8bf33/fem.js
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.146.203 Montreal, Canada, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-w.ca-central-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: bfe59bd642bfb002cede8d9aa3fdfb08da38e7841521e9d24bc4da59e0986d76

Request headers

Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Origin: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Tue, 22 Feb 2022 01:50:58 GMT
Last-Modified: Fri, 18 Feb 2022 18:41:06 GMT
Server: AmazonS3
x-amz-request-id: 91RBBK1S316C4V0N
ETag: "855c41473eedb90d6c5d854b870fbf74"
Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 3000
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 271134
x-amz-id-2: 4yZ1DqyKRnp+l5n1Lp8AqSxLLTiPjSCfp6cWdF4vhKr51/09CpwltKuChQ8m3BUj132nGfZ4H4Y=

GET
H2 200 business-wire-logo.svg
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/images/common/ 11 KB
4 KB 22ms
19ms Image
image/svg+xml 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/images/common/business-wire-logo.svg

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

7fb15552a88b764ca42963e71136255cecf99c6bccc6fdc68fbe0f930a516cb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
last-modified: Fri, 24 Dec 2021 02:26:29 GMT
etag: W/"61c52fd5-2b6a"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Fri, 17 Feb 2023 01:50:57 GMT

GET
H2 200 Newsfile-High-Res.png
smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/04/ 13 KB
13 KB 95ms
20ms Image
image/webp 52.85.61.25
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/04/Newsfile-High-Res.png
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.25 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-25.ewr53.r.cloudfront.net
Software: nginx/1.19.10 /
Resource Hash: 7720a0f40d088f144d749c07f075b8dfdc84afd25900a59045fe6c29d0fc5090

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Tue, 04 May 2021 23:36:37 GMT
via: 1.1 2c7d387775f2e52dd268d2f49202b5d2.cloudfront.net (CloudFront)
server: nginx/1.19.10
age: 25323260
etag: "58a1b532378c9a60bc8df47534dea7218beaf9a0"
vary: Accept
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=31536000,public
x-amz-cf-pop: EWR53-P1
x-pmd-smart-cdn-proxy: da21880a3f69
content-length: 13064
x-amz-cf-id: 9PbDtmpQSm10R75RNEfrFyFsGGVSWsibtENLgz7QtYkDN3Gmr9fwKw==
expires: Wed, 04 May 2022 23:36:37 GMT

GET
H2 200 globe-newswire.svg
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/images/common/ 14 KB
4 KB 18ms
15ms Image
image/svg+xml 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/images/common/globe-newswire.svg

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

ca157b8a9c98a19c0446a974ea642d13e3b3398f328d312fd474df9f63c45fe9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
last-modified: Fri, 24 Dec 2021 02:26:29 GMT
etag: W/"61c52fd5-3750"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Fri, 17 Feb 2023 01:50:57 GMT

GET
H2 200 icon-soc-fb.svg
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/images/share-icons/ 775 B
692 B 19ms
17ms Image
image/svg+xml 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/images/share-icons/icon-soc-fb.svg

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

40e562e806ce113ae7879d0dd76db82797b5c274794751c260381f2c8b283641

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
last-modified: Fri, 24 Dec 2021 02:26:29 GMT
etag: W/"61c52fd5-307"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Fri, 17 Feb 2023 01:50:57 GMT

GET
H2 200 icon-soc-tw.svg
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/images/share-icons/ 2 KB
1 KB 17ms
14ms Image
image/svg+xml 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/images/share-icons/icon-soc-tw.svg

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

975a64dc9bbc5e1884ba8ca2e76d9b2791d16d5c9f3619bf30477cd21a8636d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
last-modified: Fri, 24 Dec 2021 02:26:29 GMT
etag: W/"61c52fd5-6a2"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Fri, 17 Feb 2023 01:50:57 GMT

GET
H2 200 shared.3d6e20680ace.js Show response
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/CACHE/js/ 24 KB
10 KB 20ms
18ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/CACHE/js/shared.3d6e20680ace.js

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

3d6e20680ace24ba433ac950d7719fd3e756cb4c57626d64be6e88f1c742fc15

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Origin: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
last-modified: Fri, 24 Dec 2021 02:26:33 GMT
etag: W/"61c52fd9-5e02"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Fri, 17 Feb 2023 01:50:57 GMT

GET
H2 200 main.aebf0e0d15c0.js Show response
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/CACHE/js/ 94 KB
30 KB 22ms
20ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/CACHE/js/main.aebf0e0d15c0.js

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

aebf0e0d15c0130fbe1375e3d5daff30441efea4c2545cc9f69cea6c13bab3a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Origin: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
last-modified: Fri, 24 Dec 2021 02:26:33 GMT
etag: W/"61c52fd9-176b6"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Fri, 17 Feb 2023 01:50:57 GMT

GET
DATA 200
OK truncated
/ 128 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 23d00276404c2322c5d3bb27f5e930b67f81bc964189b36b028ab1521a5929db

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
16 KB 76ms
19ms Font
font/woff2 2607:f8b0:4006:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto+Condensed:700%7CRoboto:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 01:28:42 GMT
x-content-type-options: nosniff
age: 346935
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 18 Feb 2023 01:28:42 GMT

GET
H2 200 ieVi2ZhZI2eCN5jzbjEETS9weq8-32meGCQYbw.woff2
fonts.gstatic.com/s/robotocondensed/v24/ 15 KB
15 KB 99ms
48ms Font
font/woff2 2607:f8b0:4006:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotocondensed/v24/ieVi2ZhZI2eCN5jzbjEETS9weq8-32meGCQYbw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto+Condensed:700%7CRoboto:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e79c1c1a140e6afb861074c70392db54cc65a06050de2a69162ab94eb95b0516

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 16 Feb 2022 19:35:46 GMT
x-content-type-options: nosniff
age: 454511
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15660
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 19:19:40 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 16 Feb 2023 19:35:46 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 76ms
25ms Font
font/woff2 2607:f8b0:4006:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto+Condensed:700%7CRoboto:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 15 Feb 2022 16:23:56 GMT
x-content-type-options: nosniff
age: 552421
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 15 Feb 2023 16:23:56 GMT

GET
H/1.1 200
OK xd.html Show response
pmd-dev-frontend-modules.s3.amazonaws.com/AA-606-0c8bf33/ Frame A3DE 188 B
577 B 72ms
35ms Document
text/html 52.95.146.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pmd-dev-frontend-modules.s3.amazonaws.com/AA-606-0c8bf33/xd.html
Requested by: Host: pmd-dev-frontend-modules.s3.amazonaws.com
URL: https://pmd-dev-frontend-modules.s3.amazonaws.com/AA-606-0c8bf33/fem.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.146.203 Montreal, Canada, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-w.ca-central-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 6c8ee3f969943732ebe4bec6db2f9593e601405cb74b58a677f435d2d2b72b68

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Response headers

x-amz-id-2: yXlm5MCfwfZe6D6EMx/P3P3syDBs9u/c4Gp/6EqfmyuTVkd5ATd3tGAsYuhLObasNl+i5CocdvU=
x-amz-request-id: 91RA13THD5SCD7ZF
Date: Tue, 22 Feb 2022 01:50:58 GMT
Last-Modified: Fri, 18 Feb 2022 18:41:06 GMT
ETag: "eafe5fc79af4b8eea93d579b2d82cca7"
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Type: text/html
Server: AmazonS3
Content-Length: 188

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 495 KB
111 KB 83ms
34ms Script
application/javascript 2607:f8b0:4006:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MKM4ZNQ&l=dataLayer

Requested by

Host: pmd-dev-frontend-modules.s3.amazonaws.com
URL: https://pmd-dev-frontend-modules.s3.amazonaws.com/AA-606-0c8bf33/fem.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2008 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fa1a83860ae68c1af3b078fd55da92278d7c32238380cd8e111e90a398575a4a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112856
x-xss-protection: 0
last-modified: Tue, 22 Feb 2022 00:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 22 Feb 2022 01:50:57 GMT

GET
H2 200 beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 59ms
19ms Script
application/javascript 52.85.61.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: pmd-dev-frontend-modules.s3.amazonaws.com
URL: https://pmd-dev-frontend-modules.s3.amazonaws.com/AA-606-0c8bf33/fem.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.28 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-28.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 21 Feb 2022 14:47:46 GMT
content-encoding: gzip
etag: W/"1827f116c73f319409b97f10b8a58ade"
last-modified: Fri, 26 Feb 2021 14:35:05 GMT
server: AmazonS3
age: 39797
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 d7202b57803815a076179b3bb9bbd766.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-P1
x-amz-cf-id: HB8bpxWmD8vbYKKn2_CEgubgbTTUsGZCgzJFQ477uCVpeA1bu0Rpcw==

GET
H2 200 mparticle.js Show response
jssdkcdns.mparticle.com/js/v2/us1-a9588c0ddc27594cabd152e47ffe27ee/ 184 KB
48 KB 148ms
112ms Script
application/javascript 2a04:4e42:200::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://jssdkcdns.mparticle.com/js/v2/us1-a9588c0ddc27594cabd152e47ffe27ee/mparticle.js
Requested by: Host: pmd-dev-frontend-modules.s3.amazonaws.com
URL: https://pmd-dev-frontend-modules.s3.amazonaws.com/AA-606-0c8bf33/fem.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:200::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Kestrel /
Resource Hash: f7914b4836b5815c4b3dcd79c44fa3390dedf00785d79f90dc7f6c6f38c947c5

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
via: 1.1 varnish, 1.1 varnish
server: Kestrel
age: 0
x-origin-name: fastlyshield--shield_ssl_cache_iad_kiad7000146_IAD
x-served-by: cache-iad-kiad7000146-IAD, cache-yul12828-YUL
vary: Accept, Accept-Encoding
x-cache: MISS, MISS
content-type: application/javascript
content-encoding: gzip
cache-control: public, max-age=3600
accept-ranges: bytes
x-timer: S1645494658.524928,VS0,VE96
content-length: 48496
x-cache-hits: 0, 0

GET
H2 200 uthtxmddg.js Show response
cdn.krxd.net/controltag/ 29 KB
7 KB 43ms
11ms Script
text/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/controltag/uthtxmddg.js
Requested by: Host: pmd-dev-frontend-modules.s3.amazonaws.com
URL: https://pmd-dev-frontend-modules.s3.amazonaws.com/AA-606-0c8bf33/fem.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 76a237b880fbfc8ac655e91dcf5c9af3b44ccc506c69328409b4047d72519eea

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_config_service_ash_prod
date: Tue, 22 Feb 2022 01:50:57 GMT
via: 1.1 varnish, 1.1 varnish
age: 985
x-cache: MISS, HIT, HIT
x-app-cache: HIT
x-age: 0
content-encoding: gzip
content-length: 6471
x-served-by: config-service-a003-ash-prod.krxd.net, cache-iad-kiad7000123-IAD, cache-yul12825-YUL
x-response-time: 1
x-do-esi: esi
x-timer: S1645494658.521089,VS0,VE0
etag: "8d8408c6b02eb41f93710c678ece74490c4f6485"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=1200
accept-ranges: bytes
x-cache-hits: 0, 1, 30

GET
H2 200 pubads_impl_2022021401.js Show response
securepubads.g.doubleclick.net/gpt/ 360 KB
121 KB 21ms
20ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022021401.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

sffe /

Resource Hash

8e2dcb9912e96ad6472e010d4e66d67c647dfc385f09d652c1ff8d4d752baf14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 20 Feb 2022 01:29:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 174115
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 123280
x-xss-protection: 0
last-modified: Mon, 14 Feb 2022 09:43:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 20 Feb 2023 01:29:02 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 133 B
145 B 67ms
39ms XHR
application/json 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=revert-cheet-3898-ontariofarmer.gdev.postmedia.digital

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

3f00d652362583c48f3e00e6882a084213f1ae76107f5819fe992ddc75139b87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 120
x-xss-protection: 0
expires: Tue, 22 Feb 2022 01:50:57 GMT

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
330 B 36ms
35ms XHR
text/plain 52.85.63.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3528&u=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.63.179 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-63-179.ewr53.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
via: 1.1 35c803afef083002d824403342d4c62e.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: EWR53-P1
x-cache: Miss from cloudfront
access-control-allow-origin: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-id: N9XdPLn8ORROi0UawvPSMWW_3u8SKWO3sQItc98eXwSoWn06KWOk4A==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 107ms
66ms XHR
application/javascript 52.85.63.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.63.179 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-63-179.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin
x-amz-cf-pop: EWR53-P1
x-cache: Miss from cloudfront
access-control-allow-origin: *
last-modified: Sat, 19 Feb 2022 01:26:04 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: kI14R7urpxgHjeMWGWlNpVn0IgFose_t
via: 1.1 4b6e1bc9480bffb0b8980e408fffa59e.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
content-type: application/javascript
x-amz-cf-id: 76hU2fwTb80Er3PStDU1yC8SJUk7pe_CHmrTAh1Xz999gHag35RBfg==

GET
H2 200 pub Show response
pixel.adsafeprotected.com/services/ 2 KB
2 KB 94ms
35ms XHR
application/json 52.4.137.218
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/services/pub?anId=928934&slot=%7Bid:ad-1,ss:%5B1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-2,ss:%5B6.6,1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-native-1,ss:%5B5.5%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-3,ss:%5B7.7,1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-native-2,ss:%5B5.5%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-4,ss:%5B1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-native-3,ss:%5B5.5%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-5,ss:%5B1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-native-4,ss:%5B5.5%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-6,ss:%5B1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-native-5,ss:%5B5.5%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-7,ss:%5B1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-native-6,ss:%5B5.5%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-8,ss:%5B1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-native-7,ss:%5B5.5%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-9,ss:%5B1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-native-8,ss:%5B5.5%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-10,ss:%5B1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&wr=1600.1200&sr=1600.1200&sessionId=ea9990d1-a6fb-9ddf-c7e4-d739d20c87f8&url=https%253A%252F%252Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%252F
Requested by: Host: cdn.adsafeprotected.com
URL: https://cdn.adsafeprotected.com/iasPET.1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.4.137.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-137-218.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 40f460b0a11cc3dd45853c3907c92490cda1e1ba7fc2aeeefb8ecf10643cef0c

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
x-server-name: app11.va.303net.net
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
access-control-expose-headers: X-Server-Name
access-control-allow-credentials: true
timing-allow-origin: *
server: nginx

GET
H2 200 7b3b1c666ca0ec3aa30815.js Show response
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/ 13 KB
5 KB 12ms
12ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/7b3b1c666ca0ec3aa30815.js

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/CACHE/js/shared.3d6e20680ace.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

709932d262282e65073a8940fc09fc3fffbeb13682a8190bf8a1e96fc2c59888

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
last-modified: Fri, 24 Dec 2021 02:25:52 GMT
etag: W/"61c52fb0-3211"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Fri, 17 Feb 2023 01:50:57 GMT

GET
H2 200 1bd3027b055930c428798.js Show response
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/ 10 KB
3 KB 12ms
12ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/1bd3027b055930c428798.js

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/CACHE/js/shared.3d6e20680ace.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

3c59439b4ea6905545d0a5f41278422ee0d3bb3d370b4b8eaea35f306a9e1f63

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
last-modified: Fri, 24 Dec 2021 02:25:52 GMT
etag: W/"61c52fb0-28b7"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Fri, 17 Feb 2023 01:50:57 GMT

GET
H2 200 c21a9b55aee30072973019.js Show response
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/ 6 KB
3 KB 22ms
22ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/c21a9b55aee30072973019.js

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/CACHE/js/shared.3d6e20680ace.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

65bdb0f68bb734a9ee0412aeb1d9898bd4098339efd43b8356acf19b3d8c3ad5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
last-modified: Fri, 24 Dec 2021 02:25:52 GMT
etag: W/"61c52fb0-1890"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Fri, 17 Feb 2023 01:50:57 GMT

GET
H2 200 02f6fe35cf4ad2674cc916.js Show response
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/ 7 KB
3 KB 20ms
18ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/02f6fe35cf4ad2674cc916.js

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/CACHE/js/shared.3d6e20680ace.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

6902e79f7c8a801e6c1e25c65fd4dcf30034a12d12dad3286d2f0af4457c9b0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
last-modified: Fri, 24 Dec 2021 02:25:52 GMT
etag: W/"61c52fb0-1a84"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Fri, 17 Feb 2023 01:50:57 GMT

GET
H2 200 d425b4b71b15e7eb53b310.js Show response
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/ 11 KB
4 KB 20ms
18ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/d425b4b71b15e7eb53b310.js

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/CACHE/js/shared.3d6e20680ace.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

adaf81788242f9c48cc12172354c5df3e22fdcbcd2c3979dd83b419bb59e3db7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
last-modified: Fri, 24 Dec 2021 02:25:52 GMT
etag: W/"61c52fb0-2ab4"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Fri, 17 Feb 2023 01:50:57 GMT

GET
H2 200 f3500b3ce093146933ed28.js Show response
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/ 9 KB
3 KB 20ms
19ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/f3500b3ce093146933ed28.js

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/CACHE/js/shared.3d6e20680ace.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

0878df8b9a030066f26276aab6a4e36e509b480ec37fdac609ec3037611267d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
last-modified: Fri, 24 Dec 2021 02:25:52 GMT
etag: W/"61c52fb0-25d9"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Fri, 17 Feb 2023 01:50:57 GMT

GET
H2 200 732f5d85811fe762c9444.js Show response
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/ 8 KB
3 KB 21ms
20ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/732f5d85811fe762c9444.js

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/CACHE/js/shared.3d6e20680ace.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

c1613fae297f062becb2e3f0a24314be2a09ba5809d48bd1a2ea5eacb95e18ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
last-modified: Fri, 24 Dec 2021 02:25:52 GMT
etag: W/"61c52fb0-1eaa"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Fri, 17 Feb 2023 01:50:57 GMT

GET
H2 200 48cb48fffb4b21371c986.js Show response
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/ 19 KB
6 KB 28ms
27ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/48cb48fffb4b21371c986.js

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/CACHE/js/shared.3d6e20680ace.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

fe3cd3089faea77abfd92708efafcb5af900dead2bea4d8655a5b879cefc0f05

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
last-modified: Fri, 24 Dec 2021 02:25:52 GMT
etag: W/"61c52fb0-4c4a"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Fri, 17 Feb 2023 01:50:57 GMT

GET
H2 200 a58e8c4ae3847ac9536913.js Show response
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/ 45 KB
12 KB 29ms
28ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/a58e8c4ae3847ac9536913.js

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/CACHE/js/shared.3d6e20680ace.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

ec5048fe0002a0fd7fdc7141ffd02691784cd09dc8f1adee6783c86d8d5604cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
last-modified: Fri, 24 Dec 2021 02:25:52 GMT
etag: W/"61c52fb0-b2ee"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Fri, 17 Feb 2023 01:50:57 GMT

GET
H2 200 CD_Bake-it-Foward-Truck-e1639757520670.jpg
smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/12/ 31 KB
32 KB 25ms
18ms Image
image/webp 52.85.61.25
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/12/CD_Bake-it-Foward-Truck-e1639757520670.jpg?quality=90&strip=all&w=344&type=webp
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.25 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-25.ewr53.r.cloudfront.net
Software: nginx/1.19.10 /
Resource Hash: 5853621d02d975fba45c91907a09fec43c635c608a30f31ecd9b85342693b41d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Mon, 21 Feb 2022 16:44:30 GMT
via: 1.1 2c7d387775f2e52dd268d2f49202b5d2.cloudfront.net (CloudFront)
server: nginx/1.19.10
age: 32787
etag: "ad4eb5e4458105b8a5460e49803224b75633b8a0"
vary: Accept
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=31536000,public
x-amz-cf-pop: EWR53-P1
x-pmd-smart-cdn-proxy: 40f839df65e4
content-length: 32210
x-amz-cf-id: 8tozgCHaLpKGPXYiMQkcvkSsMv_xOK3NMcP6cPtfifAOw5HPZ52BWA==
expires: Tue, 21 Feb 2023 16:44:30 GMT

GET
H2 200 wild-boars-e1637260632118.jpg
smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/11/ 16 KB
16 KB 58ms
23ms Image
image/webp 34.149.157.221
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/11/wild-boars-e1637260632118.jpg?quality=90&strip=all&w=344&type=webp
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.157.221 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 221.157.149.34.bc.googleusercontent.com
Software: nginx/1.19.10 /
Resource Hash: c6d4675d324e5b40ed5fe0f15dfc55855a7d6389232ce7c981062d99b80d366c

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Mon, 21 Feb 2022 23:05:38 GMT
via: 1.1 google
server: nginx/1.19.10
cache-control: max-age=2592000,public
age: 9919
etag: "7a09af2688eda187779b301412175145979f59a9"
vary: Accept
content-type: image/webp
x-cache-hit: hit
x-pmd-smart-cdn-proxy: thumbor-proxy-64c799cd7-wf6k7
alt-svc: clear
content-length: 16430

GET
H2 200 Peggy-Brekveld-President-e1637684271190.jpg
smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/11/ 35 KB
35 KB 46ms
12ms Image
image/webp 34.149.157.221
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/11/Peggy-Brekveld-President-e1637684271190.jpg?quality=90&strip=all&w=344&type=webp
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.157.221 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 221.157.149.34.bc.googleusercontent.com
Software: nginx/1.19.10 /
Resource Hash: 42cb48fcecb9f09d629e736d1ca8a7eb9c37c8e493b140d071fa92396897b333

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Mon, 21 Feb 2022 23:05:38 GMT
via: 1.1 google
server: nginx/1.19.10
cache-control: max-age=2592000,public
age: 9919
etag: "9427ccddca2fc4413cf31e61819ef57d3a7733a0"
vary: Accept
content-type: image/webp
x-cache-hit: hit
x-pmd-smart-cdn-proxy: thumbor-proxy-64c799cd7-wf6k7
alt-svc: clear
content-length: 35688

GET
H2 200 ca.0402-dn-migrants.dn_.jpg
smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/10/ 28 KB
28 KB 66ms
32ms Image
image/webp 34.149.157.221
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/10/ca.0402-dn-migrants.dn_.jpg?quality=90&strip=all&w=344&type=webp
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.157.221 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 221.157.149.34.bc.googleusercontent.com
Software: nginx/1.19.10 /
Resource Hash: 39874e19af66fa05a8e943e773c81187cb7437bb3cb0076df6defb9381d32911

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Mon, 21 Feb 2022 23:05:38 GMT
via: 1.1 google
server: nginx/1.19.10
cache-control: max-age=2592000,public
age: 9919
etag: "0f76a31c5e5eab3492b396502a69587e7ce4fc0b"
vary: Accept
content-type: image/webp
x-cache-hit: hit
x-pmd-smart-cdn-proxy: thumbor-proxy-64c799cd7-nc9ch
alt-svc: clear
content-length: 29074

GET
H2 200 wild-boars-e1637260632118.jpg
smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/11/ 16 KB
16 KB 40ms
31ms Image
image/webp 52.85.61.25
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/11/wild-boars-e1637260632118.jpg?quality=90&strip=all&w=344&type=webp
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.25 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-25.ewr53.r.cloudfront.net
Software: nginx/1.19.10 /
Resource Hash: c6d4675d324e5b40ed5fe0f15dfc55855a7d6389232ce7c981062d99b80d366c

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Mon, 21 Feb 2022 16:44:30 GMT
via: 1.1 2c7d387775f2e52dd268d2f49202b5d2.cloudfront.net (CloudFront)
server: nginx/1.19.10
age: 32787
etag: "7a09af2688eda187779b301412175145979f59a9"
vary: Accept
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=31536000,public
x-amz-cf-pop: EWR53-P1
x-pmd-smart-cdn-proxy: 7fd9ac2a82d8
content-length: 16430
x-amz-cf-id: l_tWbYdhAdsRS3jNfDtGHwehsNaBOqUGAdMSjb-hT6ww0Tfw2CQ5UA==
expires: Tue, 21 Feb 2023 16:44:30 GMT

GET
H2 200 John-Hambly-and-Senator-Robert-Black-e1638401412154.jpg
smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/12/ 23 KB
23 KB 41ms
33ms Image
image/webp 52.85.61.25
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/12/John-Hambly-and-Senator-Robert-Black-e1638401412154.jpg?quality=90&strip=all&w=344&type=webp
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.25 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-25.ewr53.r.cloudfront.net
Software: nginx/1.19.10 /
Resource Hash: 166b32472bd35ab18cf94e37efd5055f293406d30ffac183474318140b45ebf2

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Mon, 21 Feb 2022 16:44:30 GMT
via: 1.1 2c7d387775f2e52dd268d2f49202b5d2.cloudfront.net (CloudFront)
server: nginx/1.19.10
age: 32787
etag: "147c41b1ed8f81ee472e83e273ada9d134e9c4a1"
vary: Accept
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=31536000,public
x-amz-cf-pop: EWR53-P1
x-pmd-smart-cdn-proxy: f57c70a41ad7
content-length: 23408
x-amz-cf-id: Zhehy_g9Kqr9163OGdqUMzZFnAiZ242gb3AKwys2Vo75a7Mv6n-EMg==
expires: Tue, 21 Feb 2023 16:44:30 GMT

GET
H2 200 pg.1125-pg-shawn.jpg
smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/11/ 43 KB
43 KB 68ms
34ms Image
image/webp 34.149.157.221
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/11/pg.1125-pg-shawn.jpg?quality=90&strip=all&w=344&type=webp
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.157.221 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 221.157.149.34.bc.googleusercontent.com
Software: nginx/1.19.10 /
Resource Hash: c4cf4079ec71eea0051719d77dad827e876accf52dff47dbb7822f06d628fed4

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Mon, 21 Feb 2022 12:48:11 GMT
via: 1.1 google
server: nginx/1.19.10
cache-control: max-age=2592000,public
age: 46966
etag: "2ce9a641b071a9f7a6680503aeb6e5dac9bddd85"
vary: Accept
content-type: image/webp
x-cache-hit: hit
x-pmd-smart-cdn-proxy: thumbor-proxy-64c799cd7-wf6k7
alt-svc: clear
content-length: 43806

GET
H2 200 0525_na_farmers_1-scaled-e1605745495325.jpg
smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/04/ 17 KB
17 KB 60ms
27ms Image
image/webp 34.149.157.221
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/04/0525_na_farmers_1-scaled-e1605745495325.jpg?quality=90&strip=all&w=344&type=webp
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.157.221 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 221.157.149.34.bc.googleusercontent.com
Software: nginx/1.19.10 /
Resource Hash: 5702be858374d0c1b9cfa6164335204df766faceb85311b0311cc81b77041708

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Mon, 21 Feb 2022 23:05:44 GMT
via: 1.1 google
server: nginx/1.19.10
cache-control: max-age=2592000,public
age: 9913
etag: "7391dc2d7e0f6c688ac932b148865f9d0a7131bb"
vary: Accept
content-type: image/webp
x-cache-hit: hit
x-pmd-smart-cdn-proxy: thumbor-proxy-64c799cd7-nc9ch
alt-svc: clear
content-length: 17506

GET
H2 200 potato-wart.png
smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/11/ 15 KB
15 KB 72ms
39ms Image
image/webp 34.149.157.221
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/11/potato-wart.png?quality=90&strip=all&w=344&type=webp
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.157.221 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 221.157.149.34.bc.googleusercontent.com
Software: nginx/1.19.10 /
Resource Hash: 5e2aab555cbfbe4f398bc031f658fd37c078428446a48154a9e9301fe01b72d9

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Mon, 21 Feb 2022 23:05:39 GMT
via: 1.1 google
server: nginx/1.19.10
cache-control: max-age=2592000,public
age: 9918
etag: "3ed5c9b1efe187888cedb87f003fb971133fddab"
vary: Accept
content-type: image/webp
x-cache-hit: hit
x-pmd-smart-cdn-proxy: thumbor-proxy-64c799cd7-nc9ch
alt-svc: clear
content-length: 15746

GET
H2 200 same-three-crops-e1637087061815.jpg
smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/11/ 47 KB
48 KB 46ms
43ms Image
image/webp 52.85.61.25
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/11/same-three-crops-e1637087061815.jpg?quality=90&strip=all&w=344&type=webp
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.25 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-25.ewr53.r.cloudfront.net
Software: nginx/1.19.10 /
Resource Hash: 2987df61c80f5e13507666bcb5e2805b7c766a6e3e4f664d4bd557848839e60c

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Mon, 21 Feb 2022 16:44:30 GMT
via: 1.1 2c7d387775f2e52dd268d2f49202b5d2.cloudfront.net (CloudFront)
server: nginx/1.19.10
age: 32787
etag: "8e64c1dd4cdac9fa97cfc843c6037477648f4b10"
vary: Accept
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=31536000,public
x-amz-cf-pop: EWR53-P1
x-pmd-smart-cdn-proxy: d6f84ff61fdc
content-length: 48502
x-amz-cf-id: OvdWi2vysKv0ZoT0QWEcK94Nu_GCAJFNae_9hLPTqsz5BrJ2zWw4Dw==
expires: Tue, 21 Feb 2023 16:44:30 GMT

GET
H2 200 index.html Show response
cdn.districtm.io/ids/ Frame 13DF 116 B
303 B 62ms
50ms Document
text/html 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/index.html
Requested by: Host: hb.districtm.io
URL: https://hb.districtm.io/prod/100549/all.postmedia.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
content-type: text/html
cf-ray: 6e14910a08668cab-EWR
age: 8473
last-modified: Thu, 20 May 2021 02:18:27 GMT
via: 1.1 68d323cfd4a0f1ae252f92c083654190.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-amz-cf-id: JckNxXqiH0esjaHslc71XKIaU2ZZcsU43DBFmno8qjK3Lky51xK9sg==
x-amz-cf-pop: IAD89-P2
x-cache: Hit from cloudfront
vary: Accept-Encoding
server: cloudflare
content-encoding: br

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
38 B 82ms
71ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: hb.districtm.io
URL: https://hb.districtm.io/prod/100549/all.postmedia.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6e14910a08698cab-EWR
access-control-allow-headers: origin, content-type

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
232 B 73ms
63ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: hb.districtm.io
URL: https://hb.districtm.io/prod/100549/all.postmedia.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6e14910a086a8cab-EWR
access-control-allow-headers: origin, content-type

GET
H2 200 controltag.js.a1705c5ac5f06cf0c202ff70908fc042 Show response
cdn.krxd.net/ctjs/ 259 KB
83 KB 10ms
10ms Script
application/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/controltag/uthtxmddg.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 58d6350da5588a52d6baa4efc27a3362b4ee69dba3504fc762f934d7bb5d0bc4

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_Controltag_S3
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
age: 17587967
x-amz-server-side-encryption: AES256
x-cache: HIT
x-cache-hits: 2407057
content-length: 84509
x-served-by: cache-yul12825-YUL
last-modified: Mon, 02 Aug 2021 12:06:17 GMT
x-timer: S1645494658.597262,VS0,VE0
etag: "a1705c5ac5f06cf0c202ff70908fc042"
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=315360000
accept-ranges: bytes
expires: Thu, 31 Jul 2031 12:06:16 GMT

GET
H/1.1 200
OK xd.js Show response
pmd-dev-frontend-modules.s3.amazonaws.com/AA-606-0c8bf33/ Frame A3DE 37 KB
37 KB 34ms
34ms Script
application/javascript 52.95.146.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pmd-dev-frontend-modules.s3.amazonaws.com/AA-606-0c8bf33/xd.js
Requested by: Host: pmd-dev-frontend-modules.s3.amazonaws.com
URL: https://pmd-dev-frontend-modules.s3.amazonaws.com/AA-606-0c8bf33/xd.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.146.203 Montreal, Canada, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-w.ca-central-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 804e46afd5ad7b262335603b1fc216893c3d17fee2cf4346c6be71cdeb663020

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pmd-dev-frontend-modules.s3.amazonaws.com/AA-606-0c8bf33/xd.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Tue, 22 Feb 2022 01:50:58 GMT
Last-Modified: Fri, 18 Feb 2022 18:41:06 GMT
Server: AmazonS3
x-amz-request-id: 91RDQT94FHB9S37H
ETag: "e1a3c96a52aaa5551f578eb374e6065c"
Content-Type: application/javascript
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 37382
x-amz-id-2: 2m7MUbViqnGuhT6M9FOqpmzwCR4S4VFFcU7atfRLgGVZ+H9VJSKBKElE/0tk2amOZ2mW/YYlU9Y=

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 194 B
691 B 513ms
513ms XHR
text/javascript 52.85.63.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.amazon-adsystem.com/e/dtb/bid?src=3528&u=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&pid=OVGwSTuqbnRsS&cb=0&ws=1600x1200&v=7.73.0&t=2000&slots=%5B%7B%22sd%22%3A%22ad-1%22%2C%22s%22%3A%5B%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22ad-2%22%2C%22s%22%3A%5B%226x6%22%2C%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22ad-native-1%22%2C%22s%22%3A%5B%225x5%22%5D%7D%2C%7B%22sd%22%3A%22ad-3%22%2C%22s%22%3A%5B%227x7%22%2C%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22ad-native-2%22%2C%22s%22%3A%5B%225x5%22%5D%7D%2C%7B%22sd%22%3A%22ad-4%22%2C%22s%22%3A%5B%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22ad-native-3%22%2C%22s%22%3A%5B%225x5%22%5D%7D%2C%7B%22sd%22%3A%22ad-5%22%2C%22s%22%3A%5B%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22ad-native-4%22%2C%22s%22%3A%5B%225x5%22%5D%7D%2C%7B%22sd%22%3A%22ad-6%22%2C%22s%22%3A%5B%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22ad-native-5%22%2C%22s%22%3A%5B%225x5%22%5D%7D%2C%7B%22sd%22%3A%22ad-7%22%2C%22s%22%3A%5B%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22ad-native-6%22%2C%22s%22%3A%5B%225x5%22%5D%7D%2C%7B%22sd%22%3A%22ad-8%22%2C%22s%22%3A%5B%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22ad-native-7%22%2C%22s%22%3A%5B%225x5%22%5D%7D%2C%7B%22sd%22%3A%22ad-9%22%2C%22s%22%3A%5B%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22ad-native-8%22%2C%22s%22%3A%5B%225x5%22%5D%7D%2C%7B%22sd%22%3A%22ad-10%22%2C%22s%22%3A%5B%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%5D&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.63.179 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-63-179.ewr53.r.cloudfront.net

Software

Server /

Resource Hash

61a9435112cb68acc5f8da27798416ac4082a71a8ee5d392fb39c30185e4bc73

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
via: 1.1 35c803afef083002d824403342d4c62e.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: EWR53-P1
x-amz-rid: 7BDK0MHB1SH6XPK6R7SS
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
strict-transport-security: max-age=47474747; includeSubDomains; preload
timing-allow-origin: *
content-length: 194
x-amz-cf-id: tI6dh2P11XZDq-cQv8EN5R4B4WzVzpil2t-Kkn-IzOLW0ENr4Ck7oA==

GET
H2 200 proxy.3d2100fd7107262ecb55ce6847f01fa5.html Show response
cdn.krxd.net/partnerjs/xdi/ Frame 8EC4 805 B
826 B 10ms
10ms Document
text/html 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3bcfa04dbc2db44af54bd72a0f7b98912368f16f525729a1b9b673f62ca7e5c9

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Response headers

last-modified: Tue, 21 Feb 2017 17:50:54 GMT
etag: "3d2100fd7107262ecb55ce6847f01fa5"
cache-control: public, max-age=315360000
expires: Fri, 19 Feb 2027 17:50:50 GMT
content-type: text/html
x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_Partner_JS_S3
content-encoding: gzip
accept-ranges: bytes
date: Tue, 22 Feb 2022 01:50:57 GMT
via: 1.1 varnish
age: 22345177
x-served-by: cache-yul12825-YUL
x-cache: HIT
x-cache-hits: 822420
x-timer: S1645494658.782269,VS0,VE0
vary: Accept-Encoding
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
content-length: 525

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 39 KB
15 KB 95ms
46ms Script
text/javascript 142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKM4ZNQ&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

cae0ae2d67aac89367108586ebd25e00afc5d0f8110e6eb71b8d274037f7a5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14884
x-xss-protection: 0
server: cafe
etag: 16747055602125368176
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 22 Feb 2022 01:50:57 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 1006 B
792 B 91ms
20ms Script
application/x-javascript 2600:141b:13::17d7:82d2
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKM4ZNQ&l=dataLayer
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:13::17d7:82d2 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 0055b9d0429e9c194b4aa6b5f49cbc2ec31a7220ee7c8c186a9ee951feabd482

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Tue, 22 Feb 2022 01:50:57 GMT
Content-Encoding: gzip
Last-Modified: Thu, 17 Feb 2022 18:48:07 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=26565
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 479

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 99 KB
26 KB 57ms
19ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

27bcdc67e32fef9bdd86b785b1bafadd7f6915c49f6b49bed86bfbddf414b2f8

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 26236
x-xss-protection: 0
pragma: public
x-fb-debug: EIRw6uhnE27sG/oElUWoXr9Ql8t6sPbRq73//vcLsmBoi8CaubWffrvUJNqkG5+BbWBLO9Q1oHpAaTPc97xVUA==
x-fb-trip-id: 1512268381
x-frame-options: DENY
date: Tue, 22 Feb 2022 01:50:57 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 14 KB
6 KB 98ms
29ms Script
application/javascript 146.75.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.36.157 Reston, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
last-modified: Sat, 05 Feb 2022 00:34:56 GMT
etag: "8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache
x-cache: HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 5410
x-served-by: cache-iad-kcgs7200174-IAD

GET
H2

204

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=10276888&ns__t=1645494657803&ns_c=UTF-8&c8=Home%20%7C%20Ontario%20Farmer&c7=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&c9=
https://sb.scorecardresearch.com/b2?c1=2&c2=10276888&ns__t=1645494657803&ns_c=UTF-8&c8=Home%20%7C%20Ontario%20Farmer&c7=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&c9=

0
224 B

25ms
25ms

Image
text/plain

52.85.61.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=10276888&ns__t=1645494657803&ns_c=UTF-8&c8=Home%20%7C%20Ontario%20Farmer&c7=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&c9=
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 52.85.61.28 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-28.ewr53.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
via: 1.1 d7202b57803815a076179b3bb9bbd766.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-P1
etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
x-amz-cf-id: hSdcmQs0Ui9yMz4mzDOZvHAqRhfeEhUMaVM4pkcunRL-bYE3Oupdvg==
x-cache: Miss from cloudfront

Redirect headers

date: Tue, 22 Feb 2022 01:50:57 GMT
via: 1.1 d7202b57803815a076179b3bb9bbd766.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-P1
vary: Accept
x-cache: Miss from cloudfront
content-type: text/plain; charset=utf-8
location: https://sb.scorecardresearch.com/b2?c1=2&c2=10276888&ns__t=1645494657803&ns_c=UTF-8&c8=Home%20%7C%20Ontario%20Farmer&c7=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&c9=
content-length: 217
x-amz-cf-id: FnH4JNAIX0s30FQcJN3ZFvn_9yafyI9hW50X8N0wFLqjJG3-CyQbww==

GET
H2 200 idsync.d5cb6b96.js Show response
cdn.districtm.io/ids/ Frame 13DF 3 KB
2 KB 76ms
75ms Script
application/javascript 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Requested by: Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aebd50af0cd8da2f314a52e2088788775d1a441bd674ef9379578e7bc1b5ad50

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/ids/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
via: 1.1 fb134201578e9706e0dd8abdab0f2abf.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 66910
cf-polished: origSize=3302
x-cache: Miss from cloudfront
cf-bgj: minify
content-encoding: br
last-modified: Thu, 20 May 2021 02:18:27 GMT
server: cloudflare
etag: W/"74ede07ef946dc2316f86b2661cf2dd3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=172800
x-amz-cf-pop: JFK51-C1
cf-ray: 6e14910b7b528cab-EWR
x-amz-cf-id: eAFQyvDpP0PzfMELvLEVR-hml06ux82vdQ9KWW3mKynTylzMM2bdbw==
expires: Thu, 24 Feb 2022 01:50:57 GMT

OPTIONS
H2 204 identify
identity.mparticle.com/v1/ Frame 0
0 52ms
14ms Preflight 2a04:4e42:200::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://identity.mparticle.com/v1/identify

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=900

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,x-mp-key
Origin: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

server: Kestrel
access-control-allow-headers: content-type,x-mp-key
access-control-allow-methods: POST
access-control-allow-origin: *
x-origin-name: 4PrgpUXX9K0sNAH1JImfyI--F_us1_origin
accept-ranges: bytes
date: Tue, 22 Feb 2022 01:50:57 GMT
via: 1.1 varnish
age: 1725
x-served-by: cache-yul12826-YUL
x-cache: HIT
x-cache-hits: 1398
x-timer: S1645494658.878380,VS0,VE0
strict-transport-security: max-age=900

POST
H2 200 identify Show response
identity.mparticle.com/v1/ 175 B
276 B 48ms
47ms XHR
application/json 2a04:4e42:200::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://identity.mparticle.com/v1/identify

Requested by

Host: jssdkcdns.mparticle.com
URL: https://jssdkcdns.mparticle.com/js/v2/us1-a9588c0ddc27594cabd152e47ffe27ee/mparticle.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Kestrel /

Resource Hash

eab06b3b242b9a3bd1506c6e82dc5ef17fe38ce8ba301985cc7c7a8a266f71b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=900

Request headers

x-mp-key: us1-a9588c0ddc27594cabd152e47ffe27ee
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
server: Kestrel
x-timer: S1645494658.890567,VS0,VE37
x-origin-name: 4PrgpUXX9K0sNAH1JImfyI--F_us1_origin
x-served-by: cache-yul12826-YUL
vary: Accept-Encoding
x-cache: MISS
content-type: application/json; charset=utf-8
access-control-allow-origin: *
strict-transport-security: max-age=900
accept-ranges: bytes
via: 1.1 varnish
x-cache-hits: 0

GET
H2 200 / Show response
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/api-root/weather/current_conditions/ON/London/ 697 B
584 B 1098ms
1097ms Fetch
text/html 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/api-root/weather/current_conditions/ON/London/?format=html

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/websites/js/f3500b3ce093146933ed28.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

db15dd210c5e6315ca7c68ea0caff33cd1a4c5cd0ee006574562b0e65189cd28

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
content-encoding: gzip
vary: Accept-Encoding, Accept, Cookie, Origin
x-frame-options: SAMEORIGIN
x-pmd-backend: cheetah-nginx
allow: GET
content-type: text/html; charset=utf-8
cache-control: max-age=60
strict-transport-security: max-age=15724800; includeSubDomains
expires: Tue, 22 Feb 2022 01:51:58 GMT

GET
H2 200 42fb57ac-2013-45a6-8dad-332d53e17c1b Show response
consumer.krxd.net/consent/get/ 239 B
432 B 60ms
30ms Script
text/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://consumer.krxd.net/consent/get/42fb57ac-2013-45a6-8dad-332d53e17c1b?idt=device&dt=kxcookie&callback=Krux.ns.postmedia.kxjsonp_consent_get_0
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8ddf9e8fa96d1bbbeaf292ca94fc082dde61e4a6be90c87f8b2609fd88edbd4d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
via: 1.1 varnish
age: 0
x-served-by: consumer-a015-ash-prod.krxd.net, cache-yul12833-YUL
vary: Accept-Encoding
x-cache: MISS, MISS
content-type: text/javascript; charset=UTF-8
content-encoding: gzip
cache-control: max-age=1800
x-age: 0
accept-ranges: bytes
x-timer: S1645494658.891315,VS0,VE15
content-length: 193
x-cache-hits: 0, 0

GET
H2 200 simple Show response
api.sail-personalize.com/v1/personalize/ 256 B
474 B 39ms
29ms Fetch
application/json 99.83.154.140
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.sail-personalize.com/v1/personalize/simple?pageviews=1&isMobile=0
Requested by: Host: ak.sail-horizon.com
URL: https://ak.sail-horizon.com/spm/spm.v1.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.154.140 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: aa7557bb34ea5624b.awsglobalaccelerator.com
Software: /
Resource Hash: ebf5baf9b0e82eb5b98a1e248d8a3040295ac04eb6b7d926ecca617d8d269a63

Request headers

x-lib-version: v1.0.1
Accept-Language: en-CA,en;q=0.9
authorization: Bearer b9d3df2fccd108b5eff3c44f573b2cd6
content-type: application/json
accept: application/json
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
x-referring-url: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
content-encoding: gzip
allowedorigins: *
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: no-store
access-control-allow-credentials: true
allowedheaders: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin
content-length: 173
allowedmethods: GET,OPTIONS
expires: -1

OPTIONS
H2 200 simple
api.sail-personalize.com/v1/personalize/ Frame 0
0 92ms
30ms Preflight
text/plain 99.83.154.140
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.sail-personalize.com/v1/personalize/simple?pageviews=1&isMobile=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.154.140 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: aa7557bb34ea5624b.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization,content-type,x-lib-version,x-referring-url
Origin: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
content-type: text/plain
content-length: 18
access-control-allow-origin: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
access-control-allow-credentials: true
access-control-max-age: 1800
access-control-allow-methods: OPTIONS,GET,POST,PUT,DELETE
access-control-allow-headers: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Lib-Version,X-Referring-URL
allow: HEAD,GET,OPTIONS

GET
H2 200 buyers Show response
dmx.districtm.io/s/v1/ Frame 13DF 445 B
716 B 63ms
63ms XHR
application/json 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/buyers

Requested by

Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe074cf2c852c9e4fab263d4a98a39c0cc4e91c0bc6f168304470214602b6d01

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: DELETE, GET, OPTIONS, POST
content-type: application/json
access-control-allow-origin: https://cdn.districtm.io
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6e14910c1cb68cab-EWR
access-control-allow-headers: Origin, Content-Type

GET
H2 200 uthtxmddg.js Show response
cdn.krxd.net/controltag/ Frame 8EC4 29 KB
7 KB 11ms
11ms Script
text/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/controltag/uthtxmddg.js
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 76a237b880fbfc8ac655e91dcf5c9af3b44ccc506c69328409b4047d72519eea

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_config_service_ash_prod
date: Tue, 22 Feb 2022 01:50:57 GMT
via: 1.1 varnish, 1.1 varnish
age: 985
x-cache: MISS, HIT, HIT
x-app-cache: HIT
x-age: 0
content-encoding: gzip
content-length: 6471
x-served-by: config-service-a003-ash-prod.krxd.net, cache-iad-kiad7000123-IAD, cache-yul12825-YUL
x-response-time: 1
x-do-esi: esi
x-timer: S1645494658.935689,VS0,VE0
etag: "8d8408c6b02eb41f93710c678ece74490c4f6485"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=1200
accept-ranges: bytes
x-cache-hits: 0, 1, 31

GET
H3 200 1685973801652415 Show response
connect.facebook.net/signals/config/ 310 KB
88 KB 41ms
20ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1685973801652415?v=2.9.52&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1a1cb145978036238fc717a47ecca7efce5f18634a29ee41c0d57ce7f24eaf83

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 90182
x-xss-protection: 0
pragma: public
x-fb-debug: CBU/9b3MjMv1apQqWmsenOB5WmCx4xeFeN5GcWxpE5l+2HdybI41ngchcpk3fHlzREnoekwJcty6kTWHGYYmXw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 22 Feb 2022 01:50:57 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK insight.old.min.js Show response
snap.licdn.com/li.lms-analytics/ 5 KB
2 KB 20ms
20ms Script
application/x-javascript 2600:141b:13::17d7:82d2
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:13::17d7:82d2 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Tue, 22 Feb 2022 01:50:57 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Feb 2022 23:50:54 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=36067
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2036

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/990309138/ 2 KB
2 KB 101ms
35ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/990309138/?random=1645494657957&cv=9&fst=1645494657957&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg2g0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&tiba=Home%20%7C%20Ontario%20Farmer&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4c407841613a18a1c6545d1a57accb4951998944eef506ee803e20bf1531beb7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1038
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/580448699/ 2 KB
1 KB 78ms
42ms Script
text/javascript 142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/580448699/?random=1645494657960&cv=9&fst=1645494657960&num=1&value=0&label=FmJTCMOu_N8BELvj45QC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg2g0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&tiba=Home%20%7C%20Ontario%20Farmer&auid=1585089914.1645494658&hn=www.googleadservices.com&bttype=purchase&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

fe305c77b83686cd1170b06db8bdbc6f6fb35a13d3d5fcc33284024667c3fc54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1238
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
458 B 218ms
54ms Script
application/javascript 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o01de&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=d2eb1a82-8efb-44a8-96f6-efcb2cd8dac5&tw_document_href=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&tpx_cb=twttr.conversion.loadPixels

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-response-time: 8
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
server: tsa_b
strict-transport-security: max-age=631138519
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 55237d3992434607119a95cf1a76cbaa95af342949af1ea0b0a12e1c3424a1ef
content-type: application/javascript;charset=utf-8
content-length: 57

GET
H2 200 adsct
t.co/i/ 43 B
336 B 154ms
54ms Image
image/gif 104.244.42.69
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o01de&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=d2eb1a82-8efb-44a8-96f6-efcb2cd8dac5&tw_document_href=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.69 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-response-time: 6
date: Tue, 22 Feb 2022 01:50:57 GMT
server: tsa_b
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 120f5856baca10679ec3279f94626d46970fa370d2203e4300852c2cf678c2a9
content-length: 43

OPTIONS
H2 204 identify
identity.mparticle.com/v1/ Frame 0
0 11ms
10ms Preflight 2a04:4e42:200::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://identity.mparticle.com/v1/identify

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=900

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,x-mp-key
Origin: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

server: Kestrel
access-control-allow-headers: content-type,x-mp-key
access-control-allow-methods: POST
access-control-allow-origin: *
x-origin-name: 4PrgpUXX9K0sNAH1JImfyI--F_us1_origin
accept-ranges: bytes
date: Tue, 22 Feb 2022 01:50:57 GMT
via: 1.1 varnish
age: 1725
x-served-by: cache-yul12826-YUL
x-cache: HIT
x-cache-hits: 1399
x-timer: S1645494658.978783,VS0,VE0
strict-transport-security: max-age=900

POST
H2 200 identify Show response
identity.mparticle.com/v1/ 175 B
251 B 50ms
49ms XHR
application/json 2a04:4e42:200::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://identity.mparticle.com/v1/identify

Requested by

Host: jssdkcdns.mparticle.com
URL: https://jssdkcdns.mparticle.com/js/v2/us1-a9588c0ddc27594cabd152e47ffe27ee/mparticle.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Kestrel /

Resource Hash

3b45e4bab0a5e13bb27fbf55a76dc68dda7889946f8e293815456ce1cc99359a

Security Headers

Name	Value
Strict-Transport-Security	max-age=900

Request headers

x-mp-key: us1-a9588c0ddc27594cabd152e47ffe27ee
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
content-encoding: gzip
server: Kestrel
x-timer: S1645494658.991172,VS0,VE39
x-origin-name: 4PrgpUXX9K0sNAH1JImfyI--F_us1_origin
x-served-by: cache-yul12826-YUL
vary: Accept-Encoding
x-cache: MISS
content-type: application/json; charset=utf-8
access-control-allow-origin: *
strict-transport-security: max-age=900
accept-ranges: bytes
via: 1.1 varnish
x-cache-hits: 0

GET
H2 200 controltag.js.a1705c5ac5f06cf0c202ff70908fc042 Show response
cdn.krxd.net/ctjs/ Frame 8EC4 259 KB
83 KB 12ms
11ms Script
application/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/controltag/uthtxmddg.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 58d6350da5588a52d6baa4efc27a3362b4ee69dba3504fc762f934d7bb5d0bc4

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_Controltag_S3
date: Tue, 22 Feb 2022 01:50:57 GMT
content-encoding: gzip
age: 17587968
x-amz-server-side-encryption: AES256
x-cache: HIT
x-cache-hits: 2407059
content-length: 84509
x-served-by: cache-yul12825-YUL
last-modified: Mon, 02 Aug 2021 12:06:17 GMT
x-timer: S1645494658.983583,VS0,VE0
etag: "a1705c5ac5f06cf0c202ff70908fc042"
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=315360000
accept-ranges: bytes
expires: Thu, 31 Jul 2031 12:06:16 GMT

GET
H2

200

/
p.adsymptotic.com/d/px/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1747836&time=1645494657978&url=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1747836&time=1645494657978&url=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1747836%26time%3D1645494657978%26url%3Dhttps%253A%252F%252Frevert-cheet-3898-onta...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1747836&time=1645494657978&url=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&cookiesTest=true&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1747836&time=1645494657978&url=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&cookiesTest=true&liSync=true&e_ipv6=AQLHo3...
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=0a1a0b4c-4091-4d5c-8c01-2a6297267836
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=0a1a0b4c-4091-4d5c-8c01-2a6297267836&_expected_cookie=4f38d581827d609c7356f94b...

43 B
142 B

53ms
50ms

Image
image/gif

104.18.101.194
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=0a1a0b4c-4091-4d5c-8c01-2a6297267836&_expected_cookie=4f38d581827d609c7356f94be1ac2da5
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 104.18.101.194 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6e1491105fec54d9-YYZ
p3p: CP='NON DSP COR CONi OUR BUS CNT'
content-type: image/gif
content-length: 43

Redirect headers

location: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=0a1a0b4c-4091-4d5c-8c01-2a6297267836&_expected_cookie=4f38d581827d609c7356f94be1ac2da5
date: Tue, 22 Feb 2022 01:50:58 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 6e14910fef3454d9-YYZ
content-length: 0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"

GET
H2

200

968062827794341354 Show response
dmx.districtm.io/s/10056/ Frame 13DF
Redirect Chain

https://p.rfihub.com/cm?pub=36496&in=1
https://dmx.districtm.io/s/10056/968062827794341354

74 B
187 B

57ms
55ms

Script
application/javascript

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10056/968062827794341354

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e58d11729ac1aaea5798582f74341fd5a827fa916c2afa0f1eb48de68e8ed6f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Tue, 22 Feb 2022 01:50:58 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6e14910d3f218cab-EWR

Redirect headers

Location: https://dmx.districtm.io/s/10056/968062827794341354
Date: Tue, 22 Feb 2022 01:50:58 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

37f25f47-fcb4-47fc-96ef-7ef38cff4262 Show response
dmx.districtm.io/s/10059/ Frame 13DF
Redirect Chain

https://match.sharethrough.com/1PQ8qgv7/v1/
https://dmx.districtm.io/s/10059/37f25f47-fcb4-47fc-96ef-7ef38cff4262

92 B
141 B

68ms
67ms

Script
application/javascript

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10059/37f25f47-fcb4-47fc-96ef-7ef38cff4262

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6c350596209bb92fbfe46287eaf6392f6d4e557ac7ca38cfad1c781798a474d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Tue, 22 Feb 2022 01:50:58 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6e14910d3f408cab-EWR

Redirect headers

location: https://dmx.districtm.io/s/10059/37f25f47-fcb4-47fc-96ef-7ef38cff4262
date: Tue, 22 Feb 2022 01:50:58 GMT
content-length: 0

GET
H2

200

YhRBggAH9Y6JOwAy&_test=YhRBggAH9Y6JOwAy Show response
dmx.us-east-33.districtm.io/s/10016/ Frame 13DF
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/1477?redir=https%3A//dmx.us-east-33.districtm.io/s/10016/$%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/1477?redir=https%3A//dmx.us-east-33.districtm.io/s/10016/$%7BTM_USER_ID%7D&_test=YhRBggAH9Y6JOwAy
https://dmx.us-east-33.districtm.io/s/10016/YhRBggAH9Y6JOwAy&_test=YhRBggAH9Y6JOwAy

95 B
232 B

127ms
35ms

Script
application/javascript

35.231.227.177
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.us-east-33.districtm.io/s/10016/YhRBggAH9Y6JOwAy&_test=YhRBggAH9Y6JOwAy

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Server

35.231.227.177 North Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

177.227.231.35.bc.googleusercontent.com

Software

Resource Hash

33e685d2f9d40201bf2068e31a29d44460a4a7d6e8b96d01e80906fb8967c064

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
content-length: 95
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1645494658.107738,VS0,VE0
x-served-by: cache-yul12828-YUL
x-cache: HIT
location: https://dmx.us-east-33.districtm.io/s/10016/YhRBggAH9Y6JOwAy&_test=YhRBggAH9Y6JOwAy
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

jz3vfA4wQhJ2neqoOdQylpU4mbc Show response
dmx.districtm.io/s/10026/ Frame 13DF
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=132
https://dmx.districtm.io/s/10026/jz3vfA4wQhJ2neqoOdQylpU4mbc

83 B
138 B

62ms
61ms

Script
application/javascript

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10026/jz3vfA4wQhJ2neqoOdQylpU4mbc

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

75a77e830f86d137e25f975b17be19598bfb447a90609f627d8058aaa98e988d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Tue, 22 Feb 2022 01:50:58 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6e14910d5f7c8cab-EWR

Redirect headers

Location: https://dmx.districtm.io/s/10026/jz3vfA4wQhJ2neqoOdQylpU4mbc
Date: Tue, 22 Feb 2022 01:50:58 GMT
Connection: keep-alive
Content-Length: 83
Content-Type: text/html; charset=utf-8

GET
H2

200

5BNFHJJ9IAgWdjiYNVgr Show response
dmx.districtm.io/s/10027/ Frame 13DF
Redirect Chain

https://us.creativecdn.com/cm-notify?pi=districtm
https://us.creativecdn.com/cm-notify?pi=districtm&tc=1
https://dmx.districtm.io/s/10027/5BNFHJJ9IAgWdjiYNVgr?pi=districtm&tc=1

76 B
134 B

56ms
55ms

Script
application/javascript

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10027/5BNFHJJ9IAgWdjiYNVgr?pi=districtm&tc=1

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5158dae06a46081e23403635bc98fdc0194e932daba1752475cf2934e917d6d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Tue, 22 Feb 2022 01:50:58 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6e14910d6f988cab-EWR

Redirect headers

location: https://dmx.districtm.io/s/10027/5BNFHJJ9IAgWdjiYNVgr?pi=districtm&tc=1
pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT, Tue, 22 Feb 2022 01:50:58 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 42fb57ac-2013-45a6-8dad-332d53e17c1b Show response
consumer.krxd.net/consent/get/ Frame 8EC4 224 B
309 B 32ms
32ms Script
text/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://consumer.krxd.net/consent/get/42fb57ac-2013-45a6-8dad-332d53e17c1b?idt=device&dt=kxcookie&callback=Krux.ns.postmedia.kxjsonp_consent_get_0
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: a0f35d5c804fc84da1c86a0cd213a3f094722a7a4f7ba5e404e6805c5ae18bd8

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
via: 1.1 varnish
age: 0
x-served-by: consumer-a007-ash-prod.krxd.net, cache-yul12833-YUL
vary: Accept-Encoding
x-cache: MISS, MISS
content-type: text/javascript; charset=UTF-8
content-encoding: gzip
cache-control: max-age=1800
x-age: 0
accept-ranges: bytes
x-timer: S1645494658.053428,VS0,VE19
content-length: 186
x-cache-hits: 0, 0

GET
H2 200 /
www.facebook.com/tr/ 44 B
406 B 66ms
18ms Image
image/gif 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1685973801652415&ev=PageView&dl=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&rl=&if=false&ts=1645494658088&sw=1600&sh=1200&v=2.9.52&r=stable&ec=0&o=30&par[0]=%7B%22extractorID%22%3A%22514537319740368%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%22priceCurrency%22%3A%22CAD%22%7D%7D%7D&par[1]=%7B%22extractorID%22%3A%22503487844400487%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%22priceCurrency%22%3A%22CAD%22%7D%7D%7D&par[2]=%7B%22extractorID%22%3A%221042784969583558%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%22priceCurrency%22%3A%22CAD%22%7D%7D%7D&par[3]=%7B%22extractorID%22%3A%22858678751523779%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%7D%7D%7D&par[4]=%7B%22extractorID%22%3A%221127243281129742%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%7D%7D%7D&par[5]=%7B%22extractorID%22%3A%22497819211464386%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%7D%7D%7D&fbp=fb.1.1645494658086.921559624&it=1645494657937&coo=false&exp=p0&rqm=GET

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Tue, 22 Feb 2022 01:50:58 GMT

GET
H3

200

/
www.google.ca/pagead/1p-conversion/580448699/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/580448699/?random=1263551499&cv=9&fst=1645494657960&num=1&value=0&label=FmJTCMOu_N8BELvj45QC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO...
https://www.google.com/pagead/1p-conversion/580448699/?random=1263551499&cv=9&fst=1645494657960&num=1&value=0&label=FmJTCMOu_N8BELvj45QC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_...
https://www.google.ca/pagead/1p-conversion/580448699/?random=1263551499&cv=9&fst=1645494657960&num=1&value=0&label=FmJTCMOu_N8BELvj45QC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_a...

42 B
64 B

72ms
45ms

Image
image/gif

2607:f8b0:4006:823::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-conversion/580448699/?random=1263551499&cv=9&fst=1645494657960&num=1&value=0&label=FmJTCMOu_N8BELvj45QC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg2g0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&tiba=Home%20%7C%20Ontario%20Farmer&auid=1585089914.1645494658&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=gkEUYpegAeOMoPMPu52EyAw&cid=CAQSKQCNIrLMHjpdPQOX6a3AtcZq54zuNvQhZXjP8VK64UJl2Al7pLb9X-3y&eitems=ChEIgI3NkAYQvqPU5vTIysiHARIdAKnWO2vmmI3bpkkWSOPyHbyf6gcVCt3DMRUcfm0&random=1525386978&resp=GooglemKTybQhCsO&ipr=y&prhg=0

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Server

2607:f8b0:4006:823::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.ca/pagead/1p-conversion/580448699/?random=1263551499&cv=9&fst=1645494657960&num=1&value=0&label=FmJTCMOu_N8BELvj45QC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg2g0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&tiba=Home%20%7C%20Ontario%20Farmer&auid=1585089914.1645494658&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=gkEUYpegAeOMoPMPu52EyAw&cid=CAQSKQCNIrLMHjpdPQOX6a3AtcZq54zuNvQhZXjP8VK64UJl2Al7pLb9X-3y&eitems=ChEIgI3NkAYQvqPU5vTIysiHARIdAKnWO2vmmI3bpkkWSOPyHbyf6gcVCt3DMRUcfm0&random=1525386978&resp=GooglemKTybQhCsO&ipr=y&prhg=0
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/990309138/ 42 B
548 B 93ms
41ms Image
image/gif 2607:f8b0:4006:822::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/990309138/?random=1645494657957&cv=9&fst=1645491600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg2g0&sendb=1&frm=0&url=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&tiba=Home%20%7C%20Ontario%20Farmer&async=1&fmt=3&is_vtc=1&random=388462823&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2004 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.ca/pagead/1p-user-list/990309138/ 42 B
548 B 102ms
39ms Image
image/gif 2607:f8b0:4006:823::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/990309138/?random=1645494657957&cv=9&fst=1645491600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg2g0&sendb=1&frm=0&url=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&tiba=Home%20%7C%20Ontario%20Farmer&async=1&fmt=3&is_vtc=1&random=388462823&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame 8EC4
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=google
https://cm.g.doubleclick.net/pixel?google_cm&google_nid=krux_digital&google_hm=T3JVWC1zeTI
https://beacon.krxd.net/usermatch.gif?google_gid=CAESEEJvJLDAW88FhJfRcHwQVpU&google_cver=1

0
337 B

25ms
24ms

Image
text/plain

107.22.254.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?google_gid=CAESEEJvJLDAW88FhJfRcHwQVpU&google_cver=1
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 107.22.254.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-22-254-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
cache-control: private, no-cache, no-store
x-request-time: D=81 t=1645494658
x-served-by: beacon-n033-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://beacon.krxd.net/usermatch.gif?google_gid=CAESEEJvJLDAW88FhJfRcHwQVpU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 291
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame 8EC4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=krux_digital&google_cm&google_hm=T3JVWC1zeTI
https://beacon.krxd.net/usermatch.gif?google_gid=CAESEEJvJLDAW88FhJfRcHwQVpU&google_cver=1

0
337 B

28ms
28ms

Image
text/plain

107.22.254.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?google_gid=CAESEEJvJLDAW88FhJfRcHwQVpU&google_cver=1
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 107.22.254.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-22-254-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
cache-control: private, no-cache, no-store
x-request-time: D=30 t=1645494658
x-served-by: beacon-n027-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://beacon.krxd.net/usermatch.gif?google_gid=CAESEEJvJLDAW88FhJfRcHwQVpU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 291
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 379708.gif
idsync.rlcdn.com/ Frame 8EC4 42 B
450 B 69ms
42ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/379708.gif?partner_uid=OrUX-sy2
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 22 Feb 2022 01:50:58 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame 8EC4
Redirect Chain

https://stags.bluekai.com/site/26357?id=OrUX-sy2&redir=https://beacon.krxd.net/usermatch.gif?_kuid%3DOrUX-sy2%26partner%3Dbluekai%26bk_uuid%3D%24_BK_UUID
https://beacon.krxd.net/usermatch.gif?_kuid=OrUX-sy2&partner=bluekai&bk_uuid=$_BK_UUID

0
337 B

34ms
21ms

Image
text/plain

107.22.254.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?_kuid=OrUX-sy2&partner=bluekai&bk_uuid=$_BK_UUID
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 107.22.254.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-22-254-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
cache-control: private, no-cache, no-store
x-request-time: D=30 t=1645494658
x-served-by: beacon-n019-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location: https://beacon.krxd.net/usermatch.gif?_kuid=OrUX-sy2&partner=bluekai&bk_uuid=$_BK_UUID
Date: Tue, 22 Feb 2022 01:50:58 GMT
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET
H2 200 p
sb.scorecardresearch.com/ Frame 8EC4 64 B
440 B 32ms
30ms Image
image/gif 52.85.61.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=9&c2=8188709&cs_xi=OrUX-sy2&rn=1645494658
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.61.28 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-28.ewr53.r.cloudfront.net
Software: /
Resource Hash: 831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
via: 1.1 d7202b57803815a076179b3bb9bbd766.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-P1
etag: W/"40-jHLN3x5dWpBzaQm4lkBmDWvrjrg"
x-cache: Miss from cloudfront
content-type: image/gif; charset=utf-8
content-length: 64
x-amz-cf-id: MKZgDF5cqEVfoGmhPsR9gWBz5UVjGu4whzS-d0hmWUUs2EeVcYL6rQ==

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame 8EC4
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/NC4WTmcy?redir=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner_id%3Dcb276571-e0d9-4438-9fd4-80a1ff034b01%26puid%3D%24%7BTM_USER_ID%7D
https://beacon.krxd.net/usermatch.gif?partner_id=cb276571-e0d9-4438-9fd4-80a1ff034b01&puid=YhRBggAH9Y6JOwAy

0
338 B

87ms
24ms

Image
text/plain

107.22.254.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner_id=cb276571-e0d9-4438-9fd4-80a1ff034b01&puid=YhRBggAH9Y6JOwAy
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 107.22.254.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-22-254-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
cache-control: private, no-cache, no-store
x-request-time: D=63 t=1645494657
x-served-by: beacon-n038-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1645494658.137215,VS0,VE0
x-served-by: cache-yul12828-YUL
x-cache: HIT
location: https://beacon.krxd.net/usermatch.gif?partner_id=cb276571-e0d9-4438-9fd4-80a1ff034b01&puid=YhRBggAH9Y6JOwAy
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame 8EC4
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=beeswax
https://match.prod.bidr.io/cookie-sync/krux?partner_user_id=OrUX-sy2
https://match.prod.bidr.io/cookie-sync/krux?partner_user_id=OrUX-sy2&_bee_ppp=1
https://beacon.krxd.net/usermatch.gif?partner=beeswax&partner_uid=AADHsE7EKIMAAH5eVhizbg

0
337 B

24ms
24ms

Image
text/plain

107.22.254.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=beeswax&partner_uid=AADHsE7EKIMAAH5eVhizbg
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 107.22.254.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-22-254-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
cache-control: private, no-cache, no-store
x-request-time: D=31 t=1645494658
x-served-by: beacon-n012-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: https://beacon.krxd.net/usermatch.gif?partner=beeswax&partner_uid=AADHsE7EKIMAAH5eVhizbg
Date: Tue, 22 Feb 2022 01:50:58 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame 8EC4
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=mediamath
https://sync.mathtag.com/sync/img?mt_exid=10031&mt_exuid=OrUX-sy2&redirect=https://beacon.krxd.net/usermatch.gif?partner%3Dmediamath%26partner_id%3D%5BMM_UUID%5D
https://beacon.krxd.net/usermatch.gif?partner=mediamath&partner_id=2d386214-4182-4d00-a150-6a33a1aba1d8

0
337 B

24ms
24ms

Image
text/plain

107.22.254.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=mediamath&partner_id=2d386214-4182-4d00-a150-6a33a1aba1d8
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 107.22.254.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-22-254-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
cache-control: private, no-cache, no-store
x-request-time: D=38 t=1645494658
x-served-by: beacon-n002-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Date: Tue, 22 Feb 2022 01:50:58 GMT
Server: MT3 4133 baa842e master iad-pixel-x16 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://beacon.krxd.net/usermatch.gif?partner=mediamath&partner_id=2d386214-4182-4d00-a150-6a33a1aba1d8
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 22 Feb 2022 01:50:57 GMT

GET
H/1.1 200
OK tag.aspx Show response
ml314.com/ Frame 8EC4 27 KB
12 KB 142ms
47ms Script
application/javascript 34.235.23.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?2212022
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.235.23.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-235-23-231.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 300b9ba11e041384aafe746b81adbac891f04890e6d71728d572df9073610076

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Tue, 22 Feb 2022 01:50:57 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=86400
Connection: keep-alive
Content-Length: 11606

GET
H/1.1

200
OK

g.js
aa.agkn.com/adscores/ Frame 8EC4
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=neustar
https://aa.agkn.com/adscores/g.js?sid=9212244187&_kdpid=OrUX-sy2

43 B
680 B

266ms
51ms

Image
image/gif

156.154.202.36
NEUSTAR-AS6

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.js?sid=9212244187&_kdpid=OrUX-sy2
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: HTTP/1.1
Server: 156.154.202.36 , United States, ASN19907 (NEUSTAR-AS6, US),
Reverse DNS
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Feb 2022 01:50:58 GMT
Server: AAWebServer
Access-Control-Allow-Methods: GET, POST, OPTIONS
P3P: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Type: image/gif
Access-Control-Allow-Headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
Content-Length: 43
Expires: 0

Redirect headers

location: https://aa.agkn.com/adscores/g.js?sid=9212244187&_kdpid=OrUX-sy2
date: Tue, 22 Feb 2022 01:50:58 GMT
x-cache-hits: 0
x-age: 0
content-length: 0
x-cache: MISS
x-served-by: usermatch-a001-ash-prod.krxd.net

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame 8EC4
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=183716&cb=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dcasale%26partner_uid%3D__UID__
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dcasale%26partner_uid%3D__UID__&s=183716&C=1
https://beacon.krxd.net/usermatch.gif?partner=casale&partner_uid=YhRBgtM0cBpKPoSUl4Qz5QAA%26042

0
337 B

24ms
24ms

Image
text/plain

107.22.254.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=casale&partner_uid=YhRBgtM0cBpKPoSUl4Qz5QAA%26042
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 107.22.254.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-22-254-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
cache-control: private, no-cache, no-store
x-request-time: D=33 t=1645494658
x-served-by: beacon-n017-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma: no-cache
Date: Tue, 22 Feb 2022 01:50:58 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://beacon.krxd.net/usermatch.gif?partner=casale&partner_uid=YhRBgtM0cBpKPoSUl4Qz5QAA%26042
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 283
Expires: Tue, 22 Feb 2022 01:50:58 GMT

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame 8EC4
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=salesforce
https://beacon.krxd.net/usermatch.gif?partner=stackadapt&partner_uid=jz3vfA4wQhJ2neqoOdQylpU4mbc

0
337 B

71ms
28ms

Image
text/plain

107.22.254.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=stackadapt&partner_uid=jz3vfA4wQhJ2neqoOdQylpU4mbc
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 107.22.254.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-22-254-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
cache-control: private, no-cache, no-store
x-request-time: D=28 t=1645494658
x-served-by: beacon-n036-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location: https://beacon.krxd.net/usermatch.gif?partner=stackadapt&partner_uid=jz3vfA4wQhJ2neqoOdQylpU4mbc
Date: Tue, 22 Feb 2022 01:50:58 GMT
Connection: keep-alive
Content-Length: 123
Content-Type: text/html; charset=utf-8

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame 8EC4
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=triplelift&gdpr=0&cmp_cs=&us_privacy=undefined
https://eb2.3lift.com/xuid?mid=3587&xuid=OrUX-sy2&dongle=13b2&rdir=https://beacon.krxd.net/usermatch.gif?partner%3Dtriplelift%26partner_uid%3D$UID&gdpr=0&cmp_cs=&us_privacy=undefined
https://eb2.3lift.com/xuid?ld=1&mid=3587&xuid=OrUX-sy2&dongle=13b2&gdpr=0&cmp_cs=&us_privacy=undefined&rdir=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dtriplelift%26partner_uid%3D%24UID
https://beacon.krxd.net/usermatch.gif?partner=triplelift&partner_uid=1084003074738852891507

0
337 B

24ms
24ms

Image
text/plain

107.22.254.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=triplelift&partner_uid=1084003074738852891507
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 107.22.254.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-22-254-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
cache-control: private, no-cache, no-store
x-request-time: D=29 t=1645494658
x-served-by: beacon-n021-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: https://beacon.krxd.net/usermatch.gif?partner=triplelift&partner_uid=1084003074738852891507
date: Tue, 22 Feb 2022 01:50:58 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1

200
OK

iu3 Show response
s.amazon-adsystem.com/ Frame EBD0
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&dcc=t

275 B
1 KB

46ms
45ms

Document
text/html

209.54.177.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&dcc=t

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.177.54 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

5bfee1a430ede5828fcb00547e58f4121e6758b35517b4ee1b5387067a2e65e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Response headers

Server: Server
Date: Tue, 22 Feb 2022 01:50:58 GMT
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 275
Connection: keep-alive
x-amz-rid: W9RHZNRB9HGFDS9TPMF8
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

Redirect headers

Server: Server
Date: Tue, 22 Feb 2022 01:50:58 GMT
Content-Length: 0
Connection: keep-alive
x-amz-rid: 3E36XYH9AMSXSAGW06C5
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&dcc=t
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

GET
H2 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
792 B 114ms
39ms Script
application/javascript 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=revert-cheet-3898-ontariofarmer.gdev.postmedia.digital

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022021401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 22 Feb 2022 01:50:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 88ms
39ms Script
application/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=revert-cheet-3898-ontariofarmer.gdev.postmedia.digital

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022021401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 22 Feb 2022 01:50:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 884 KB
80 KB 885ms
884ms XHR
text/plain 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=621539644028560&correlator=2554575144621653&eid=31065009&output=ldjh&gdfp_req=1&vrg=2022021401&ptt=17&impl=fifs&sc=1&sfv=1-0-38&ecs=20220222&iu_parts=3081%2CSMCO_ENCO_MAGOnFarmer_EN_WEB%2Cindex&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250%2C6x6%7C1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250%2C5x5%2C7x7%7C1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250%2C5x5%2C1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250%2C5x5%2C1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250%2C5x5%2C1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250%2C5x5%2C1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250%2C5x5%2C1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250%2C5x5%2C1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250%2C5x5%2C1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250&ppid=00000000ppidp6120600872118404188&prev_scp=loc%3D1%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3De0f639c7-9381-11ec-b4a7-0e7b21184db3%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%7Cloc%3D2%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3De0f639c8-9381-11ec-b4a7-0e7b21184db3%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%26pub%3D40%7Cloc%3D1%26amznbid%3D2%26amznp%3D2%26id%3De0f639c9-9381-11ec-b4a7-0e7b21184db3%7Cloc%3D3%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3De0f639ca-9381-11ec-b4a7-0e7b21184db3%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%7Cloc%3D2%26amznbid%3D2%26amznp%3D2%26id%3De0f639cb-9381-11ec-b4a7-0e7b21184db3%7Cloc%3D4%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3De0f639cc-9381-11ec-b4a7-0e7b21184db3%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%26pub%3D40%7Cloc%3D3%26amznbid%3D2%26amznp%3D2%26id%3De0f639cd-9381-11ec-b4a7-0e7b21184db3%7Cloc%3D5%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3De0f639ce-9381-11ec-b4a7-0e7b21184db3%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%2C80%26pub%3D40%7Cloc%3D4%26amznbid%3D2%26amznp%3D2%26id%3De0f639cf-9381-11ec-b4a7-0e7b21184db3%7Cloc%3D6%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3De0f639d0-9381-11ec-b4a7-0e7b21184db3%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%26pub%3D40%7Cloc%3D5%26amznbid%3D2%26amznp%3D2%26id%3De0f639d1-9381-11ec-b4a7-0e7b21184db3%7Cloc%3D7%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3De0f639d2-9381-11ec-b4a7-0e7b21184db3%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%26pub%3D40%7Cloc%3D6%26amznbid%3D2%26amznp%3D2%26id%3De0f639d3-9381-11ec-b4a7-0e7b21184db3%7Cloc%3D8%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3De0f639d4-9381-11ec-b4a7-0e7b21184db3%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%26pub%3D40%7Cloc%3D7%26amznbid%3D2%26amznp%3D2%26id%3De0f639d5-9381-11ec-b4a7-0e7b21184db3%7Cloc%3D9%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3De0f639d6-9381-11ec-b4a7-0e7b21184db3%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%26pub%3D40%7Cloc%3D8%26amznbid%3D2%26amznp%3D2%26id%3De0f639d7-9381-11ec-b4a7-0e7b21184db3%7Cloc%3D10%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3De0f639d8-9381-11ec-b4a7-0e7b21184db3%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%26pub%3D40&eri=1&cust_params=no_pol%3Dtrue%26page%3Dindex%26pr%3Donf%26sensitive%3Dn%26negative%3Dn%26ck%3Dindex%26imp%3Dindex%26kuid%3D%26amznbid%3D0%26amznp%3D0%26fr%3Dfalse%26adt%3DveryLow%26alc%3DveryLow%26dlm%3DveryLow%26drg%3DveryLow%26hat%3DveryLow%26off%3DveryLow%26vio%3Dlow%26ias-kw%3DIAS_UNSCORED_PG&cookie_enabled=1&bc=31&abxe=1&dt=1645494658239&lmt=1645494658&dlt=1645494657102&idt=499&frm=20&biw=1600&bih=1200&oid=2&adxs=200%2C797%2C765%2C797%2C765%2C200%2C765%2C200%2C765%2C200%2C765%2C200%2C765%2C200%2C765%2C200%2C765%2C200&adys=233%2C566%2C1108%2C1847%2C2674%2C3413%2C3955%2C3754%2C4296%2C4095%2C4637%2C4436%2C4978%2C4777%2C5319%2C5118%2C5660%2C5459&adks=625928897%2C1960150758%2C1840685615%2C346298458%2C1840685612%2C625928910%2C1840685613%2C625928909%2C1840685586%2C625928908%2C1840685587%2C625928907%2C1840685584%2C625928906%2C1840685585%2C625928905%2C1840685590%2C2524969409&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca%7Cb%7Cc%7Cd%7Ce%7Cf%7Cg%7Ch%7Ci&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F&vis=1&scr_x=0&scr_y=0&psz=1600x250%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250&msz=1600x250%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250&ga_vid=1776981398.1645494658&ga_sid=1645494658&ga_hid=821311234&ga_fc=false&fws=4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4&ohw=1600%2C1600%2C628%2C1600%2C628%2C1600%2C628%2C1600%2C628%2C1600%2C628%2C1600%2C628%2C1600%2C628%2C1600%2C628%2C1600&btvi=0%7C0%7C0%7C1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7C10%7C11%7C12%7C13%7C14%7C15&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022021401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

c2d354fdedbaadf1b43f895733b1280a82d5afe4437cd469b3164c3847ce495b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:59 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 81925
x-xss-protection: 0
google-lineitem-id: -1,-1,-2,-1,-2,-1,-2,-1,-2,-1,-2,-1,-2,-1,-2,-1,-2,-1
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,-2,-1,-2,-1,-2,-1,-2,-1,-2,-1,-2,-1,-2,-1,-2,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 3149 6 KB
4 KB 101ms
34ms Document
text/html 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022021401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 22 Feb 2022 01:50:58 GMT
expires: Wed, 22 Feb 2023 01:50:58 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 204 users Show response
dmx.districtm.io/s/v1/ Frame 13DF 0
585 B 69ms
68ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/users

Requested by

Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://cdn.districtm.io/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: DELETE, GET, OPTIONS, POST
access-control-allow-origin: https://cdn.districtm.io
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6e14910f1ad18cab-EWR
access-control-allow-headers: Origin, Content-Type

GET
H/1.1 200
OK utsync.ashx Show response
ml314.com/ Frame 8EC4 270 B
1 KB 29ms
26ms Script
application/javascript 34.235.23.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=748&ct=js&pi=&fp=&clid=&if=1&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fcdn.krxd.net%2Fpartnerjs%2Fxdi%2Fproxy.3d2100fd7107262ecb55ce6847f01fa5.html%23!kxcid%3Duthtxmddg%26kxt%3Dhttps%253A%252F%252Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%26kxcl%3Dcdn%26kxp%3D&pv=1645494658281_n2mcz39pt&bl=en-us&cb=2261099&return=https%3A%2F%2Fml314.com%2Fcsync.ashx%3Ffp%3DOrUX-sy2%26person_id%3D%5BPersonID%5D%26eid%3D748%26return%3Dhttps%253A%252F%252Fbeacon.krxd.net%252Fusermatch.gif%253Fpartner%253Dmadisonlogic%2526partner_uid%253D%5BPersonID%5D&ht=&d=&dc=&si=1645494658281_n2mcz39pt&cid=&s=1600x1200&rp=https%3A%2F%2Frevert-cheet-3898-ontariofarmer.gdev.postmedia.digital%2F
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?2212022
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.235.23.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-235-23-231.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 14ab5b278f9be15de0074f89acdb48201d71f3c0ffc385b168fee5c0904e22d2

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Feb 2022 01:50:57 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control: private
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 334
Expires: 0

OPTIONS
H2 204 users
dmx.districtm.io/s/v1/ Frame 0
0 116ms
78ms Preflight 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/users

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://cdn.districtm.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
cf-ray: 6e14910e9f5acab0-YYZ
access-control-allow-origin: https://cdn.districtm.io
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type
access-control-allow-methods: DELETE, GET, OPTIONS, POST
access-control-max-age: 14400
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame 8EC4
Redirect Chain

https://ml314.com/csync.ashx?fp=OrUX-sy2&person_id=3625308949374304293&eid=748&return=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dmadisonlogic%26partner_uid%3D3625308949374304293
https://beacon.krxd.net/usermatch.gif?partner=madisonlogic&partner_uid=3625308949374304293

0
337 B

25ms
23ms

Image
text/plain

107.22.254.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=madisonlogic&partner_uid=3625308949374304293
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 107.22.254.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-22-254-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
cache-control: private, no-cache, no-store
x-request-time: D=31 t=1645494658
x-served-by: beacon-n016-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Date: Tue, 22 Feb 2022 01:50:58 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: text/html; charset=utf-8
Location: https://beacon.krxd.net/usermatch.gif?partner=madisonlogic&partner_uid=3625308949374304293
Cache-Control: private
Connection: keep-alive
Content-Length: 211
Expires: Tue, 22 Feb 2022 20:50:58 GMT

GET
H/1.1 200
OK pr Show response
s.amazon-adsystem.com/v3/ Frame 561B 2 KB
3 KB 29ms
29ms Document
text/html 209.54.177.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&dcc=t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.177.54 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

bed79e22634d48c6e53d084c7dc1ac8e7ed34377df61478f7020d89248124ea1

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&dcc=t

Response headers

Server: Server
Date: Tue, 22 Feb 2022 01:50:58 GMT
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 2044
Connection: keep-alive
x-amz-rid: S2H7Z8HPGK92VFW34TA2
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

GET
H2 200 / Show response
match.sharethrough.com/jwumXNuB/v1/ Frame 5965 427 B
529 B 24ms
24ms Document
text/html 34.195.153.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.195.153.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-153-99.compute-1.amazonaws.com
Software: /
Resource Hash: be732f4748336c52d34be6c2545917a6757dd03142e5bf9b0bcd02f14d6aeb9d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
content-length: 427

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 525C 15 KB
6 KB 63ms
19ms Document
text/html 23.54.68.197
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-197.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

last-modified: Tue, 01 Feb 2022 06:38:00 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5549
content-type: text/html; charset=UTF-8
cache-control: max-age=88983
expires: Wed, 23 Feb 2022 02:34:01 GMT
date: Tue, 22 Feb 2022 01:50:58 GMT
vary: Accept-Encoding

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame C202 281 B
554 B 65ms
19ms Document
text/html 23.57.136.222
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.57.136.222 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-57-136-222.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "402b2-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 22 Feb 2022 01:50:58 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H3

200

cm Show response
u.openx.net/w/1.0/ Frame 4380
Redirect Chain

https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX...

722 B
480 B

44ms
31ms

Document
text/html

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 3c95dce4dc9f51eb06f8cec239fefd4ae84e5484edc51e70da258c8010fa6ba8

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

vary: Accept, Accept-Encoding
server: OXGW/17.1.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 22 Feb 2022 01:50:58 GMT
content-type: text/html
content-length: 461
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Redirect headers

server: OXGW/17.1.0
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
date: Tue, 22 Feb 2022 01:50:58 GMT
content-length: 0
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 8C40
Redirect Chain

https://ib.adnxs.com/getuid?https://s.amazon-adsystem.com/ecm3?id=$UID&ex=districtm
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID%26ex%3Ddistrictm
https://s.amazon-adsystem.com/ecm3?id=3270471530205738017&ex=districtm

43 B
556 B

31ms
30ms

Document
image/gif

209.54.177.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?id=3270471530205738017&ex=districtm

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.177.54 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: Server
Date: Tue, 22 Feb 2022 01:50:58 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
x-amz-rid: DF6V407XHQ3HZFF4BHQ8
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

Redirect headers

Server: nginx/1.17.9
Date: Tue, 22 Feb 2022 01:50:58 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Location: https://s.amazon-adsystem.com/ecm3?id=3270471530205738017&ex=districtm
AN-X-Request-Uuid: 93d65963-4280-46cc-a239-3ae81b452349
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 550.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 3CC5
Redirect Chain

https://ib.adnxs.com/getuid?https://s.amazon-adsystem.com/ecm3?id=$UID&ex=appnexus.com
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID%26ex%3Dappnexus.com
https://s.amazon-adsystem.com/ecm3?id=1032252883967861238&ex=appnexus.com

43 B
556 B

31ms
31ms

Document
image/gif

209.54.177.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?id=1032252883967861238&ex=appnexus.com

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.177.54 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: Server
Date: Tue, 22 Feb 2022 01:50:58 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
x-amz-rid: RQ6869E964AV2885FG3T
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

Redirect headers

Server: nginx/1.17.9
Date: Tue, 22 Feb 2022 01:50:58 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Location: https://s.amazon-adsystem.com/ecm3?id=1032252883967861238&ex=appnexus.com
AN-X-Request-Uuid: ea8f2e54-3238-4902-97a9-92d53be02f0a
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 550.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com

GET
H/1.1

200
OK

amazon Show response
ap.lijit.com/beacon/ Frame 1DD1
Redirect Chain

https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com
https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1

1 KB
1 KB

30ms
30ms

Document
text/html

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.86.49 , United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: bd9f530ba7705636d303f4a8358e04e7b460187c0aff61ab589fa311026b3d6b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: nginx
Date: Tue, 22 Feb 2022 01:50:58 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Vary: Accept-Encoding
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
X-Powered-By: raptor
Content-Encoding: gzip
X-Sovrn-Pod: ad_ap1dca1

Redirect headers

Server: nginx
Date: Tue, 22 Feb 2022 01:50:58 GMT
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
X-Powered-By: raptor
X-Sovrn-Pod: ad_ap1dca1

GET
H2

200

index.html Show response
cdn.districtm.io/ids/ Frame A8D5
Redirect Chain

https://cdn.districtm.io/ids/?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D
https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D

116 B
322 B

43ms
43ms

Document
text/html

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
content-type: text/html
cf-ray: 6e14910f6b658cab-EWR
age: 8474
last-modified: Thu, 20 May 2021 02:18:27 GMT
via: 1.1 68d323cfd4a0f1ae252f92c083654190.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-amz-cf-id: JUMTK4Au11mr14tiehj5ZBkQQ9PCuSWJ45P_xz91QayBnqWRYhsDvw==
x-amz-cf-pop: IAD89-P2
x-cache: Hit from cloudfront
vary: Accept-Encoding
server: cloudflare
content-encoding: br

Redirect headers

date: Tue, 22 Feb 2022 01:50:58 GMT
location: https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D
cf-ray: 6e14910f2b018cab-EWR
cache-control: max-age=3600
expires: Tue, 22 Feb 2022 02:50:58 GMT
vary: Accept-Encoding
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 8357
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=1084003074738852891507

43 B
556 B

31ms
31ms

Document
image/gif

209.54.177.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=1084003074738852891507

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.177.54 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: Server
Date: Tue, 22 Feb 2022 01:50:58 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
x-amz-rid: N0SYT1XVSR8TE2M6MDV8
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

Redirect headers

date: Tue, 22 Feb 2022 01:50:58 GMT
content-length: 0
location: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=1084003074738852891507
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 5965 43 B
556 B 63ms
30ms Image
image/gif 209.54.177.54
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=sharethrough.com&id=37f25f47-fcb4-47fc-96ef-7ef38cff4262

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.177.54 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Feb 2022 01:50:58 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 2J43ZTH93W4KDD901WX1
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 5965
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=97
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=97
https://match.sharethrough.com/sync/v1?source_id=gBgkxrVErPj9wqivTDd2AmVY&source_user_id=c76cc6fd-c0a8-4e5c-bb32-40044772f910-62144182-4341&gdpr=0&gdpr_consent=

68 B
262 B

26ms
26ms

Image
image/png

34.195.153.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=gBgkxrVErPj9wqivTDd2AmVY&source_user_id=c76cc6fd-c0a8-4e5c-bb32-40044772f910-62144182-4341&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 34.195.153.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-153-99.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://match.sharethrough.com/sync/v1?source_id=gBgkxrVErPj9wqivTDd2AmVY&source_user_id=c76cc6fd-c0a8-4e5c-bb32-40044772f910-62144182-4341&gdpr=0&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 5965
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=25982a9f-10af-4049-96e3-31137c201343&gdpr=0&gdpr_consent=

68 B
262 B

27ms
27ms

Image
image/png

34.195.153.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=25982a9f-10af-4049-96e3-31137c201343&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 34.195.153.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-153-99.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=25982a9f-10af-4049-96e3-31137c201343&gdpr=0&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 323

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 5965
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3
https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=18694
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=KZXH18GE-1W-1EA2

68 B
262 B

25ms
24ms

Image
image/png

34.195.153.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=KZXH18GE-1W-1EA2
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 34.195.153.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-153-99.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=KZXH18GE-1W-1EA2
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 03d4828e33e22cf7b4098c5a68746480
Expires: 0

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 5965
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4
https://ssum.casalemedia.com/usermatchredir?s=186046&cb=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DGM7HYz3VFjuymbiqnJLyjuPy%26source_user_id%3D__UID__
https://match.sharethrough.com/sync/v1?source_id=GM7HYz3VFjuymbiqnJLyjuPy&source_user_id=YhRBgtM0cBpKPoSUl4Qz5QAA%26042

68 B
262 B

25ms
22ms

Image
image/png

34.195.153.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=GM7HYz3VFjuymbiqnJLyjuPy&source_user_id=YhRBgtM0cBpKPoSUl4Qz5QAA%26042
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 34.195.153.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-153-99.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
Date: Tue, 22 Feb 2022 01:50:58 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://match.sharethrough.com/sync/v1?source_id=GM7HYz3VFjuymbiqnJLyjuPy&source_user_id=YhRBgtM0cBpKPoSUl4Qz5QAA%26042
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 307
Expires: Tue, 22 Feb 2022 01:50:58 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame C202 33 KB
10 KB 24ms
24ms Script
text/html 23.57.136.222
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.57.136.222 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-57-136-222.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 4e48be26b32a67e5d820e61ea8f17a762d718df7e4761dbe79b089bf76c9a9d1

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Tue, 22 Feb 2022 01:50:58 GMT
Content-Encoding: gzip
Last-Modified: Thu, 17 Feb 2022 19:52:27 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=20919
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9761
Expires: Tue, 22 Feb 2022 07:39:37 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 525C 2 KB
2 KB 133ms
18ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=54172287&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 644d402269486db543524238e4b6d1dcdfe40d3b76fcb4c40ad9f3a54b78c672

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:57 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 1569
content-type: text/html; charset=UTF-8

GET
H2 200 idsync.d5cb6b96.js Show response
cdn.districtm.io/ids/ Frame A8D5 3 KB
2 KB 51ms
50ms Script
application/javascript 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Requested by: Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aebd50af0cd8da2f314a52e2088788775d1a441bd674ef9379578e7bc1b5ad50

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
via: 1.1 fb134201578e9706e0dd8abdab0f2abf.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 66911
cf-polished: origSize=3302
x-cache: Miss from cloudfront
cf-bgj: minify
content-encoding: br
last-modified: Thu, 20 May 2021 02:18:27 GMT
server: cloudflare
etag: W/"74ede07ef946dc2316f86b2661cf2dd3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=172800
x-amz-cf-pop: JFK51-C1
cf-ray: 6e1491100c988cab-EWR
x-amz-cf-id: eAFQyvDpP0PzfMELvLEVR-hml06ux82vdQ9KWW3mKynTylzMM2bdbw==
expires: Thu, 24 Feb 2022 01:50:58 GMT

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 4380 43 B
556 B 32ms
31ms Image
image/gif 209.54.177.54
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=openx.com&id=ffe67708-2f14-84e5-9365-8216d299861e

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.177.54 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Feb 2022 01:50:58 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: SM3495ZJ4DYJQ0N869V5
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 4380
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YhRBggAH9Y6JOwAy

43 B
180 B

33ms
28ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537148856&val=YhRBggAH9Y6JOwAy
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1645494659.587062,VS0,VE0
x-served-by: cache-yul12828-YUL
x-cache: HIT
location: https://us-u.openx.net/w/1.0/sd?id=537148856&val=YhRBggAH9Y6JOwAy
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 33f76d31-a312-ad56-62bc-167445fd80b7
pr-bh.ybp.yahoo.com/sync/openx/ Frame 4380 43 B
991 B 80ms
28ms Image
image/gif 2600:1f18:4e9:5a01:82b8:89c9:c55a:66d8
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/33f76d31-a312-ad56-62bc-167445fd80b7?gdpr=0

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:82b8:89c9:c55a:66d8 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 4380
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=a7300b75-33be-3f1f-536b-0081baaa4dfe&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=25982a9f-10af-4049-96e3-31137c201343&ttd_puid=a7300b75-33be-3f1f-536b-0081baaa4dfe

43 B
249 B

34ms
28ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=25982a9f-10af-4049-96e3-31137c201343&ttd_puid=a7300b75-33be-3f1f-536b-0081baaa4dfe
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=25982a9f-10af-4049-96e3-31137c201343&ttd_puid=a7300b75-33be-3f1f-536b-0081baaa4dfe
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 293

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 4380 170 B
188 B 37ms
35ms Image
image/png 142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OGI1ZmQ4YmYtZmFjOS02MWJiLTQ2OGItNWEzODcwNDg4Mzll

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 4380
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEB3zuYhEXL4AuR5qP9qHstQ&google_cver=1

43 B
106 B

29ms
28ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEB3zuYhEXL4AuR5qP9qHstQ&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEB3zuYhEXL4AuR5qP9qHstQ&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 1DD1 43 B
556 B 35ms
33ms Image
image/gif 209.54.177.54
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=da7ec15180eaa86010a10906&ex=sovrn.com&gdpr=0&gdpr_consent=

Requested by

Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.177.54 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Feb 2022 01:50:58 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: H8G4PSZEZ5BX2CHA1SA6
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 1DD1
Redirect Chain

https://data.adsrvr.org/track/cmf/generic?ttd_pid=federatedmedia&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=27&3pid=25982a9f-10af-4049-96e3-31137c201343&gdpr=0&gdpr_consent=

43 B
918 B

64ms
18ms

Image
image/gif

63.251.114.136
INTERNAP-2BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=27&3pid=25982a9f-10af-4049-96e3-31137c201343&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 63.251.114.136 , United States, ASN12181 (INTERNAP-2BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Feb 2022 01:50:58 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap5ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://ce.lijit.com/merge?pid=27&3pid=25982a9f-10af-4049-96e3-31137c201343&gdpr=0&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 223

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 1DD1
Redirect Chain

https://pixel.quantserve.com/pixel/p-CXt61zNBpKUt1.gif?idmatch=0&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=ja_3JY-s_iOW_PV13qnrc96v8HWWr6IpjKXQsrg9

43 B
922 B

25ms
21ms

Image
image/gif

63.251.114.136
INTERNAP-2BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=ja_3JY-s_iOW_PV13qnrc96v8HWWr6IpjKXQsrg9
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 63.251.114.136 , United States, ASN12181 (INTERNAP-2BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Feb 2022 01:50:58 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap5ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=ja_3JY-s_iOW_PV13qnrc96v8HWWr6IpjKXQsrg9
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 1DD1
Redirect Chain

https://aorta.clickagy.com/pixel.gif?ch=185&cm=da7ec15180eaa86010a10906&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=84&3pid=c:a643638e815cf4bb0d313e32e48c12ab

43 B
1 KB

25ms
19ms

Image
image/gif

63.251.114.136
INTERNAP-2BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=84&3pid=c:a643638e815cf4bb0d313e32e48c12ab
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 63.251.114.136 , United States, ASN12181 (INTERNAP-2BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Feb 2022 01:50:58 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap5ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Tue, 22 Feb 2022 01:50:58 GMT
server: Aorta/20220128.132aca1
access-control-allow-origin
access-control-max-age: 31536000
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/plain
Location: https://ce.lijit.com/merge?pid=84&3pid=c:a643638e815cf4bb0d313e32e48c12ab
access-control-expose-headers: Set-Cookie
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
X-Aorta-Region: us-east-1
Connection: keep-alive
X-Aorta-Host: ip-10-42-22-47.ec2.internal
access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction
Content-Length: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 1DD1
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558511&ev=1&rurl=https%3A%2F%2Fce.lijit.com/merge?pid=49&3pid=%%VGUID%%&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=49&3pid=f6fydBPfVMDA&ev=1&pid=558511&gdpr_consent=&gdpr=0

43 B
1 KB

35ms
19ms

Image
image/gif

63.251.114.136
INTERNAP-2BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=49&3pid=f6fydBPfVMDA&ev=1&pid=558511&gdpr_consent=&gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 63.251.114.136 , United States, ASN12181 (INTERNAP-2BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Feb 2022 01:50:58 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap5ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-CA
location: https://ce.lijit.com/merge?pid=49&3pid=f6fydBPfVMDA&ev=1&pid=558511&gdpr_consent=&gdpr=0
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-6f4b885bc-2bq6h
expires: -1

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 1DD1
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent=
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=sovrn&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=87&3pid=5eee8e08-b4d2-47c8-8287-d54394a5c299

43 B
2 KB

20ms
20ms

Image
image/gif

63.251.114.136
INTERNAP-2BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=87&3pid=5eee8e08-b4d2-47c8-8287-d54394a5c299
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 63.251.114.136 , United States, ASN12181 (INTERNAP-2BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Feb 2022 01:50:58 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap5ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: //ce.lijit.com/merge?pid=87&3pid=5eee8e08-b4d2-47c8-8287-d54394a5c299
date: Tue, 22 Feb 2022 01:50:58 GMT
cache-control: no-cache, no-store, must-revalidate
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame C202
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=KZXH18GE-1W-1EA2
https://s.amazon-adsystem.com/ecm3?id=KZXH18GE-1W-1EA2&ex=d-rubiconproject.com&status=ok

43 B
556 B

30ms
30ms

Image
image/gif

209.54.177.54
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=KZXH18GE-1W-1EA2&ex=d-rubiconproject.com&status=ok

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

HTTP/1.1

Server

209.54.177.54 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Feb 2022 01:50:58 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 1WG5AZ3PPHNZ45AWK2H2
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://s.amazon-adsystem.com/ecm3?id=KZXH18GE-1W-1EA2&ex=d-rubiconproject.com&status=ok
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 03d4828e33e22cf7b4098c5a68746480
Expires: 0

POST
H3 200 / Show response
www.facebook.com/tr/ Frame B135 0
18 B 42ms
18ms Document
text/plain 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Response headers

content-type: text/plain
access-control-allow-origin: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority: u=0
date: Tue, 22 Feb 2022 01:50:58 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame A8D5
Redirect Chain

https://dmx.districtm.io/s/v1/users/10002
https://s.amazon-adsystem.com/ecm3?ex=dmx.com&id=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOjEwMDAyLCJ1c3IiOiJxZ1llc2dZYk1qVlNaamhGTTNGR1ZXVjZNRUYxVFdWSE1EVkhla0ZKVldGdiJ9.8PZJyw-P0tRPNSlIdp7cqj...

43 B
556 B

31ms
31ms

Image
image/gif

209.54.177.54
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=dmx.com&id=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOjEwMDAyLCJ1c3IiOiJxZ1llc2dZYk1qVlNaamhGTTNGR1ZXVjZNRUYxVFdWSE1EVkhla0ZKVldGdiJ9.8PZJyw-P0tRPNSlIdp7cqjzdbGhN84KpUwx97Drn6PTecpEodMik8yW2NI5g4KXJaZwcHFPRD_12THUipYsiMg

Requested by

Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D

Protocol

HTTP/1.1

Server

209.54.177.54 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Feb 2022 01:50:58 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: DJDPV2QRXPKFJRNN0P9V
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Tue, 22 Feb 2022 01:50:58 GMT
cf-cache-status: DYNAMIC
server: cloudflare
location: https://s.amazon-adsystem.com/ecm3?ex=dmx.com&id=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOjEwMDAyLCJ1c3IiOiJxZ1llc2dZYk1qVlNaamhGTTNGR1ZXVjZNRUYxVFdWSE1EVkhla0ZKVldGdiJ9.8PZJyw-P0tRPNSlIdp7cqjzdbGhN84KpUwx97Drn6PTecpEodMik8yW2NI5g4KXJaZwcHFPRD_12THUipYsiMg
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: DELETE, GET, OPTIONS, POST
access-control-allow-origin: https://cdn.districtm.io
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6e1491107d548cab-EWR
access-control-allow-headers: Origin, Content-Type
content-length: 0

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame F322
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=F5442E89-17F3-44B7-B527-DBDE7BA68DD7
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=F5442E89-17F3-44B7-B527-DBDE7BA68DD7

35 B
467 B

18ms
18ms

Document
image/gif

185.167.164.39
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=F5442E89-17F3-44B7-B527-DBDE7BA68DD7

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.39 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Tue, 22 Feb 2022 01:50:58 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

server: nginx
date: Tue, 22 Feb 2022 01:50:58 GMT
content-length: 0
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=F5442E89-17F3-44B7-B527-DBDE7BA68DD7
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 46F3
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YhRBggAH9Y6JOwAy&gdpr=0&gdpr_consent=

1 B
257 B

96ms
24ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YhRBggAH9Y6JOwAy&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Tue, 22 Feb 2022 01:50:58 GMT
content-type: text/html; charset=utf-8
content-length: 1
x-lat: va1pug003:0:1331
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

server: Varnish
retry-after: 0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YhRBggAH9Y6JOwAy&gdpr=0&gdpr_consent=
accept-ranges: bytes
date: Tue, 22 Feb 2022 01:50:58 GMT
via: 1.1 varnish
x-served-by: cache-yul12828-YUL
x-cache: HIT
x-cache-hits: 0
x-timer: S1645494659.698745,VS0,VE0
cache-control: no-cache
pragma: no-cache
content-length: 0

GET
H/1.1 200
OK ecm3 Show response
s.amazon-adsystem.com/ Frame DCBE 43 B
556 B 32ms
30ms Document
image/gif 209.54.177.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?id=F5442E89-17F3-44B7-B527-DBDE7BA68DD7&ex=pubmatic.com

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.177.54 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

Server: Server
Date: Tue, 22 Feb 2022 01:50:58 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
x-amz-rid: 5MRZKG9ZQMEWDPPD5SD0
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 525C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=9UQuiRfzRLe1J9vee6aN1w%3D%3D
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

15 KB
15 KB

21ms
18ms

Image
text/html

23.54.68.197
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Server: 23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-54-68-197.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
content-encoding: gzip
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
server: Apache/2.2.15 (CentOS)
etag: "1300708-3de4-5d6ef246ef4cf"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=88983
accept-ranges: bytes
content-type: text/html; charset=UTF-8
content-length: 5549
expires: Wed, 23 Feb 2022 02:34:01 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 272
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

458249.gif
idsync.rlcdn.com/ Frame 525C
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=F5442E89-17F3-44B7-B527-DBDE7BA68DD7
https://pippio.com/api/sync?pid=5324&it=1&iv=82c1247234cc368950cd699276b3e03448c65554540528962d0bc1b86d240ac8791426b5417dce21&_=2
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA4MmMxMjQ3MjM0Y2MzNjg5NTBjZDY5OTI3NmIzZTAzNDQ4YzY1NTU0NTQwNTI4OTYyZDBiYzFiODZkMjQwYWM4NzkxNDI2YjU...
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA4MmMxMjQ3MjM0Y2MzNjg5NTBjZDY5OTI3NmIzZTAzNDQ4YzY1NTU0NTQwNTI4OTYyZDBiYzFiODZkMjQwYWM4NzkxNDI2YjU0MTdkY2UyMRAAGgwIgoPRkAYSBAgCEABCAEoA&goog...
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
https://idsync.rlcdn.com/458249.gif?partner_uid=71ae591f-056f-461a-851c-4f2962414785

42 B
60 B

42ms
41ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/458249.gif?partner_uid=71ae591f-056f-461a-851c-4f2962414785
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 22 Feb 2022 01:50:59 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/458249.gif?partner_uid=71ae591f-056f-461a-851c-4f2962414785
date: Tue, 22 Feb 2022 01:50:59 GMT
via: 1.1 google
x-samesite: secure
alt-svc: clear
content-length: 111
content-type: text/html; charset=utf-8

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 525C
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=2d386214-4182-4d00-a150-6a33a1aba1d8

0
260 B

77ms
25ms

Image
text/plain

8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=2d386214-4182-4d00-a150-6a33a1aba1d8
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:59 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Tue, 22 Feb 2022 01:50:58 GMT
Server: MT3 4133 baa842e master iad-pixel-x4 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=2d386214-4182-4d00-a150-6a33a1aba1d8
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 22 Feb 2022 01:50:57 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 525C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjU0NDJFODktMTdGMy00NEI3LUI1MjctREJERTdCQTY4REQ3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
342 B

63ms
19ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 21 Feb 2022 20:56:18 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug026:0:374
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 525C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEGOWN_jMTikL_CdbmFUi3lM&google_cver=1

42 B
439 B

64ms
20ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEGOWN_jMTikL_CdbmFUi3lM&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 21 Feb 2022 20:34:30 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug027:0:402
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEGOWN_jMTikL_CdbmFUi3lM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 525C
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:4DC78985468648D4B1B4F7DEDE93899D

42 B
383 B

20ms
19ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:4DC78985468648D4B1B4F7DEDE93899D
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug002:0:459
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Tue, 22 Feb 2022 01:50:58 GMT
x-content-type-options: nosniff
server: nginx
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:4DC78985468648D4B1B4F7DEDE93899D
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Mon, 21 Feb 2022 01:50:58 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 525C
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7255204550680405259&gdpr=0&gdpr_consent=&us_privacy=

1 B
324 B

25ms
25ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7255204550680405259&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:59 GMT
cache-control: no-store, no-cache, private
x-lat: va1pug005:0:416
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7255204550680405259&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 525C
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=25982a9f-10af-4049-96e3-31137c201343

42 B
603 B

76ms
23ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=25982a9f-10af-4049-96e3-31137c201343
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
cache-control: no-store, no-cache, private
x-lat: va1pug018:0:393
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=25982a9f-10af-4049-96e3-31137c201343
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 313

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C202
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pYSDE4R0UtMVctMUVBMg==

170 B
188 B

39ms
37ms

Image
image/png

142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pYSDE4R0UtMVctMUVBMg==

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1

Protocol

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pYSDE4R0UtMVctMUVBMg==
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: ab995a74221271a8dc253760ec78ee1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

204

v1
ads.yahoo.com/cms/ Frame C202
Redirect Chain

https://token.rubiconproject.com/token?pid=26594
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KZXH18GE-1W-1EA2&sigv=1&esig=2~4ace4d71fddf952a09d3520845d7442f669f32fb

0
194 B

90ms
29ms

Image
text/plain

2001:4998:14:800::1001
YAHOO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KZXH18GE-1W-1EA2&sigv=1&esig=2~4ace4d71fddf952a09d3520845d7442f669f32fb

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1

Protocol

Server

2001:4998:14:800::1001 , United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KZXH18GE-1W-1EA2&sigv=1&esig=2~4ace4d71fddf952a09d3520845d7442f669f32fb
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 03d4828e33e22cf7b4098c5a68746480
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

422
Unprocessable Entity

tap.php
pixel.rubiconproject.com/ Frame C202
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/wUr2VdDB7fzExvUSdOLWmcn5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6483038817428292933

0
0

95ms
23ms

Image
text/plain

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6483038817428292933
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Redirect headers

date: Tue, 22 Feb 2022 01:50:58 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6483038817428292933
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H2

200

setuid
px.ads.linkedin.com/ Frame C202
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=KZXH18GE-1W-1EA2

0
141 B

56ms
49ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=KZXH18GE-1W-1EA2
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:58 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 31EA2DE546DC4DB48F85638F776CA382 Ref B: YTO01EDGE0509 Ref C: 2022-02-22T01:50:58Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXYkZSeY3XvDQsa10tfmA==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=KZXH18GE-1W-1EA2
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 03d4828e33e22cf7b4098c5a68746480
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 709414.gif
id.rlcdn.com/ Frame C202 42 B
288 B 43ms
41ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/709414.gif
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 22 Feb 2022 01:50:58 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H/1.1

422
Unprocessable Entity

tap.php
pixel.rubiconproject.com/ Frame C202
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=2d386214-4182-4d00-a150-6a33a1aba1d8&expires=28

0
0

95ms
25ms

Image
text/plain

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=2d386214-4182-4d00-a150-6a33a1aba1d8&expires=28
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Redirect headers

Date: Tue, 22 Feb 2022 01:50:58 GMT
Server: MT3 4133 baa842e master iad-pixel-x31 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=2d386214-4182-4d00-a150-6a33a1aba1d8&expires=28
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 22 Feb 2022 01:50:57 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C202
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MmY4YjJiNjBhNGI4OWQ3M2ViOTc4MWZlZjUxZDg5YTc5MDNmNTAyYQ

170 B
188 B

37ms
35ms

Image
image/png

142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MmY4YjJiNjBhNGI4OWQ3M2ViOTc4MWZlZjUxZDg5YTc5MDNmNTAyYQ

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1

Protocol

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MmY4YjJiNjBhNGI4OWQ3M2ViOTc4MWZlZjUxZDg5YTc5MDNmNTAyYQ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: ab995a74221271a8dc253760ec78ee1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

422
Unprocessable Entity

tap.php
pixel.rubiconproject.com/ Frame C202
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=25982a9f-10af-4049-96e3-31137c201343&gdpr=0&gdpr_consent=&expires=30

0
0

101ms
25ms

Image
text/plain

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=25982a9f-10af-4049-96e3-31137c201343&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:58 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=25982a9f-10af-4049-96e3-31137c201343&gdpr=0&gdpr_consent=&expires=30
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 289

GET
H2 200 hp_w_ion_l.svg
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/weather/images/ 39 KB
15 KB 15ms
14ms Image
image/svg+xml 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/9.1.2/weather/images/hp_w_ion_l.svg

Requested by

Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

29184c416fa3c5ffcbc4baf96ffe14c8d5fe2a0ff451da9d40b7109960ba3c2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Tue, 22 Feb 2022 01:50:58 GMT
content-encoding: gzip
last-modified: Fri, 24 Dec 2021 02:26:29 GMT
etag: W/"61c52fd5-9ab0"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Fri, 17 Feb 2023 01:50:58 GMT

GET
H2 200 optout_check Show response
beacon.krxd.net/ 82 B
241 B 24ms
24ms Script
text/javascript 107.22.254.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.krxd.net/optout_check?callback=Krux.ns.postmedia.kxjsonp_optOutCheck
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.22.254.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-22-254-227.compute-1.amazonaws.com
Software: /
Resource Hash: 0535edcb69bc883196ac4f00005d76245377ebcfd800486362b8c37f2f213007

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:59 GMT
cache-control: private, max-age=0, s-max-age=0
x-request-time: D=43 t=1645494659
x-served-by: beacon-n008-ash-prod.krxd.net
content-type: text/javascript

GET
H2 200 get Show response
cdn.krxd.net/userdata/ 364 B
510 B 29ms
29ms Script
text/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/userdata/get?pub=42fb57ac-2013-45a6-8dad-332d53e17c1b&technographics=1&callback=Krux.ns.postmedia.kxjsonp_userdata
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 6d9bc265633896e510b703d724e0755972ad09a7a94a7a47c44796dbbf48b294

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_userdata_ash_prod_krxd_net___UserData_Service_V2
date: Tue, 22 Feb 2022 01:50:59 GMT
content-encoding: gzip
age: 0
x-served-by: userdata-a011-ash-prod.krxd.net, cache-yul12825-YUL
vary: Accept-Encoding
x-cache: MISS, MISS
content-type: text/javascript
via: 1.1 varnish
cache-control: private, max-age=1800
x-age: 0
accept-ranges: bytes
x-timer: S1645494659.150647,VS0,VE19
content-length: 282
x-cache-hits: 0, 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 13 KB
10 KB 92ms
46ms XHR
application/json 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022021401&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022021401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cba3ea17b1953652d697e2eff5236640c08d1c78f04c229cf231561937aa8626

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 22 Feb 2022 01:50:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9896
x-xss-protection: 0

GET
H2 200 ribn-postmedia.min.js Show response
assets.ribn.com/v2/production/ 13 KB
4 KB 93ms
17ms Script
application/javascript 2600:9000:2209:0:7:75d4:e40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.ribn.com/v2/production/ribn-postmedia.min.js
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2209:0:7:75d4:e40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c81cab8c63d469329c0e0724770c6c8622f0d5d1fb8b6f919b6d7dddfadba190

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 21 Feb 2022 19:39:55 GMT
content-encoding: gzip
last-modified: Wed, 01 Sep 2021 18:06:03 GMT
server: AmazonS3
age: 22290
etag: W/"baaa6497dd2dea88d8fdb6d6cca08cf2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 17da55c14108bb8cae904f764f67c0e0.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-P1
x-amz-cf-id: RTlZX277H1vL1YeROf3N3Kk_jM_eOuvfiBkJtNrcAHoiazAT9c2GaA==

GET
H2

200

cs.js Show response
sb.scorecardresearch.com/internal-c2/default/
Redirect Chain

https://sb.scorecardresearch.com/c2/10276888/cs.js
https://sb.scorecardresearch.com/internal-c2/default/cs.js

0
350 B

17ms
17ms

Script
application/javascript

52.85.61.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/internal-c2/default/cs.js
Protocol: H2
Server: 52.85.61.28 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-28.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 22 Feb 2022 01:45:23 GMT
via: 1.1 d7202b57803815a076179b3bb9bbd766.cloudfront.net (CloudFront)
last-modified: Mon, 01 Mar 2021 20:42:20 GMT
server: AmazonS3
age: 337
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: EWR53-P1
accept-ranges: bytes
content-length: 0
x-amz-cf-id: rX3O6rYb02IcQ-U-xXfWNpMneS-FLCD40AOLMBfcTKcdRNVSI4e4AQ==

Redirect headers

date: Tue, 22 Feb 2022 01:50:59 GMT
via: 1.1 d7202b57803815a076179b3bb9bbd766.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-P1
vary: Accept
x-cache: Miss from cloudfront
content-type: text/plain; charset=utf-8
location: /internal-c2/default/cs.js
content-length: 48
x-amz-cf-id: Eqx5RVsd09rrcsWJgNKRX4cXtIEAmyU44DyovwAOLuD42_K1qSsSmA==

GET
H2 200 42fb57ac-2013-45a6-8dad-332d53e17c1b Show response
consumer.krxd.net/consent/get/ 224 B
310 B 30ms
30ms Script
text/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://consumer.krxd.net/consent/get/42fb57ac-2013-45a6-8dad-332d53e17c1b?idt=device&dt=kxcookie&callback=Krux.ns.postmedia.kxjsonp_consent_get_1
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: b4cd5a35208ed1887c60d9068a37b1efd686c5735ecde966379a3d6c27f044e6

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:59 GMT
via: 1.1 varnish
age: 0
x-served-by: consumer-a016-ash-prod.krxd.net, cache-yul12833-YUL
vary: Accept-Encoding
x-cache: MISS, MISS
content-type: text/javascript; charset=UTF-8
content-encoding: gzip
cache-control: max-age=1800
x-age: 0
accept-ranges: bytes
x-timer: S1645494659.179100,VS0,VE20
content-length: 187
x-cache-hits: 0, 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 94ms
39ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022021401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 22 Feb 2022 01:50:59 GMT

GET
H3 200 container.html Show response
1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 1937 6 KB
3 KB 49ms
20ms Document
text/html 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022021401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 22 Feb 2022 01:50:58 GMT
expires: Wed, 22 Feb 2023 01:50:58 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 8F86 6 KB
3 KB 23ms
22ms Document
text/html 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022021401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 22 Feb 2022 01:50:58 GMT
expires: Wed, 22 Feb 2023 01:50:58 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220216/r20110914/client/ Frame 1937 2 KB
904 B 87ms
55ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220216/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:42:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 496
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 877
x-xss-protection: 0
server: cafe
etag: 13035868154101442325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Mar 2022 01:42:43 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 1937 0
0 94ms
93ms Fetch
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CP46vgkEUYvrPGYTD_gSjtI7wBuaT9shovKrQ9swPjarj1P0sEAEg4pn9D2B9oAHW77n2A8gBCeACAKgDAcgDmwSqBKgCT9B1IC5LdoppL-J7tatzbeKiggHWRuVmg0W791Yb-OOijxyrv0BOQNgf7V3M2JaNL_JGPYPT0iIMhl9QfCt4lS3VAv487tesvWLe0NS3O884Qw5nGhviVAQUQrBZFTSnYnV1zKOwBMdEitiywV0T5qYr84-Xe7SPfI86ltR0Lv_L0Y1FoZ7MmVgxlQFwSdpmxaC7bcy1-eBygRNYp7LnkTGMp_6u4_OXumCHY4yGbpXw3YePtWINBgdt32tRoUvurwun3wVKtRPmWeqskqQf7Nj7vIyciMHJbbjLUvCYPycHE9GaNlRqVk2qMVKksHa9meW5R7oXPgPoUT_LF5dK47o4COS5NcGFmgtDQfPQ-OljI3oHhagaN4pVasUaq3V9K5_kpuuI2JvABIGfooLuA-AEAZIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAeSkMYJqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpr4b2AcA8gcEEL2OCtIIBwiAYRABGF2ACgPICwHYEw7QFQGYFgGAFwGyFx4KHAgAEhRwdWItNTYxMTA1MzY2MjYxMzM5MBjN9RE&sigh=jjSCElE9vug&uach_m=[UACH]&template_id=494
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s80-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220216/r20110914/ Frame 1937 19 KB
8 KB 61ms
31ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220216/r20110914/abg_lite_fy2019.js

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cb0a1ac121b8aa9b8e2912768985ee6341cdd33d4c7b4db39052731d4b5248e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:32:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1107
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7876
x-xss-protection: 0
server: cafe
etag: 1930320615972901081
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Mar 2022 01:32:32 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220216/r20110914/client/ Frame 1937 2 KB
1 KB 82ms
53ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220216/r20110914/client/window_focus_fy2019.js

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:46:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 260
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Mar 2022 01:46:39 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1937 124 KB
38 KB 135ms
43ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5b9794842e89dcec3790d21b95acce36c08673d4162e745dc440e6766534ed53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38723
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1645015031201889"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 22 Feb 2022 01:50:59 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220216/r20110914/client/ Frame 1937 15 KB
6 KB 55ms
26ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220216/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78ea6d7806beda2d76bb7d9abb14b034ad476a897376c270aefcf40a2f49316c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:49:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 68
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6438
x-xss-protection: 0
server: cafe
etag: 12093742715590823996
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Mar 2022 01:49:51 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 1937 0
0 39ms
37ms Image
text/html 2607:f8b0:4006:822::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSMbb1-lAi6OeSW9Ov3X7M6mqmI6gxSY3BgAh99znZaWgfifgMpQay6anxWAiqlEEzPD2vLvg0RR6wLbpQ08pb0aG-6kQ
Requested by: Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:822::2004 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H2 200 6db0573cb067ea4557d3af56fc7062b8.js Show response
www.gstatic.com/mysidia/ Frame 1937 28 KB
12 KB 109ms
15ms Script
text/javascript 2607:f8b0:4006:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/6db0573cb067ea4557d3af56fc7062b8.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a50761af47976acf2a9b1ed88cff6727c6c0fa4a18c2806a26f108c5268b4c1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 09:59:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 402693
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11678
x-xss-protection: 0
last-modified: Tue, 15 Feb 2022 08:01:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 18 May 2022 09:59:26 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame ACA2 13 KB
5 KB 48ms
27ms Document
text/html 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 20 Feb 2022 19:27:41 GMT
expires: Mon, 20 Feb 2023 19:27:41 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 109398
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame A9BF 783 B
534 B 48ms
47ms Document
text/html 2607:f8b0:4006:822::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2004 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

7d06e3131ddb81933c107666b35dd12529999f1bab34373676aacbc0781d3f38

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-F5+QuM7M9uppvsBO+sjcvw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Tue, 22 Feb 2022 01:50:59 GMT
date: Tue, 22 Feb 2022 01:50:59 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-F5+QuM7M9uppvsBO+sjcvw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220216/r20110914/client/ Frame 8F86 2 KB
904 B 72ms
55ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220216/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:42:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 496
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 877
x-xss-protection: 0
server: cafe
etag: 13035868154101442325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Mar 2022 01:42:43 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 8F86 0
0 91ms
91ms Fetch
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CIn81gkEUYvvPGYTD_gSjtI7wBuaT9shovKrQ9swPjarj1P0sEAEg4pn9D2B9oAHW77n2A8gBCeACAKgDAcgDmwSqBKsCT9B_x9NUpfrkbzvr7bCKuIQQh1Jda3ffUH0qveoC42ga_K4gtBTcHDyKeuFG4LaGUFQlr7uiu_E0Nh7AJS06UtunWdg-1MxSWc1GtllyzJPKvg-MJR3eOZQVTwk4OoeDL5ySTOkiP-89ICDudI6br4DeuNLKGOAWbNBaWt48uEPqytYajiEcsPvpqmiyS7AtQeYz9zKqJKARDlpMmHAm2ql4LbUJ9_AgQRwpAstLobPvwCoGXlQi9jB0MYj9G9qCIoSbWtxv19Q_xuCNPmVG0O2kUxfxOUJC2OOyNt_H95pan9zWcS0tFlbVS8aP90wJxmLghom4IBUcmpv9EIM5Myc8k_2wb9ePr5dkvyAvNpIfwrSj1qMaKQ7kvHXgIp4aKzCLeDemyFO2FnnABIGfooLuA-AEAZIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAeSkMYJqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpr4b2AcA8gcEEL2OCtIIBwiAYRABGF2ACgPICwHYEw7QFQGYFgGAFwGyFx4KHAgAEhRwdWItNTYxMTA1MzY2MjYxMzM5MBjN9RE&sigh=RdQJ5saFAfI&uach_m=[UACH]&template_id=494
Requested by: Host: revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
URL: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s80-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220216/r20110914/ Frame 8F86 19 KB
8 KB 51ms
35ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220216/r20110914/abg_lite_fy2019.js

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cb0a1ac121b8aa9b8e2912768985ee6341cdd33d4c7b4db39052731d4b5248e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:32:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1107
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7876
x-xss-protection: 0
server: cafe
etag: 1930320615972901081
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Mar 2022 01:32:32 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220216/r20110914/client/ Frame 8F86 2 KB
1 KB 69ms
54ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220216/r20110914/client/window_focus_fy2019.js

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:46:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 260
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Mar 2022 01:46:39 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8F86 124 KB
38 KB 171ms
95ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5b9794842e89dcec3790d21b95acce36c08673d4162e745dc440e6766534ed53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38723
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1645015031201889"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 22 Feb 2022 01:50:59 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220216/r20110914/client/ Frame 8F86 15 KB
6 KB 54ms
40ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220216/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78ea6d7806beda2d76bb7d9abb14b034ad476a897376c270aefcf40a2f49316c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:49:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 68
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6438
x-xss-protection: 0
server: cafe
etag: 12093742715590823996
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Mar 2022 01:49:51 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 8F86 0
0 42ms
41ms Image
text/html 2607:f8b0:4006:822::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQqcRW7fP9rJfJT0AddyZttw1pn5PZBMh5j2EseLucEIb97Bv7FZj_RyIqwPDRlEeXwI3TYstINUgsxN-ZRPhCrK0yVMA
Requested by: Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:822::2004 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H2 200 6db0573cb067ea4557d3af56fc7062b8.js Show response
www.gstatic.com/mysidia/ Frame 8F86 28 KB
11 KB 97ms
19ms Script
text/javascript 2607:f8b0:4006:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/6db0573cb067ea4557d3af56fc7062b8.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a50761af47976acf2a9b1ed88cff6727c6c0fa4a18c2806a26f108c5268b4c1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 09:59:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 402693
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11678
x-xss-protection: 0
last-modified: Tue, 15 Feb 2022 08:01:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 18 May 2022 09:59:26 GMT

GET
H2 204 pixel.gif
beacon.krxd.net/ 0
337 B 26ms
25ms Image
text/plain 107.22.254.227
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/pixel.gif?source=smarttag&fired=report&confid=uthtxmddg&_kpid=42fb57ac-2013-45a6-8dad-332d53e17c1b&_kcp_s=communities&_kcp_d=postmedia.digital&_knifr=9&_kua_kx_tz=0&geo_country=ca&geo_region=qc&geo_dma=124462&_kua_kx_lang=en-us&_kua_kx_tech_browser_language=en-us&_kua_mpid=6120600872118404188&_kua_ad_light_user=false&_kua_kx_tech_browser=Chrome%209&_kua_kx_tech_manufacturer=Microsoft%20Corporation&_kua_kx_tech_device=Computer&_kua_kx_tech_os=Windows%2010&_kua_kx_geo_country=ca&_kua_kx_geo_region=qc&_kua_kx_geo_dma=124462&_kua_kx_whistle=0&_kpa_domain=postmedia.digital&_kpa_page_type=index&_kpa_communities_page_type=index&_kpa_main_category=index&_kpa_view_type=HTML&_kpa_env=test&_kpa_paywall_whitelist=false&t_navigation_type=0&t_dns=0&t_tcp=27&t_http_request=-1&t_http_response=53&t_content_ready=6741&t_window_load=8512&t_redirect=0&interchange_ran=false&userdata_was_requested=true&userdata_did_respond=true&store_user_after=w5zwflvew&userdata_user=OrUX-sy2%2Cw5zwflvew&sview=1&kplt0=41818&kplt1=42920&kplt2=42921&kplt3=42922&kplt4=44981&kplt5=45977&kplt6=46302&jsonp_requests=https%3A%2F%2Fconsumer.krxd.net%2Fconsent%2Fget%2F42fb57ac-2013-45a6-8dad-332d53e17c1b%2C111%2Chttps%3A%2F%2Fbeacon.krxd.net%2Foptout_check%2C35%2Chttps%3A%2F%2Fcdn.krxd.net%2Fuserdata%2Fget%2C37%2Chttps%3A%2F%2Fconsumer.krxd.net%2Fconsent%2Fget%2F42fb57ac-2013-45a6-8dad-332d53e17c1b%2C154
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.22.254.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-22-254-227.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:59 GMT
cache-control: private, no-cache, no-store
x-request-time: D=62 t=1645494659
x-served-by: beacon-n019-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame 1937 24 KB
24 KB 100ms
22ms Image
image/jpeg 2607:f8b0:4006:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcRTNN-EC6XPuR-4TKDd3TUkYIx3YcAgyT7Y5Cg1aeECmzotDolWFn1D-d4Whw&usqp=CAI

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:806::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8ed0a1bd4eb0ed3301ce027cbbbfc1ab533ec89a81b2446dd053b2b15131eae7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 16 Feb 2022 18:14:25 GMT
x-content-type-options: nosniff
age: 459394
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24258
x-xss-protection: 0
last-modified: Sun, 10 Jan 2021 00:59:03 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Thu, 16 Feb 2023 18:14:25 GMT

GET
H2 200 shopping
encrypted-tbn2.gstatic.com/ Frame 1937 33 KB
34 KB 98ms
20ms Image
image/jpeg 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcS2IDJufoMlZqKch7sMW55w1Z7w6PSDwq1ipgUXw2b52eHUYC0u3Pt1rjgfww&usqp=CAI

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7672bbc7995d3a3f83002c8042c2c00f758192c570ca5f190496dfa7922dd13a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 08:03:27 GMT
x-content-type-options: nosniff
age: 409652
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33954
x-xss-protection: 0
last-modified: Tue, 30 Mar 2021 05:26:16 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Feb 2023 08:03:27 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame 1937 27 KB
27 KB 120ms
42ms Image
image/jpeg 2607:f8b0:4006:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcQLVEl5f1rPigNuEE2QfRGImWXNxtUtUqhOBCQ-FR1NG3aZP0U4DfS-AeGNng&usqp=CAI

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:806::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c029a62dd0db8acae4dcb0475c391322985f608ab5322241cdc8f1beb4137295

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 19:33:55 GMT
x-content-type-options: nosniff
age: 281824
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27645
x-xss-protection: 0
last-modified: Wed, 04 Aug 2021 02:11:11 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sat, 18 Feb 2023 19:33:55 GMT

GET
H2 200 shopping
encrypted-tbn1.gstatic.com/ Frame 1937 46 KB
47 KB 96ms
20ms Image
image/jpeg 2607:f8b0:4006:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcRhvBvC5kjKMvpi9imRZqRJpjRLb4y5tOaJ7qUpINPE2mRxEgZjQEJnSM5W29E&usqp=CAI

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

829d72817722e405d355555ed468ffb9484c781e4527981ee9240e2cc92b8f14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 16 Feb 2022 02:52:39 GMT
x-content-type-options: nosniff
age: 514700
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47123
x-xss-protection: 0
last-modified: Thu, 18 Mar 2021 02:24:51 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Thu, 16 Feb 2023 02:52:39 GMT

GET
H2 200 shopping
encrypted-tbn2.gstatic.com/ Frame 1937 18 KB
18 KB 136ms
59ms Image
image/jpeg 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcQMzno35dCud-qq3pVafGSKbvZQfsyHysbMQS5408HvWxeABig&usqp=CAI

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

300cd678581c1f04ad918b185f5e75f1b67944339b7e52b008dc8aea9f9f1dfb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 19 Feb 2022 19:07:31 GMT
x-content-type-options: nosniff
age: 197008
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18500
x-xss-protection: 0
last-modified: Wed, 17 Apr 2019 09:55:38 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sun, 19 Feb 2023 19:07:31 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame 8F86 24 KB
24 KB 120ms
52ms Image
image/jpeg 2607:f8b0:4006:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcRTNN-EC6XPuR-4TKDd3TUkYIx3YcAgyT7Y5Cg1aeECmzotDolWFn1D-d4Whw&usqp=CAI

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:806::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8ed0a1bd4eb0ed3301ce027cbbbfc1ab533ec89a81b2446dd053b2b15131eae7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 16 Feb 2022 18:14:25 GMT
x-content-type-options: nosniff
age: 459394
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24258
x-xss-protection: 0
last-modified: Sun, 10 Jan 2021 00:59:03 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Thu, 16 Feb 2023 18:14:25 GMT

GET
H2 200 shopping
encrypted-tbn2.gstatic.com/ Frame 8F86 33 KB
33 KB 109ms
42ms Image
image/jpeg 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcS2IDJufoMlZqKch7sMW55w1Z7w6PSDwq1ipgUXw2b52eHUYC0u3Pt1rjgfww&usqp=CAI

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7672bbc7995d3a3f83002c8042c2c00f758192c570ca5f190496dfa7922dd13a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 08:03:27 GMT
x-content-type-options: nosniff
age: 409652
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33954
x-xss-protection: 0
last-modified: Tue, 30 Mar 2021 05:26:16 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Feb 2023 08:03:27 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame 8F86 27 KB
27 KB 128ms
61ms Image
image/jpeg 2607:f8b0:4006:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcQLVEl5f1rPigNuEE2QfRGImWXNxtUtUqhOBCQ-FR1NG3aZP0U4DfS-AeGNng&usqp=CAI

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:806::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c029a62dd0db8acae4dcb0475c391322985f608ab5322241cdc8f1beb4137295

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 19:33:55 GMT
x-content-type-options: nosniff
age: 281824
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27645
x-xss-protection: 0
last-modified: Wed, 04 Aug 2021 02:11:11 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sat, 18 Feb 2023 19:33:55 GMT

GET
H2 200 shopping
encrypted-tbn1.gstatic.com/ Frame 8F86 46 KB
46 KB 108ms
41ms Image
image/jpeg 2607:f8b0:4006:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcRhvBvC5kjKMvpi9imRZqRJpjRLb4y5tOaJ7qUpINPE2mRxEgZjQEJnSM5W29E&usqp=CAI

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

829d72817722e405d355555ed468ffb9484c781e4527981ee9240e2cc92b8f14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 16 Feb 2022 02:52:39 GMT
x-content-type-options: nosniff
age: 514700
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47123
x-xss-protection: 0
last-modified: Thu, 18 Mar 2021 02:24:51 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Thu, 16 Feb 2023 02:52:39 GMT

GET
H2 200 shopping
encrypted-tbn2.gstatic.com/ Frame 8F86 18 KB
18 KB 130ms
63ms Image
image/jpeg 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcQMzno35dCud-qq3pVafGSKbvZQfsyHysbMQS5408HvWxeABig&usqp=CAI

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

300cd678581c1f04ad918b185f5e75f1b67944339b7e52b008dc8aea9f9f1dfb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 19 Feb 2022 19:07:31 GMT
x-content-type-options: nosniff
age: 197008
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18500
x-xss-protection: 0
last-modified: Wed, 17 Apr 2019 09:55:38 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sun, 19 Feb 2023 19:07:31 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C1B9 1 KB
749 B 58ms
26ms Document
text/html 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Mon, 21 Feb 2022 19:21:13 GMT
expires: Tue, 22 Feb 2022 19:21:13 GMT
cache-control: public, max-age=86400
age: 23386
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 6B2D 1 KB
749 B 52ms
27ms Document
text/html 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Mon, 21 Feb 2022 19:21:13 GMT
expires: Tue, 22 Feb 2022 19:21:13 GMT
cache-control: public, max-age=86400
age: 23386
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame A9BF 0
0 74ms
54ms Image
text/html 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022021401&jk=621539644028560&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81d::2002 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H3 200 amNa6lhdd-Oid2bHU1unpRJ57vx5QG5_ysqcoHUTmoo.js Show response
pagead2.googlesyndication.com/bg/ Frame ACA2 35 KB
13 KB 46ms
29ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/amNa6lhdd-Oid2bHU1unpRJ57vx5QG5_ysqcoHUTmoo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a635aea585d77e3a27766c7535ba7a51279eefc79406e7fcaca9ca075139a8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 21 Feb 2022 20:27:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19417
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13572
x-xss-protection: 0
last-modified: Mon, 14 Feb 2022 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 21 Feb 2023 20:27:22 GMT

GET
DATA 200
OK truncated
/ Frame 1937 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3150efb8d7753652048316a309a576d13cfd401e0a3fdad03e050a9023c5a950

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 8F86 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 341cbeee5137b8d4fa122e468d0fb6e666cbc95b364639013a0eb5b41602c544

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame C1B9
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEMKbeOLaGcFnJa9ag3dJ6Wc&google_cver=1&google_push=AYg5qPKJzYa0PYfYp9wPj_WBMVRL88Afx8Pgs3aQjt0cVpb198Gt3nns6Ws73PLipH-E0rb1lxl-F3EdF-JoaaCXy5k3VojNIY2R&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEMKbeOLaGcFnJa9ag3dJ6Wc&google_cver=1&google_push=AYg5qPKJzYa0PYfYp9wPj_WBMVRL88Afx8Pgs3aQjt0cVpb198Gt3nns6Ws73PLipH-E0rb1lxl-F3EdF-JoaaCXy5k3VojNIY2...

43 B
419 B

106ms
93ms

Image
image/gif

2606:4700::6812:c05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEMKbeOLaGcFnJa9ag3dJ6Wc&google_cver=1&google_push=AYg5qPKJzYa0PYfYp9wPj_WBMVRL88Afx8Pgs3aQjt0cVpb198Gt3nns6Ws73PLipH-E0rb1lxl-F3EdF-JoaaCXy5k3VojNIY2R&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPKJzYa0PYfYp9wPj_WBMVRL88Afx8Pgs3aQjt0cVpb198Gt3nns6Ws73PLipH-E0rb1lxl-F3EdF-JoaaCXy5k3VojNIY2R%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Protocol: H2
Server: 2606:4700::6812:c05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:51:00 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6e14911a3ede7136-YUL
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
content-type: image/gif; charset=utf-8
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:51:00 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 1
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6e149117facd7136-YUL
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEMKbeOLaGcFnJa9ag3dJ6Wc&google_cver=1&google_push=AYg5qPKJzYa0PYfYp9wPj_WBMVRL88Afx8Pgs3aQjt0cVpb198Gt3nns6Ws73PLipH-E0rb1lxl-F3EdF-JoaaCXy5k3VojNIY2R&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPKJzYa0PYfYp9wPj_WBMVRL88Afx8Pgs3aQjt0cVpb198Gt3nns6Ws73PLipH-E0rb1lxl-F3EdF-JoaaCXy5k3VojNIY2R%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control: no-cache, private
content-type: text/html
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK CookieSyncAdX
rtb.adentifi.com/ Frame C1B9 0
88 B 101ms
23ms Image
text/plain 3.208.70.15
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncAdX?google_gid=CAESEJDSCje6R08RSeMbHwI06C4&google_cver=1&google_push=AYg5qPIbRzkxKtqDg9nc1ciAqjX3wAtYAorZYtkNtdTnUgUV9g6ZdiGvqQdtjcfF24WZYLlM0oX-bL714r3O-6qkMk_YKm-hh62x
Requested by: Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.208.70.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-208-70-15.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 0
Content-Type: text/plain

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C1B9
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEJqvSApMhOz4M1AgsAu11Og&google_cver=1&google_push=AYg5qPJZ5WH6tsQWl6cDLWzbsF_qNjBA3V_nbrUgH6GC6cPRRYo-wQoJ2QYkeTDprXIWl7TyLPp3P3A-lB-l3yv...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=jz3vfA4wQhJ2neqoOdQylpU4mbc&google_push=AYg5qPJZ5WH6tsQWl6cDLWzbsF_qNjBA3V_nbrUgH6GC6cPRRYo-wQoJ2QYkeTDprXIWl7TyLPp3P3A-lB-l3y...

170 B
188 B

38ms
37ms

Image
image/png

142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=jz3vfA4wQhJ2neqoOdQylpU4mbc&google_push=AYg5qPJZ5WH6tsQWl6cDLWzbsF_qNjBA3V_nbrUgH6GC6cPRRYo-wQoJ2QYkeTDprXIWl7TyLPp3P3A-lB-l3yvrEATsTkmSNm3P

Protocol

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=jz3vfA4wQhJ2neqoOdQylpU4mbc&google_push=AYg5qPJZ5WH6tsQWl6cDLWzbsF_qNjBA3V_nbrUgH6GC6cPRRYo-wQoJ2QYkeTDprXIWl7TyLPp3P3A-lB-l3yvrEATsTkmSNm3P
Date: Tue, 22 Feb 2022 01:50:59 GMT
Connection: keep-alive
Content-Length: 242
Content-Type: text/html; charset=utf-8

GET

pixel
cm.g.doubleclick.net/ Frame C1B9
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESELUeKXb95YsN1Q2ZzmSDWSk&google_cver=1&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJF...
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESELUeKXb95YsN1Q2ZzmSDWSk&google_cver=1&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C1B9
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEA...
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=AYg5qPL_PWukON-QKCD5MBhz0QX-aDXWAB5byMmA-Ctt1-8VF1SevmTc-ii1OSwEwttZsAogfw9VHZ9kox2pIJ128AOFXCEPD61t&redir=https%3A%2F%2Fcm.g.doubl...
https://sync.targeting.unrulymedia.com/csync/RX-673dd3f2-f25b-4f39-982b-68ec1dae7252-005?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAYg5qPL_PWukON-QKCD5MBhz0...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPL_PWukON-QKCD5MBhz0QX-aDXWAB5byMmA-Ctt1-8VF1SevmTc-ii1OSwEwttZsAogfw9VHZ9kox2pIJ128AOFXCEPD61t&google_hm=BWc90_LyW085mCto7B2uclI

170 B
188 B

37ms
36ms

Image
image/png

142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPL_PWukON-QKCD5MBhz0QX-aDXWAB5byMmA-Ctt1-8VF1SevmTc-ii1OSwEwttZsAogfw9VHZ9kox2pIJ128AOFXCEPD61t&google_hm=BWc90_LyW085mCto7B2uclI

Protocol

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:51:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 22 Feb 2022 01:51:00 GMT
Server: Tengine
ETag: RX673dd3f2f25b4f39982b68ec1dae7252005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPL_PWukON-QKCD5MBhz0QX-aDXWAB5byMmA-Ctt1-8VF1SevmTc-ii1OSwEwttZsAogfw9VHZ9kox2pIJ128AOFXCEPD61t&google_hm=BWc90_LyW085mCto7B2uclI
Connection: keep-alive
Content-Type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C1B9
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEMRFSnHscxOjp4_o150gNrY&google_cver=1&google_push=AYg5qPKnwBAooDOsLL7Ph_V7GNZ3WB4-EAE4daKBmL3zzNA95ndgddG9OQs7oqVNysrX1qdiIhGR6i...
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPKnwBAooDOsLL7Ph_V7GNZ3WB4-EAE4daKBmL3zzNA95ndgddG9OQs7oqVNysrX1qdiIhGR6ijFBVF3KELdG--Vkh2SA7pl&google_hm=MjI5MTIwMD...

170 B
188 B

39ms
38ms

Image
image/png

142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPKnwBAooDOsLL7Ph_V7GNZ3WB4-EAE4daKBmL3zzNA95ndgddG9OQs7oqVNysrX1qdiIhGR6ijFBVF3KELdG--Vkh2SA7pl&google_hm=MjI5MTIwMDI0MTkyNDYyNDE1Mw%3D%3D

Protocol

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:51:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPKnwBAooDOsLL7Ph_V7GNZ3WB4-EAE4daKBmL3zzNA95ndgddG9OQs7oqVNysrX1qdiIhGR6ijFBVF3KELdG--Vkh2SA7pl&google_hm=MjI5MTIwMDI0MTkyNDYyNDE1Mw%3D%3D
date: Tue, 22 Feb 2022 01:50:59 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C1B9
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEPWzLHnPNxANe-HSYMWCJ4k&google_cver=1&google_push=AYg5qPKNlGV_xlLEtMeclfQWPOaChigfVk4nrJGu9RTsi7H1jOvEDnaVSsusTgzPkl2YIg0jIYn5TXuqEzfVu8cub...
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MzdmMjVmNDctZmNiNC00N2ZjLTk2ZWYtN2VmMzhjZmY0MjYy&google_push=AYg5qPKNlGV_xlLEtMeclfQWPOaChigfVk4nrJGu9RTsi7H1jOvEDnaVSsusTgzP...

170 B
188 B

39ms
38ms

Image
image/png

142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MzdmMjVmNDctZmNiNC00N2ZjLTk2ZWYtN2VmMzhjZmY0MjYy&google_push=AYg5qPKNlGV_xlLEtMeclfQWPOaChigfVk4nrJGu9RTsi7H1jOvEDnaVSsusTgzPkl2YIg0jIYn5TXuqEzfVu8cubaEJpYvcs89E8g

Protocol

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MzdmMjVmNDctZmNiNC00N2ZjLTk2ZWYtN2VmMzhjZmY0MjYy&google_push=AYg5qPKNlGV_xlLEtMeclfQWPOaChigfVk4nrJGu9RTsi7H1jOvEDnaVSsusTgzPkl2YIg0jIYn5TXuqEzfVu8cubaEJpYvcs89E8g
date: Tue, 22 Feb 2022 01:50:59 GMT
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C1B9 0
12 B 35ms
34ms Image
text/html 142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Ldneo49zOTfPBrkBbDb3w0Fjvgo_AFYfEKlTcg89N3Pu8erK2ZJd64RkLv9bOS4DzgHvpwaw

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:59 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6B2D
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEDA_ikeK12kWgXwxF9mYRU8&google_cver=1&google_push=AYg5qPJHSTNPtcSFiGaERIJlytRXHiJo2YqKU6a2l67ME75i0t0kzzt0y9...
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AYg5qPJHSTNPtcSFiGaERIJlytRXHiJo2YqKU6a2l67ME75i0t0kzzt0y9tYgn1Hi7gIucIYZJezjmnzrNNSwNiLQ0hzBFj9NpqE&google_hm=9NSVRZ...

170 B
188 B

36ms
36ms

Image
image/png

142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AYg5qPJHSTNPtcSFiGaERIJlytRXHiJo2YqKU6a2l67ME75i0t0kzzt0y9tYgn1Hi7gIucIYZJezjmnzrNNSwNiLQ0hzBFj9NpqE&google_hm=9NSVRZjINeOUJwklYMfdUg

Protocol

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:59 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AYg5qPJHSTNPtcSFiGaERIJlytRXHiJo2YqKU6a2l67ME75i0t0kzzt0y9tYgn1Hi7gIucIYZJezjmnzrNNSwNiLQ0hzBFj9NpqE&google_hm=9NSVRZjINeOUJwklYMfdUg
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1 200
OK CookieSyncAdX
rtb.adentifi.com/ Frame 6B2D 0
88 B 109ms
23ms Image
text/plain 3.208.70.15
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncAdX?google_gid=CAESEJDSCje6R08RSeMbHwI06C4&google_cver=1&google_push=AYg5qPIex6gHYmDa8azxOlof2L_g8CZaCDqHrgi6c5NpvUP4HmwPtVlYbf17kyk5q6lDcG0jR08TVzWo0_9SLEpm3J1JY8kSwlkI
Requested by: Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.208.70.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-208-70-15.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 0
Content-Type: text/plain

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6B2D
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEGZCl21SKlC5tpNuyI4NdgM&google_cver=1&google_push=AYg5qPLCIxluxAFN4qqhxDF1Ll99JRY9S7ZJzOH08lIgT-vqNjY-yscyUeBy6-rh5oG5u1smstTuLUeG...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTQ2Njk5NjIwMDYyMDc5MTU2&google_push=AYg5qPLCIxluxAFN4qqhxDF1Ll99JRY9S7ZJzOH08lIgT-vqNjY-yscyUeBy6-rh5oG5u1smstTuLUeG...

170 B
188 B

39ms
37ms

Image
image/png

142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTQ2Njk5NjIwMDYyMDc5MTU2&google_push=AYg5qPLCIxluxAFN4qqhxDF1Ll99JRY9S7ZJzOH08lIgT-vqNjY-yscyUeBy6-rh5oG5u1smstTuLUeGXIOudccQ1_bN-JE5Mx0

Protocol

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:59 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTQ2Njk5NjIwMDYyMDc5MTU2&google_push=AYg5qPLCIxluxAFN4qqhxDF1Ll99JRY9S7ZJzOH08lIgT-vqNjY-yscyUeBy6-rh5oG5u1smstTuLUeGXIOudccQ1_bN-JE5Mx0
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6B2D
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEJqvSApMhOz4M1AgsAu11Og&google_cver=1&google_push=AYg5qPK1B_u3mYjdDdMP6TLs1eiLZ-GsfN6xZL0LWuKxeXYvuIwVWAKDRD8LevMCBAce5NhVOzl-MYyLKPG9vSM...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=jz3vfA4wQhJ2neqoOdQylpU4mbc&google_push=AYg5qPK1B_u3mYjdDdMP6TLs1eiLZ-GsfN6xZL0LWuKxeXYvuIwVWAKDRD8LevMCBAce5NhVOzl-MYyLKPG9vS...

170 B
188 B

37ms
37ms

Image
image/png

142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=jz3vfA4wQhJ2neqoOdQylpU4mbc&google_push=AYg5qPK1B_u3mYjdDdMP6TLs1eiLZ-GsfN6xZL0LWuKxeXYvuIwVWAKDRD8LevMCBAce5NhVOzl-MYyLKPG9vSMVa-IYYgNqlq3x

Protocol

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=jz3vfA4wQhJ2neqoOdQylpU4mbc&google_push=AYg5qPK1B_u3mYjdDdMP6TLs1eiLZ-GsfN6xZL0LWuKxeXYvuIwVWAKDRD8LevMCBAce5NhVOzl-MYyLKPG9vSMVa-IYYgNqlq3x
Date: Tue, 22 Feb 2022 01:50:59 GMT
Connection: keep-alive
Content-Length: 242
Content-Type: text/html; charset=utf-8

GET

pixel
cm.g.doubleclick.net/ Frame 6B2D
Redirect Chain

https://onetag-sys.com/sync/i,19/?google_gid=CAESEFWBgVV1OEvDQTnebVFvutw&google_cver=1&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6B2D
Redirect Chain

https://ads.yieldmo.com/exptsync?google_gid=CAESECdLDKyTVQeTa-RuvFx-aA0&google_cver=1&google_push=AYg5qPLOsDqy-eUShripw8CA4nLyXutUhbec0zti8hV1kSVauCiObQJbuQPdpM_E_BMr0UmYWCR0TlLkmrSxO3g-BJvg9y1CS2gr
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AYg5qPLOsDqy-eUShripw8CA4nLyXutUhbec0zti8hV1kSVauCiObQJbuQPdpM_E_BMr0UmYWCR0TlLkmrSxO3g-BJvg9y1CS2gr&google_hm=Zzg2ZTA0ODYyYTllNmFl...

170 B
188 B

37ms
36ms

Image
image/png

142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AYg5qPLOsDqy-eUShripw8CA4nLyXutUhbec0zti8hV1kSVauCiObQJbuQPdpM_E_BMr0UmYWCR0TlLkmrSxO3g-BJvg9y1CS2gr&google_hm=Zzg2ZTA0ODYyYTllNmFlZDEwYzM=

Protocol

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:50:59 GMT
location: https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AYg5qPLOsDqy-eUShripw8CA4nLyXutUhbec0zti8hV1kSVauCiObQJbuQPdpM_E_BMr0UmYWCR0TlLkmrSxO3g-BJvg9y1CS2gr&google_hm=Zzg2ZTA0ODYyYTllNmFlZDEwYzM=
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 6B2D 0
12 B 38ms
34ms Image
text/html 142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JTePA3rpAC2HHj3sRXbI6SSW-50Ot7X3f4UqK6WRSxT9w5G-AlUX4GV4ubNhvvBQ

Requested by

Host: 1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
URL: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:59 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame ACA2 0
9 B 20ms
20ms Image
text/plain 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?7rJyeQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80d::2001 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 83ms
83ms Image
image/gif 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gpt_2022021401&jk=621539644028560&bg=!MTKlMnbNAAbf-5Dq3_s7ACkAdvg8WnQrdTYpKzWngJI4wL8v6MDUbVsKs0Yz_eRgCM0SefXftIgh1AIAAAEFUgAAAAJoAQeZAt0RnkgLBTfO2OJI9fAi1emK2iK4Pon4sUKhhK6sGsB6hJl22hv2Sx0brDMFZ4UdBZ-0NTt6vTFPH5tbrpyA4UG0B2TT23ujJ5QvTiox0hI-LAtp5kaCPgUiYitq9OrCSLjF54dzNFB7tLB92kDE2T6mA9EvHtN3o9Tm4hOOXhQwQa7nVWgf320Xnq6LgLG3fIR5tmS_TtI7YBJMHkT4RF3mFYlIlTitX-bw2TXmBohBy7B8I-6sUDr-kQpHc-Mi2Z40NwBjICsIF9F7K0H9czgD78MMm5nmPahuoetvj7S2e3JjzN-zjh7mxeqhjtLrxr9VYOLaK6cx76wbqge6Fv-48OjyxnRea-z1OJ9ShoLgkWHGZhzsznLWygrHKdgjNYDFulUqmXJyDGA81PCl657W9hmx7opU9EbsrjyX80fb6sxOdYWT0L9-y2_GAVxgRsbLklUI8-DTDNcaNJTbCuWn0NYISMjo86TY2Z5skiExQXeLvZo0kx3K_VVhBNSLeNfuMwQjm6v2EZUlU1EqfF-bWo6xzGmTdFd-q70XN5Cuw15u02K2LwTDMx34mHtkdW0DlYiBOehjZkM3MCnNPTzgV2q5lansWbS-v86SjqHi6j2TJzTqD1tRdvsPfv9uF61fNpfdZNdVl5I02X50H40-BRhHCtU8JvF6CLZh5DDKupCCuqw28LyIYtCOg0Yd5y4ts1tZUe9CeFkK8XZ2uI4dfZnVe902obSPZrlKrA2nmEO3C8U8H2SyO4DtEA3U8pWA2Ky0Vdcr6q1c7uHVLfy_Wo7raOoxj0GOdVkSgURMM1cVbl0V7MnUyNIOhFVuQ1oigxMchBQOAnLtdqrMUGsWzdECKgShL1H6DUxiQB13szCHwnNeKUxE23Bmb7CnMr3V5haZKqjOeGxc6rtcfqsOkZRP_t9w-otEgZQRKEvKtz28f2Stn39aBNO_-zEI0kTzjksQmrsdU-VsX52B

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:51:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 525C 0
260 B 67ms
23ms Script
text/plain 104.36.115.114
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156011&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.114 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 22 Feb 2022 01:50:59 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 8F86 42 B
64 B 87ms
56ms Fetch
image/gif 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuKUaADnddP_az7abhr9sJZdjELtAvduG5GuHeYhDMvje0jSIta2Z4rCeCzmYoTSfXEwfPD-3RuGqCxArv7Fo-A3673eM5xGhvBghu2jNCrJ69HJQA&sai=AMfl-YQK8VLsZTeGtJcUS7Fynrkwb3R7KwyflSwujDLc0qM4144xl9tAD9xaHAefhH_-M7PptG7Z6w_7H90T9NhX4Yi0u_y1zPqJwBbmEChHo0Xa12fwv_lmkG3aXGvkzgt5hh4eM2DonhLDEarxv6U1&sig=Cg0ArKJSzHsTrRF--0UWEAE&cid=CAASFeRoPCjzmKpA7_0WZ30-1brhDLYpQg&id=lidar2&mcvt=1001&p=441,315,691,1285&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20220216&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=1960150758&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1645494659317&rpt=478&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:51:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 1937 42 B
64 B 85ms
56ms Fetch
image/gif 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssCe0jhFpqJGoZb4R6eYYjLcgOOoom5dgzNHzdR484PjSnPl68R5R85kEVTMegjX02PfbEzaDsrvCj10KUQndkyPUIbbSuA2IXvPDq27lC8B-9IRko&sai=AMfl-YQvGdy6bbP83xLbRpX-do17DSOyRqZLh7t3GyAyXte0aoRY0d0UIuscfWP0GD9B2BFyYTFPZNvXBoEmFM9aH_4UdEFYS5z9wp25SRj3n2HqOxGLEfwiPntHgdaa4xQIOoHsjtlWEgViLyR1Lj-J&sig=Cg0ArKJSzJ-ktDl78TL4EAE&cid=CAASFeRoyX28MGisM4yfYpXCf0u1p-qpqw&id=lidar2&mcvt=1004&p=108,315,358,1285&mtos=1004,1004,1004,1004,1004&tos=1004,0,0,0,0&v=20220216&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=625928897&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1645494659289&rpt=497&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Feb 2022 01:51:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 202 events Show response
jssdks.mparticle.com/v3/JS/us1-a9588c0ddc27594cabd152e47ffe27ee/ 41 B
286 B 64ms
30ms Fetch
application/json 2a04:4e42:200::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://jssdks.mparticle.com/v3/JS/us1-a9588c0ddc27594cabd152e47ffe27ee/events
Requested by: Host: jssdkcdns.mparticle.com
URL: https://jssdkcdns.mparticle.com/js/v2/us1-a9588c0ddc27594cabd152e47ffe27ee/mparticle.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:200::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Kestrel /
Resource Hash: d56935b6d90bfda04a229bcfb4a446661b821c4828ecbf1b403cb89355ca0a4b

Request headers

Accept: text/plain;charset=UTF-8
Referer: https://revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 22 Feb 2022 01:51:03 GMT
content-encoding: gzip
server: Kestrel
x-timer: S1645494663.997396,VS0,VE16
x-origin-name: 7arPuRjnqGEhiMyprEtnLk--F_us1_origin
x-served-by: cache-yul12834-YUL
vary: Accept-Encoding
x-cache: MISS
content-type: application/json
access-control-allow-origin: *
accept-ranges: bytes
via: 1.1 varnish
x-cache-hits: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ

Verdicts & Comments Add Verdict or Comment

83 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

109 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/	1970-01-20 01:14:59	Name: x-id Value: {"data":{"id":"ko82gzrx75mo4wg2z634pvcqpar9u8wq","updated":1645494657462},"exp":604800000,"ts":1645494657480,"mac":105554593}
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/	1970-01-20 01:04:54	Name: __adblocker Value: false
pmd-dev-frontend-modules.s3.amazonaws.com/	1970-01-20 01:14:59	Name: x-id Value: {"data":{"id":"ko82gzrx75mo4wg2z634pvcqpar9u8wq","updated":1645494657462},"exp":604800000,"ts":1645494657787,"mac":105644183}
.postmedia.digital/	1970-01-20 03:14:30	Name: _gcl_au Value: 1.1.1585089914.1645494658
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/	1970-01-20 01:14:59	Name: political-ad-opt-out Value: {"data":false,"exp":604800000,"ts":1645494657841,"mac":-1637861423}
.scorecardresearch.com/	1970-01-20 18:21:42	Name: UID Value: 157a231a06046e6e27eefbd1645494657
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/	1970-01-20 01:04:56	Name: sailthru_pageviews Value: 1
.krxd.net/	1970-01-20 05:24:06	Name: _kuid_ Value: OrUX-sy2
.postmedia.digital/	1970-01-20 09:50:30	Name: mprtcl-v4_767FC2FC Value: {'gs':{'ie':1\|'dt':'us1-a9588c0ddc27594cabd152e47ffe27ee'\|'av':'1.0.0'\|'cgid':'91cf7d55-517e-46ee-b450-31b8f01a59cb'\|'das':'e2e31b9c-fefd-4bd8-ad01-18afd1fcb01f'\|'csm':'WyI2MTIwNjAwODcyMTE4NDA0MTg4Il0='\|'sid':'73B484BA-DECD-4B44-994D-96B4DD675EBB'\|'les':1645494657976\|'ssd':1645494657831}\|'l':1\|'6120600872118404188':{'fst':1645494657944\|'ui':'eyIwIjoia284Mmd6cng3NW1vNHdnMno2MzRwdmNxcGFyOXU4d3EifQ=='}\|'cu':'6120600872118404188'}
.everesttech.net/	1970-01-20 09:50:30	Name: everest_g_v2 Value: g_surferid~YhRBggAH9Y6JOwAy
.postmedia.digital/	1970-01-20 03:14:30	Name: _fbp Value: fb.1.1645494658086.921559624
.rfihub.com/	1970-01-20 10:26:30	Name: rud Value: H4sIAAAAAAAAAOMSsjSzMDAzsjAyN7c0MTYxNDY1EeIz1LUwNQ1I9MwtCHa1jJTiNTQzMTWxNDEztTCwMAQATtq-CDMAAAA
.rfihub.com/	1970-01-20 10:26:30	Name: eud Value: H4sIAAAAAAAAAGsS5DU0MzE1sTQxM7UwsDAEAAJjMxMQAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAAAOMSsjSzMDAzsjAyN7c0MTYxNDY1EeIz1LUwNQ1I9MwtCHa1jAQAAUheLCQAAAA
.creativecdn.com/	1970-01-20 09:50:30	Name: u Value: 5BNFHJJ9IAgWdjiYNVgr
.creativecdn.com/	1970-01-20 09:50:30	Name: ts Value: 1645494658
.linkedin.com/	1970-01-20 03:14:30	Name: li_sugr Value: 0a1a0b4c-4091-4d5c-8c01-2a6297267836
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 18:36:48	Name: bcookie Value: "v=2&d44cb5f1-eb48-4506-81be-a94cd52ea2f7"
.sharethrough.com/	1970-01-20 09:50:30	Name: stx_user_id Value: 37f25f47-fcb4-47fc-96ef-7ef38cff4262
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital/	1970-01-20 09:50:30	Name: sailthru_visitor Value: 3eefd35b-ab9f-4090-ad9b-99115bbfa64a
sync.srv.stackadapt.com/	1970-01-20 09:50:30	Name: sa-user-id Value: s%3A0-8f3def7c-0e30-4212-769d-eaa839d43296.oY%2BWTwGpRZHB1axDeYrswQEFIwSVz8C0g1w7assyOwA
.srv.stackadapt.com/	1970-01-20 09:50:30	Name: sa-user-id-v2 Value: s%3Ajz3vfA4wQhJ2neqoOdQylpU4mbc.iqw4NYytOznGLFcow%2BpOqoCj3Rt67tW6U2VmRKu9tgs
.t.co/	1970-01-20 18:36:06	Name: muc_ads Value: ce71e408-bdba-43fc-8c85-44683b33fcad
.facebook.com/	1970-01-20 03:14:30	Name: fr Value: 0b028Kak82uDCyStT..BiFEGC...1.0.BiFEGC.
.linkedin.com/	1970-01-20 01:48:06	Name: UserMatchHistory Value: AQJ2xZG34jNs6QAAAX8fH-Rwq-nfoJVuQ7YxVjOJghsc8sKYU6tg7N8axDQdmQIpAtgE97kLgaXIkQ
.linkedin.com/	1970-01-20 01:48:06	Name: AnalyticsSyncHistory Value: AQLbWA8UTESnTwAAAX8fH-RwAEtUqEkwB6ySzKCmHL515pEkc_I9kYvPV2IigU5CAhJgcQcSCfLnpp-wpyKnVA
.twitter.com/	1970-01-20 18:36:06	Name: personalization_id Value: "v1_/JrAQekK4FOdqJwyCE5LYw=="
.doubleclick.net/	1970-01-20 18:36:06	Name: IDE Value: AHWqTUmiUtrgbx2kc-wg0qlBoTdsoJpK7I8rrCIVJPMZ2w5MuI-jcNufHh1BjHeX6dg
.casalemedia.com/	1970-01-20 09:50:30	Name: CMID Value: YhRBgtM0cBpKPoSUl4Qz5QAA
.casalemedia.com/	1970-01-20 03:14:30	Name: CMPS Value: 465
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.www.linkedin.com/	1970-01-20 18:36:48	Name: bscookie Value: "v=1&202202220150588a1d8f99-e6c8-48dc-8c5d-2dde5ce7b28dAQG9BJOwe-93pYNW9q3hj1fVHkOMWFfW"
.casalemedia.com/	1970-01-20 03:14:30	Name: CMPRO Value: 042
.casalemedia.com/	1970-01-20 01:06:21	Name: CMST Value: YhRBgmIUQYIA
.ml314.com/	1970-01-20 01:04:54	Name: u Value: aHR0cHM6Ly9jZG4ua3J4ZC5uZXQvcGFydG5lcmpzL3hkaS9wcm94eS4zZDIxMDBmZDcxMDcyNjJlY2I1NWNlNjg0N2YwMWZhNS5odG1sIyFreGNpZD11dGh0eG1kZGcma3h0PWh0dHBzJTNBJTJGJTJGcmV2ZXJ0LWNoZWV0LTM4OTgtb250YXJpb2Zhcm1lci5nZGV2LnBvc3RtZWRpYS5kaWdpdGFsJmt4Y2w9Y2RuJmt4cD0=
.ml314.com/	1970-01-20 09:50:30	Name: pi Value: 3625308949374304293
.mathtag.com/	1970-01-20 10:30:49	Name: uuid Value: 2d386214-4182-4d00-a150-6a33a1aba1d8
.amazon-adsystem.com/	1970-01-20 06:23:09	Name: ad-id Value: A5K-4cTqd0ALrkuKFf49uKo
.amazon-adsystem.com/	1970-01-21 21:49:04	Name: ad-privacy Value: 0
.3lift.com/	1970-01-20 03:14:30	Name: tluid Value: 1084003074738852891507
.bidr.io/	1970-01-20 10:33:24	Name: bito Value: AADHsE7EKIMAAH5eVhizbg
.bidr.io/	1970-01-20 10:33:24	Name: bitoIsSecure Value: ok
.linkedin.com/	1970-01-20 01:06:21	Name: lidc Value: "b=VGST01:s=V:r=V:a=V:p=V:g=2542:u=1:x=1:i=1645494658:t=1645581058:v=2:sig=AQGogorjGklC6EuqLZaqDEJflS15Und3"
.openx.net/	1970-01-20 09:50:30	Name: i Value: 749c342c-9a39-00e8-09bd-c869de8d7e03\|1645494658
.districtm.io/	1970-01-20 01:30:49	Name: _dm_uid Value: eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOjEwMDAwLCJ1c3IiOiJxZ2FiQWJJR0d6STFVbVk0UlROeFJsVmxlakJCZFUxbFJ6QTFSM3BCU1ZWaGI3b0dGUWlnVGhJUVdXaFNRbWRuUVVnNVdUWktUM2RCZWJvR0lBaXFUaEliYW5vemRtWkJOSGRSYUVveWJtVnhiMDlrVVhsc2NGVTBiV0pqdWdZWkNLdE9FaFExUWs1R1NFcEtPVWxCWjFka2FtbFpUbFpuY3JvR0F3aXVUcm9HQXdpd1Ryb0dGd2pJVGhJU09UWTRNRFl5T0RJM056azBNelF4TXpVMCIsImlhdCI6MTY0NTQ5NDY1OH0.IVM_IXzlzFPZNEngtPwKpK5uTV60vJoFfqm5EtlTdwWUNvWklrtO3Pp2aYS51jH3azzba6xmZvigAtSs9s_-Eg
.agkn.com/	1970-01-20 09:50:30	Name: ab Value: 0001%3AALdkD0o63Z1H3Oubm2rnjGbFJj2qV3G1
.lijit.com/	1970-01-20 09:50:30	Name: ljt_reader Value: da7ec15180eaa86010a10906
.openx.net/	1970-01-20 01:26:30	Name: pd Value: v2\|1645494658\|vMgakWgyiK
.adnxs.com/	1970-01-20 03:14:30	Name: uuid2 Value: 1032252883967861238
.lijit.com/	1970-01-20 09:50:30	Name: ljtrtbexp Value: eJyrVjKxVLIyNDMxMzcwMTK10FGyMEHjm6PyjaB8A0tLExDfxBhZvhYAn5QQdw%3D%3D
.adsrvr.org/	1970-01-20 09:50:30	Name: TDID Value: 25982a9f-10af-4049-96e3-31137c201343
.sitescout.com/	1970-01-20 09:50:30	Name: ssi Value: c76cc6fd-c0a8-4e5c-bb32-40044772f910#1645494658552
.rubiconproject.com/	1970-01-20 09:50:30	Name: khaos Value: KZXH18GE-1W-1EA2
.adsymptotic.com/	1970-01-20 03:14:30	Name: U Value: 4f38d581827d609c7356f94be1ac2da5
.sitescout.com/	1970-01-20 01:48:06	Name: _ssuma Value: eyI0MSI6MTY0NTQ5NDY1ODU5OH0
.openx.net/	1970-01-20 01:26:30	Name: univ_id Value: 537072971\|25982a9f-10af-4049-96e3-31137c201343\|1645494658644651
.yahoo.com/	1970-01-20 09:50:52	Name: A3 Value: d=AQABBIJBFGICEI9g3-Y3UrQzayEF8cRUvuEFEgEBAQGTFWIeYgAAAAAA_eMAAA&S=AQAAArAVz60QrYdxSNibL-Lmsn0
.pubmatic.com/	1970-01-20 03:14:30	Name: KADUSERCOOKIE Value: F5442E89-17F3-44B7-B527-DBDE7BA68DD7
.pubmatic.com/	1970-01-20 03:14:30	Name: chkChromeAb67Sec Value: 1
.pubmatic.com/	1970-01-20 01:06:21	Name: pi Value: 156011:2
.pubmatic.com/	1970-01-20 03:14:30	Name: DPSync3 Value: 1646697600%3A201_197%7C1646092800%3A164%7C1645574400%3A174
.pubmatic.com/	1970-01-20 03:14:30	Name: SyncRTB3 Value: 1646697600%3A21_13_22_54_220%7C1646092800%3A2
.quantserve.com/	1970-01-20 10:35:09	Name: mc Value: 62144182-a3de4-be26d-2d878
.lijit.com/	1970-01-20 09:50:30	Name: _ljtrtb_27 Value: 25982a9f-10af-4049-96e3-31137c201343
.contextweb.com/	1970-01-20 09:43:18	Name: V Value: f6fydBPfVMDA
.contextweb.com/	1970-01-20 09:50:30	Name: pb_rtb_ev Value: 3-1cb8\|7dW.0.1
bh.contextweb.com/	1969-12-31 23:59:59	Name: INGRESSCOOKIE Value: d5ae63ca09970f5d
.mfadsrvr.com/	1970-01-20 18:36:06	Name: tuuid Value: 5eee8e08-b4d2-47c8-8287-d54394a5c299
.mfadsrvr.com/	1970-01-20 18:36:06	Name: c Value: 1645494658
.mfadsrvr.com/	1970-01-20 18:36:06	Name: tuuid_lu Value: 1645494658
.lijit.com/	1970-01-20 09:50:30	Name: _ljtrtb_43 Value: ja_3JY-s_iOW_PV13qnrc96v8HWWr6IpjKXQsrg9
.adsrvr.org/	1970-01-20 09:50:30	Name: TDCPM Value: CAEYBSACKAIyCwiYjLyNkOy6OhAFOAE.
.lijit.com/	1970-01-20 09:50:30	Name: _ljtrtb_49 Value: f6fydBPfVMDA
.lijit.com/	1970-01-20 09:50:30	Name: _ljtrtb_84 Value: c:a643638e815cf4bb0d313e32e48c12ab
.mfadsrvr.com/	1970-01-20 18:36:06	Name: ssh Value: !sovrn,1645494658
.mathtag.com/	1970-01-20 01:48:06	Name: mt_mop Value: 9:1645494658
.rlcdn.com/	1970-01-20 02:31:18	Name: pxrc Value: CIKD0ZAGEgUI6EcQAA==
.lijit.com/	1970-01-20 09:50:30	Name: ljtrtb Value: eJwNyr0KwjAQAOB3udlALndNc90sDv4g1qXVqaRpInYQbUEQ8d3N%2BvF9gQUqSDZ9xrpJ7XGzhhWYMpspxBkvSaH2SbFmUWIjKUKkMhiNxJSv43xD5S2TJRcdFiHxMOiRkCKZyC6g8UOeuVcw%2BZ72V7X091PXNy3S6zEHsW%2B37brZ7p7T4XJe5pvA7w%2FFvilL
.lijit.com/	1970-01-20 09:50:30	Name: _ljtrtb_87 Value: 5eee8e08-b4d2-47c8-8287-d54394a5c299
.rubiconproject.com/	1970-01-20 09:50:30	Name: audit Value: 1\|3y/kTqotxoa2NHa6YMr+L96RwzS+X24UaBn8PAY3qHgeECEUBMheipno/iRff8R48/Tq9lNKkv8kEa5N2k7U1SEEFoCDRlfY38xmjE6FV7cfT2Ec3ZV8ILAbPl5aw//S3OlDu/ORdD8=
.pubmatic.com/	1970-01-20 01:48:06	Name: KRTBCOOKIE_377 Value: 6810-25982a9f-10af-4049-96e3-31137c201343&KRTB&22918-25982a9f-10af-4049-96e3-31137c201343&KRTB&23031-25982a9f-10af-4049-96e3-31137c201343
.pubmatic.com/	1970-01-20 03:14:30	Name: PUBMDCID Value: 2
.pubmatic.com/	1970-01-20 01:48:06	Name: KRTBCOOKIE_218 Value: 4056-YhRBggAH9Y6JOwAy&KRTB&22978-YhRBggAH9Y6JOwAy&KRTB&23194-YhRBggAH9Y6JOwAy&KRTB&23209-YhRBggAH9Y6JOwAy
.pubmatic.com/	1970-01-20 01:48:06	Name: SPugT Value: 1645494659
.pubmatic.com/	1970-01-20 01:48:06	Name: KRTBCOOKIE_80 Value: 22987-CAESEGOWN_jMTikL_CdbmFUi3lM&KRTB&16514-CAESEGOWN_jMTikL_CdbmFUi3lM&KRTB&23025-CAESEGOWN_jMTikL_CdbmFUi3lM
.simpli.fi/	1970-01-20 09:51:57	Name: suid Value: 4DC78985468648D4B1B4F7DEDE93899D
.pippio.com/	1970-01-20 09:50:30	Name: did Value: 6RIddbMvEO--s5LW
.pippio.com/	1970-01-20 09:50:30	Name: didts Value: 1645494658
.pippio.com/	1970-01-20 02:31:18	Name: nnls Value:
.adform.net/	1970-01-20 01:45:13	Name: C Value: 1
.pubmatic.com/	1970-01-20 01:48:06	Name: KRTBCOOKIE_148 Value: 19421-uid:4DC78985468648D4B1B4F7DEDE93899D
.adform.net/	1970-01-20 02:31:18	Name: uid Value: 546699620062079156
.pippio.com/	1970-01-20 02:31:18	Name: pxrc Value: CIKD0ZAGEgQIAhAAEgYI7OsBEAA=
.linksynergy.com/	1970-01-20 09:50:30	Name: rmuid Value: 71ae591f-056f-461a-851c-4f2962414785
.linksynergy.com/	1970-01-20 09:50:30	Name: icts Value: 2022-02-22T01:50:59Z
.turn.com/	1970-01-20 05:24:06	Name: uid Value: 7255204550680405259
.pubmatic.com/	1970-01-20 01:48:06	Name: KRTBCOOKIE_22 Value: 14911-7255204550680405259
.pubmatic.com/	1970-01-20 01:48:06	Name: PugT Value: 1645494659
.rlcdn.com/	1970-01-20 09:50:30	Name: rlas3 Value: ploz9dPlvcF7fEtMuPBB2C9s/VyGXO+oanmiWnW+Y+w=
.postmedia.digital/	1970-01-20 10:26:30	Name: __gads Value: ID=bf160d74b5ee4675:T=1645494658:S=ALNI_MZjDiCqhGEhhG0H8dhRjDGNdn8IxA
.quantserve.com/	1970-01-20 03:14:30	Name: d Value: EB4BEAHAJYEM6owQ
.360yield.com/	1970-01-20 03:14:30	Name: tuuid Value: e4114c80-195e-44d8-823e-c7f941509453
.360yield.com/	1970-01-20 03:14:30	Name: tuuid_lu Value: 1645494659
.yieldmo.com/	1970-01-20 09:50:30	Name: yieldmo_id Value: g86e04862a9e6aed10c3%7C1645494659904%7C0%7C
.1rx.io/	1970-01-20 09:50:30	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-673dd3f2-f25b-4f39-982b-68ec1dae7252-005%22%7D
.smartadserver.com/	1970-01-20 10:35:09	Name: pid Value: 2291200241924624153
.targeting.unrulymedia.com/	1970-01-20 09:50:30	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-673dd3f2-f25b-4f39-982b-68ec1dae7252-005%22%7D
.tribalfusion.com/	1970-01-20 03:14:30	Name: ANON_ID Value: aXnseFOZb3VhUEjUAvMia2cBtvh5oagZaXa33GUnosZcdTZab94av2ZdUodQ2ZbXBsywjZd63IlJfTke00AZaBcJyBem

12 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.googleadservices.com/pagead/conversion_async.js(Line 71) Message: Unrecognized feature: 'attribution-reporting'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
network	error	URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=25982a9f-10af-4049-96e3-31137c201343&gdpr=0&gdpr_consent=&expires=30 Message: Failed to load resource: the server responded with a status of 422 (Unprocessable Entity)
network	error	URL: https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=2d386214-4182-4d00-a150-6a33a1aba1d8&expires=28 Message: Failed to load resource: the server responded with a status of 422 (Unprocessable Entity)
network	error	URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6483038817428292933 Message: Failed to load resource: the server responded with a status of 422 (Unprocessable Entity)
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPI0m8gxKXQX6dLv5g9H6SoUwkG7auD8E5ypreUhi5wUlvT4NPNOh9sMfqDHXb2MC2ehovQ8YUGJPhZehDEB9LG2gUIK35GZ Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=5BFMgBleRNiCPsf5QVCUUw&google_push=AYg5qPJU_mPtgh08PRQEpML_-otFJQf7luRQF2ULKmvjqDYG-Y0r2qn1ZYdF2TUgvsTOJnn6zXrQyvPn6zUub4y_-RtpJFMAYfE Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1e83db0db5a13c2d655f202e80d2b711.safeframe.googlesyndication.com
a.tribalfusion.com
aa.agkn.com
ad.turn.com
ads.pubmatic.com
ads.yahoo.com
ads.yieldmo.com
adservice.google.ca
adservice.google.com
ak.sail-horizon.com
analytics.twitter.com
aorta.clickagy.com
ap.lijit.com
api.sail-personalize.com
assets.ribn.com
auth.lrcontent.com
beacon.krxd.net
bh.contextweb.com
c.amazon-adsystem.com
c1.adform.net
cdn.adsafeprotected.com
cdn.districtm.io
cdn.krxd.net
ce.lijit.com
cm.g.doubleclick.net
cms.quantserve.com
connect.facebook.net
consumer.krxd.net
data.adsrvr.org
dmx.districtm.io
dmx.us-east-33.districtm.io
eb2.3lift.com
encrypted-tbn1.gstatic.com
encrypted-tbn2.gstatic.com
encrypted-tbn3.gstatic.com
eus.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
hb.districtm.io
ib.adnxs.com
id.rlcdn.com
identity.mparticle.com
idsync.rlcdn.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
jssdkcdns.mparticle.com
jssdks.mparticle.com
match.adsrvr.org
match.prod.bidr.io
match.sharethrough.com
ml314.com
p.adsymptotic.com
p.rfihub.com
pagead2.googlesyndication.com
pippio.com
pixel-sync.sitescout.com
pixel-us-east.rubiconproject.com
pixel.adsafeprotected.com
pixel.quantserve.com
pixel.rubiconproject.com
pmd-dev-frontend-modules.s3.amazonaws.com
pr-bh.ybp.yahoo.com
px.ads.linkedin.com
px4.ads.linkedin.com
revert-cheet-3898-ontariofarmer.gdev.postmedia.digital
rtb.adentifi.com
rtb.mfadsrvr.com
s.amazon-adsystem.com
s.tribalfusion.com
sb.scorecardresearch.com
securepubads.g.doubleclick.net
simage2.pubmatic.com
simage4.pubmatic.com
smartcdn.gprod.postmedia.digital
smartcdn.prod.postmedia.digital
snap.licdn.com
ssbsync.smartadserver.com
ssum-sec.casalemedia.com
ssum.casalemedia.com
stags.bluekai.com
static.ads-twitter.com
sync-tm.everesttech.net
sync.1rx.io
sync.mathtag.com
sync.srv.stackadapt.com
sync.targeting.unrulymedia.com
t.co
tags.rd.linksynergy.com
token.rubiconproject.com
tpc.googlesyndication.com
u.openx.net
um.simpli.fi
us-u.openx.net
us.creativecdn.com
usermatch.krxd.net
www.facebook.com
www.google.ca
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.linkedin.com
www.npttech.com
cm.g.doubleclick.net
104.16.190.66
104.16.68.69
104.18.101.194
104.244.42.67
104.244.42.69
104.36.115.109
104.36.115.113
104.36.115.114
107.178.254.65
107.22.254.227
108.168.159.145
108.174.10.24
142.250.176.194
142.251.40.130
146.75.36.157
151.101.130.49
151.101.66.133
156.154.202.36
185.167.164.39
185.184.10.30
198.148.27.139
199.127.204.147
199.187.193.179
199.38.167.128
2001:4998:14:800::1001
207.198.113.179
209.54.177.54
23.209.184.224
23.54.68.197
23.54.68.240
23.57.136.222
2600:141b:13::17d7:82d2
2600:1f18:4e9:5a01:82b8:89c9:c55a:66d8
2600:9000:2209:0:7:75d4:e40:93a1
2606:4700:10::6816:49e8
2606:4700:3037::6815:3c3f
2606:4700::6812:c05
2607:f8b0:4006:806::200e
2607:f8b0:4006:807::2003
2607:f8b0:4006:809::200e
2607:f8b0:4006:80a::2002
2607:f8b0:4006:80b::2002
2607:f8b0:4006:80c::2001
2607:f8b0:4006:80d::2001
2607:f8b0:4006:80f::2003
2607:f8b0:4006:81d::2002
2607:f8b0:4006:81e::200e
2607:f8b0:4006:822::2004
2607:f8b0:4006:822::200a
2607:f8b0:4006:823::2002
2607:f8b0:4006:823::2003
2607:f8b0:4006:824::2008
2620:112:f002:bbbb::21
2620:116:800b:21:ea23:7677:128a:8c9c
2620:1ec:21::14
2a03:2880:f012:8:face:b00c:0:1
2a03:2880:f112:83:face:b00c:0:25de
2a04:4e42:200::645
3.208.70.15
3.33.220.150
34.149.157.221
34.195.153.99
34.231.116.207
34.232.192.29
34.235.23.231
34.95.11.30
34.98.64.218
34.98.67.3
35.169.10.7
35.190.60.146
35.207.24.140
35.231.227.177
35.71.139.29
52.4.137.218
52.85.61.15
52.85.61.25
52.85.61.28
52.85.61.89
52.85.63.179
52.95.146.203
54.243.110.155
54.85.186.77
63.251.114.136
63.251.86.49
68.67.179.135
74.121.140.14
8.28.7.83
8.28.7.84
8.43.72.98
99.83.154.140
0055b9d0429e9c194b4aa6b5f49cbc2ec31a7220ee7c8c186a9ee951feabd482
0535edcb69bc883196ac4f00005d76245377ebcfd800486362b8c37f2f213007
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
0878df8b9a030066f26276aab6a4e36e509b480ec37fdac609ec3037611267d4
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
14ab5b278f9be15de0074f89acdb48201d71f3c0ffc385b168fee5c0904e22d2
166b32472bd35ab18cf94e37efd5055f293406d30ffac183474318140b45ebf2
1a1cb145978036238fc717a47ecca7efce5f18634a29ee41c0d57ce7f24eaf83
238a7b88a5b7237a3fde744d5b7a0d8deafbe118e52453771e9e1872cac1b41f
23d00276404c2322c5d3bb27f5e930b67f81bc964189b36b028ab1521a5929db
27bcdc67e32fef9bdd86b785b1bafadd7f6915c49f6b49bed86bfbddf414b2f8
29184c416fa3c5ffcbc4baf96ffe14c8d5fe2a0ff451da9d40b7109960ba3c2f
2987df61c80f5e13507666bcb5e2805b7c766a6e3e4f664d4bd557848839e60c
2afcabe2eb6314148dfd9dfdec1333b973d97d0780cc08fddab8501afbb013e9
300b9ba11e041384aafe746b81adbac891f04890e6d71728d572df9073610076
300cd678581c1f04ad918b185f5e75f1b67944339b7e52b008dc8aea9f9f1dfb
3150efb8d7753652048316a309a576d13cfd401e0a3fdad03e050a9023c5a950
33e685d2f9d40201bf2068e31a29d44460a4a7d6e8b96d01e80906fb8967c064
341cbeee5137b8d4fa122e468d0fb6e666cbc95b364639013a0eb5b41602c544
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
39874e19af66fa05a8e943e773c81187cb7437bb3cb0076df6defb9381d32911
3b45e4bab0a5e13bb27fbf55a76dc68dda7889946f8e293815456ce1cc99359a
3bcfa04dbc2db44af54bd72a0f7b98912368f16f525729a1b9b673f62ca7e5c9
3c59439b4ea6905545d0a5f41278422ee0d3bb3d370b4b8eaea35f306a9e1f63
3c95dce4dc9f51eb06f8cec239fefd4ae84e5484edc51e70da258c8010fa6ba8
3d6e20680ace24ba433ac950d7719fd3e756cb4c57626d64be6e88f1c742fc15
3f00d652362583c48f3e00e6882a084213f1ae76107f5819fe992ddc75139b87
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
40e562e806ce113ae7879d0dd76db82797b5c274794751c260381f2c8b283641
40f460b0a11cc3dd45853c3907c92490cda1e1ba7fc2aeeefb8ecf10643cef0c
42cb48fcecb9f09d629e736d1ca8a7eb9c37c8e493b140d071fa92396897b333
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4c407841613a18a1c6545d1a57accb4951998944eef506ee803e20bf1531beb7
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e48be26b32a67e5d820e61ea8f17a762d718df7e4761dbe79b089bf76c9a9d1
5158dae06a46081e23403635bc98fdc0194e932daba1752475cf2934e917d6d8
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5702be858374d0c1b9cfa6164335204df766faceb85311b0311cc81b77041708
5853621d02d975fba45c91907a09fec43c635c608a30f31ecd9b85342693b41d
58d6350da5588a52d6baa4efc27a3362b4ee69dba3504fc762f934d7bb5d0bc4
5b9794842e89dcec3790d21b95acce36c08673d4162e745dc440e6766534ed53
5bfee1a430ede5828fcb00547e58f4121e6758b35517b4ee1b5387067a2e65e9
5e2aab555cbfbe4f398bc031f658fd37c078428446a48154a9e9301fe01b72d9
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
61a9435112cb68acc5f8da27798416ac4082a71a8ee5d392fb39c30185e4bc73
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
644d402269486db543524238e4b6d1dcdfe40d3b76fcb4c40ad9f3a54b78c672
65bdb0f68bb734a9ee0412aeb1d9898bd4098339efd43b8356acf19b3d8c3ad5
68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f
68a335c0d87dce935fee1811892070e78c514828d50bfe2ae21fde739ec1002c
6902e79f7c8a801e6c1e25c65fd4dcf30034a12d12dad3286d2f0af4457c9b0c
6a635aea585d77e3a27766c7535ba7a51279eefc79406e7fcaca9ca075139a8a
6c350596209bb92fbfe46287eaf6392f6d4e557ac7ca38cfad1c781798a474d1
6c8ee3f969943732ebe4bec6db2f9593e601405cb74b58a677f435d2d2b72b68
6d9bc265633896e510b703d724e0755972ad09a7a94a7a47c44796dbbf48b294
709932d262282e65073a8940fc09fc3fffbeb13682a8190bf8a1e96fc2c59888
7538e8f23fac8278c6027d8865bd1240514a3ff64b2c0af3b8ed3583e8ecce6b
75a77e830f86d137e25f975b17be19598bfb447a90609f627d8058aaa98e988d
7672bbc7995d3a3f83002c8042c2c00f758192c570ca5f190496dfa7922dd13a
76a237b880fbfc8ac655e91dcf5c9af3b44ccc506c69328409b4047d72519eea
7720a0f40d088f144d749c07f075b8dfdc84afd25900a59045fe6c29d0fc5090
78ea6d7806beda2d76bb7d9abb14b034ad476a897376c270aefcf40a2f49316c
7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb
7d06e3131ddb81933c107666b35dd12529999f1bab34373676aacbc0781d3f38
7fb15552a88b764ca42963e71136255cecf99c6bccc6fdc68fbe0f930a516cb7
804e46afd5ad7b262335603b1fc216893c3d17fee2cf4346c6be71cdeb663020
829d72817722e405d355555ed468ffb9484c781e4527981ee9240e2cc92b8f14
831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8ddf9e8fa96d1bbbeaf292ca94fc082dde61e4a6be90c87f8b2609fd88edbd4d
8e2dcb9912e96ad6472e010d4e66d67c647dfc385f09d652c1ff8d4d752baf14
8ed0a1bd4eb0ed3301ce027cbbbfc1ab533ec89a81b2446dd053b2b15131eae7
975a64dc9bbc5e1884ba8ca2e76d9b2791d16d5c9f3619bf30477cd21a8636d2
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
a0f35d5c804fc84da1c86a0cd213a3f094722a7a4f7ba5e404e6805c5ae18bd8
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a50761af47976acf2a9b1ed88cff6727c6c0fa4a18c2806a26f108c5268b4c1f
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a98e42e3eb993cc80c926236bbdcbfbd4c531f23bc794d51c0f09c74a526f746
aa8c4f5924fd06cbaf5c65fac729f0c3207d1f70534b07fc0915948c41b29d6e
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
adaf81788242f9c48cc12172354c5df3e22fdcbcd2c3979dd83b419bb59e3db7
aebd50af0cd8da2f314a52e2088788775d1a441bd674ef9379578e7bc1b5ad50
aebf0e0d15c0130fbe1375e3d5daff30441efea4c2545cc9f69cea6c13bab3a9
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b4cd5a35208ed1887c60d9068a37b1efd686c5735ecde966379a3d6c27f044e6
bd9f530ba7705636d303f4a8358e04e7b460187c0aff61ab589fa311026b3d6b
be732f4748336c52d34be6c2545917a6757dd03142e5bf9b0bcd02f14d6aeb9d
bed79e22634d48c6e53d084c7dc1ac8e7ed34377df61478f7020d89248124ea1
bfe59bd642bfb002cede8d9aa3fdfb08da38e7841521e9d24bc4da59e0986d76
c029a62dd0db8acae4dcb0475c391322985f608ab5322241cdc8f1beb4137295
c1613fae297f062becb2e3f0a24314be2a09ba5809d48bd1a2ea5eacb95e18ca
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c2d354fdedbaadf1b43f895733b1280a82d5afe4437cd469b3164c3847ce495b
c4cf4079ec71eea0051719d77dad827e876accf52dff47dbb7822f06d628fed4
c6d4675d324e5b40ed5fe0f15dfc55855a7d6389232ce7c981062d99b80d366c
c81cab8c63d469329c0e0724770c6c8622f0d5d1fb8b6f919b6d7dddfadba190
ca157b8a9c98a19c0446a974ea642d13e3b3398f328d312fd474df9f63c45fe9
cae0ae2d67aac89367108586ebd25e00afc5d0f8110e6eb71b8d274037f7a5d8
cb0a1ac121b8aa9b8e2912768985ee6341cdd33d4c7b4db39052731d4b5248e2
cba3ea17b1953652d697e2eff5236640c08d1c78f04c229cf231561937aa8626
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d06ae5e97e495832fc4526c3e93d7e9440f1faf5f77669b41678c9d564a25faf
d56935b6d90bfda04a229bcfb4a446661b821c4828ecbf1b403cb89355ca0a4b
d5f7c1c0cbec2c27d4165db4cd06b7780f477fc9161008bde67c7a9d62b223aa
db15dd210c5e6315ca7c68ea0caff33cd1a4c5cd0ee006574562b0e65189cd28
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e58d11729ac1aaea5798582f74341fd5a827fa916c2afa0f1eb48de68e8ed6f9
e79c1c1a140e6afb861074c70392db54cc65a06050de2a69162ab94eb95b0516
ea785267c1fb17f52f19fb3f2e95507c31dc5e1078248861cad28bdabc364a7f
eab06b3b242b9a3bd1506c6e82dc5ef17fe38ce8ba301985cc7c7a8a266f71b8
ebf5baf9b0e82eb5b98a1e248d8a3040295ac04eb6b7d926ecca617d8d269a63
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152
ec5048fe0002a0fd7fdc7141ffd02691784cd09dc8f1adee6783c86d8d5604cb
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e
f7914b4836b5815c4b3dcd79c44fa3390dedf00785d79f90dc7f6c6f38c947c5
fa1a83860ae68c1af3b078fd55da92278d7c32238380cd8e111e90a398575a4a
fe074cf2c852c9e4fab263d4a98a39c0cc4e91c0bc6f168304470214602b6d01
fe305c77b83686cd1170b06db8bdbc6f6fb35a13d3d5fcc33284024667c3fc54
fe3cd3089faea77abfd92708efafcb5af900dead2bea4d8655a5b879cefc0f05
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

revert-cheet-3898-ontariofarmer.gdev.postmedia.digital Open in urlscan Pro 34.95.11.30 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

228 Requests

74 %HTTPS

31 %IPv6

66 Domains

106 Subdomains

66 IPs

5 Countries

2373 kBTransfer

6175 kBSize

109 Cookies

12 Outgoing links

Page URL History

Redirected requests

228 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

revert-cheet-3898-ontariofarmer.gdev.postmedia.digital Open in urlscan Pro
34.95.11.30 Public Scan

Screenshot
Live screenshot

Full Image

228
Requests

74 %
HTTPS

31 %
IPv6

66
Domains

106
Subdomains

66
IPs

5
Countries

2373 kB
Transfer

6175 kB
Size

109
Cookies

228 HTTP transactions
3 data transactions