pro.oxfordincomeletter.com Open in urlscan Pro
192.135.136.168 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://links.daily.the7at7.com/u/click?_t=a06929ac1a5d4b2db9017bb4103688c8&_m=46e330cce23748aab82b39c512e297ad&_e=qqGlwdiaJGMV8...
Effective URL:
https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview...
Submission: On October 23 via api (October 23rd 2021, 3:20:01 am UTC) from BE — Scanned from DE

Summary HTTP 203 Redirects Behaviour Indicators

Summary

This website contacted 80 IPs in 10 countries across 64 domains to perform 203 HTTP transactions. The main IP is 192.135.136.168, located in United States and belongs to 14WEST-AS, US. The main domain is pro.oxfordincomeletter.com.
TLS certificate: Issued by Entrust Certification Authority - L1K on September 20th 2021. Valid for: 10 months.

This is the only time pro.oxfordincomeletter.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	52.71.102.166 52.71.102.166	14618 (AMAZON-AES) (AMAZON-AES)
1 1	54.146.149.67 54.146.149.67	14618 (AMAZON-AES) (AMAZON-AES)
3 9	192.135.136.168 192.135.136.168	11372 (14WEST-AS) (14WEST-AS)
3	52.217.163.201 52.217.163.201	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	54.231.98.83 54.231.98.83	16509 (AMAZON-02) (AMAZON-02)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:1b	20446 (HIGHWINDS3) (HIGHWINDS3)
10	2a04:4e42:200... 2a04:4e42:200::622	54113 (FASTLY) (FASTLY)
7	2606:4700:20:... 2606:4700:20::ac43:49ec	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.66.97.105 18.66.97.105	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
2	18.66.122.78 18.66.122.78	16509 (AMAZON-02) (AMAZON-02)
3	2.16.186.8 2.16.186.8	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
9	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
4	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a04:4e42:600... 2a04:4e42:600::300	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:400c:c0c::9d	15169 (GOOGLE) (GOOGLE)
1	151.101.1.44 151.101.1.44	54113 (FASTLY) (FASTLY)
1	2a02:2638::3 2a02:2638::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2600:9000:225... 2600:9000:2250:8600:11:9be7:da80:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:223... 2600:9000:223c:0:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:223... 2600:9000:223c:4e00:b:6268:b880:93a1	16509 (AMAZON-02) (AMAZON-02)
10	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
2	104.19.133.78 104.19.133.78	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.66.97.49 18.66.97.49	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:303... 2606:4700:3031::ac43:91b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2.18.234.190 2.18.234.190	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.26.12.105 104.26.12.105	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1288:80:... 2a00:1288:80:800::7000	203220 (YAHOO-DEB) (YAHOO-DEB)
3	18.195.42.228 18.195.42.228	16509 (AMAZON-02) (AMAZON-02)
8	2a00:1450:400... 2a00:1450:4001:830::2004	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
2	2600:9000:225... 2600:9000:2250:f000:b:c1a2:7dc0:93a1	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
1	52.222.236.122 52.222.236.122	16509 (AMAZON-02) (AMAZON-02)
3	70.42.32.31 70.42.32.31	13789 (INTERNAP-...) (INTERNAP-BLK3)
2	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
2	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
1	18.66.112.109 18.66.112.109	16509 (AMAZON-02) (AMAZON-02)
2 3	2a02:2638:1::13 2a02:2638:1::13	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
3	212.82.100.181 212.82.100.181	34010 (YAHOO-IRD) (YAHOO-IRD)
1 1	2600:1f18:730... 2600:1f18:730:b120:5b38:df27:617f:9396	14618 (AMAZON-AES) (AMAZON-AES)
1	54.146.217.90 54.146.217.90	14618 (AMAZON-AES) (AMAZON-AES)
24	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	178.250.0.157 178.250.0.157	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	99.81.27.250 99.81.27.250	16509 (AMAZON-02) (AMAZON-02)
1	18.66.112.79 18.66.112.79	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:829::2010	15169 (GOOGLE) (GOOGLE)
1 1	178.250.0.163 178.250.0.163	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	74.119.119.150 74.119.119.150	19750 (AS-CRITEO) (AS-CRITEO)
1	151.101.2.137 151.101.2.137	54113 (FASTLY) (FASTLY)
1	52.86.94.156 52.86.94.156	14618 (AMAZON-AES) (AMAZON-AES)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1 1	142.250.185.226 142.250.185.226	15169 (GOOGLE) (GOOGLE)
2	178.250.2.151 178.250.2.151	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1 2	34.249.161.76 34.249.161.76	16509 (AMAZON-02) (AMAZON-02)
1 2	35.227.248.159 35.227.248.159	15169 (GOOGLE) (GOOGLE)
1	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
2	104.75.88.126 104.75.88.126	16625 (AKAMAI-AS) (AKAMAI-AS)
1	3.127.62.220 3.127.62.220	16509 (AMAZON-02) (AMAZON-02)
1	8.39.36.142 8.39.36.142	26667 (RUBICONPR...) (RUBICONPROJECT)
3 4	185.33.220.242 185.33.220.242	29990 (ASN-APPNEX) (ASN-APPNEX)
1 4	18.157.70.90 18.157.70.90	16509 (AMAZON-02) (AMAZON-02)
1	34.102.166.132 34.102.166.132	15169 (GOOGLE) (GOOGLE)
2	185.64.189.110 185.64.189.110	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	13.248.245.213 13.248.245.213	16509 (AMAZON-02) (AMAZON-02)
1 2	2.21.141.232 2.21.141.232	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	2a02:6b8::90 2a02:6b8::90	208722 (YNDX) (YNDX)
1	18.66.97.123 18.66.97.123	16509 (AMAZON-02) (AMAZON-02)
1	2.21.140.74 2.21.140.74	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.90.104.248 104.90.104.248	16625 (AKAMAI-AS) (AKAMAI-AS)
1	52.50.197.208 52.50.197.208	16509 (AMAZON-02) (AMAZON-02)
3	141.226.228.48 141.226.228.48	200478 (TABOOLA-AS) (TABOOLA-AS)
1 2	18.193.213.131 18.193.213.131	16509 (AMAZON-02) (AMAZON-02)
2 8	2600:9000:224... 2600:9000:224a:b600:6:9280:1080:93a1	16509 (AMAZON-02) (AMAZON-02)
2	162.247.243.146 162.247.243.146	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	108.128.63.204 108.128.63.204	16509 (AMAZON-02) (AMAZON-02)
1	34.237.200.61 34.237.200.61	14618 (AMAZON-AES) (AMAZON-AES)
1	34.209.144.177 34.209.144.177	16509 (AMAZON-02) (AMAZON-02)
2	3.225.211.88 3.225.211.88	() ()
203	80

1 52.71.102.166 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-71-102-166.compute-1.amazonaws.com

links.daily.the7at7.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.146.149.67 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-146-149-67.compute-1.amazonaws.com

api.smartdataprocessor.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 192.135.136.168 (United States) 3 redirects

ASN11372 (14WEST-AS, US)

signup.wealthyretirement.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pro.oxfordincomeletter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.217.163.201 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

portrait-tracker.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.231.98.83 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:1b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a04:4e42:200::622 (Ascension Island)

ASN54113 (FASTLY, US)

fast.wistia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fast.wistia.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:20::ac43:49ec (United States)

ASN13335 (CLOUDFLARENET, US)

c.lytics.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.105 (United States)

ASN16509 (AMAZON-02, US)

cdn.getblueshift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.66.122.78 (United States)

ASN16509 (AMAZON-02, US)

dnzkifeab6.execute-api.us-east-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.16.186.8 (Ascension Island)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-8.deploy.static.akamaitechnologies.com

embedwistia-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:600::300 (Ascension Island)

ASN54113 (FASTLY, US)

trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c0c::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.1.44 (United States)

ASN54113 (FASTLY, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2250:8600:11:9be7:da80:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.mediago.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:0:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:4e00:b:6268:b880:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn1.lockerdomecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.19.133.78 (United States)

ASN13335 (CLOUDFLARENET, US)

a.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.49 (United States)

ASN16509 (AMAZON-02, US)

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3031::ac43:91b0 (United States)

ASN13335 (CLOUDFLARENET, US)

siteimproveanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.234.190 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-190.deploy.static.akamaitechnologies.com

amplify.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.12.105 (United States)

ASN13335 (CLOUDFLARENET, US)

at-api.tribeos.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1288:80:800::7000 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.195.42.228 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:830::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2250:f000:b:c1a2:7dc0:93a1 (United States)

ASN16509 (AMAZON-02, US)

trace.mediago.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.236.122 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-122.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 70.42.32.31 (United States)

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com

tr.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.112.109 (United States)

ASN16509 (AMAZON-02, US)

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:2638:1::13 (France) 2 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 212.82.100.181 (Switzerland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b120:5b38:df27:617f:9396 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.146.217.90 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-146-217-90.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.0.157 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.81.27.250 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-99-81-27-250.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.112.79 (United States)

ASN16509 (AMAZON-02, US)

vc.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2010 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

storage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.0.163 (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

sslwidget.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.119.119.150 (United States)

ASN19750 (AS-CRITEO, US)

widget.us.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.2.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.86.94.156 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-86-94-156.compute-1.amazonaws.com

distillery.wistia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.226 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.2.151 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.249.161.76 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-161-76.eu-west-1.compute.amazonaws.com

partner.mediawallahscript.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.227.248.159 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 159.248.227.35.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.126.56.137 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.75.88.126 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-75-88-126.deploy.static.akamaitechnologies.com

cw.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.127.62.220 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-127-62-220.eu-central-1.compute.amazonaws.com

crb.kargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.39.36.142 (United States)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.33.220.242 (Netherlands) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.157.70.90 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-157-70-90.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.166.132 (United States)

ASN15169 (GOOGLE, US)
PTR: 132.166.102.34.bc.googleusercontent.com

ad.tpmn.co.kr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.248.245.213 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.21.141.232 (Ascension Island) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-21-141-232.deploy.static.akamaitechnologies.com

r.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:6b8::90 (Moscow, Russian Federation) 1 redirects

ASN208722 (YNDX, FI)

an.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.123 (United States)

ASN16509 (AMAZON-02, US)

ad.as.amanad.adtdp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.21.140.74 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-21-140-74.deploy.static.akamaitechnologies.com

contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.90.104.248 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-90-104-248.deploy.static.akamaitechnologies.com

criteo-sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.50.197.208 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-50-197-208.eu-west-1.compute.amazonaws.com

trends.revcontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 141.226.228.48 (Netherlands)

ASN200478 (TABOOLA-AS, IL)

sync-t1.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc-events.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.193.213.131 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-193-213-131.eu-central-1.compute.amazonaws.com

ad.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:224a:b600:6:9280:1080:93a1 (United States) 2 redirects

ASN16509 (AMAZON-02, US)

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.247.243.146 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

bam-cell.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.128.63.204 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-108-128-63-204.eu-west-1.compute.amazonaws.com

d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.237.200.61 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-237-200-61.compute-1.amazonaws.com

pipedream.wistia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.209.144.177 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-209-144-177.us-west-2.compute.amazonaws.com

api.getblueshift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.225.211.88 (None, )

ASN- ()

fg8vvsvnieiv3ej16jby.litix.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
24	facebook.com www.facebook.com	2 KB
11	wistia.com fast.wistia.com distillery.wistia.com pipedream.wistia.com	356 KB
10	facebook.net connect.facebook.net	864 KB
9	adroll.com 2 redirects s.adroll.com d.adroll.com	78 KB
9	doubleclick.net 1 redirects stats.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	9 KB
9	google-analytics.com www.google-analytics.com	22 KB
8	criteo.com 3 redirects gum.criteo.com mug.criteo.com sslwidget.criteo.com widget.us.criteo.com dis.criteo.com	15 KB
8	google.de www.google.de	1 KB
8	google.com www.google.com	1 KB
7	lytics.io c.lytics.io	54 KB
7	oxfordincomeletter.com 1 redirects pro.oxfordincomeletter.com	28 KB
6	taboola.com trc.taboola.com cdn.taboola.com sync-t1.taboola.com trc-events.taboola.com	27 KB
6	amazonaws.com portrait-tracker.s3.amazonaws.com s3.amazonaws.com dnzkifeab6.execute-api.us-east-1.amazonaws.com	93 KB
5	yahoo.com sp.analytics.yahoo.com ads.yahoo.com ups.analytics.yahoo.com	4 KB
5	gstatic.com fonts.gstatic.com	82 KB
4	bidswitch.net 1 redirects x.bidswitch.net	2 KB
4	adnxs.com 3 redirects secure.adnxs.com	4 KB
4	outbrain.com amplify.outbrain.com tr.outbrain.com sync.outbrain.com	4 KB
4	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com in.hotjar.com	63 KB
4	bing.com bat.bing.com c.bing.com	11 KB
4	googletagmanager.com www.googletagmanager.com	232 KB
3	ensighten.com nexus.ensighten.com	10 KB
3	yimg.com s.yimg.com	7 KB
3	liadm.com 1 redirects b-code.liadm.com rp.liadm.com rp4.liadm.com	11 KB
3	mediago.io cdn.mediago.io trace.mediago.io	75 KB
3	akamaihd.net embedwistia-a.akamaihd.net	787 KB
2	litix.io fg8vvsvnieiv3ej16jby.litix.io	172 B
2	nr-data.net bam-cell.nr-data.net	1 KB
2	360yield.com 1 redirects ad.360yield.com	854 B
2	yandex.ru 1 redirects an.yandex.ru	674 B
2	casalemedia.com 1 redirects r.casalemedia.com	2 KB
2	3lift.com 1 redirects eb2.3lift.com	736 B
2	pubmatic.com simage2.pubmatic.com	867 B
2	addthis.com cw.addthis.com	856 B
2	tapad.com 1 redirects pixel.tapad.com	894 B
2	mediawallahscript.com 1 redirects partner.mediawallahscript.com	1 KB
2	t.co t.co	594 B
2	twitter.com analytics.twitter.com	913 B
2	mgid.com a.mgid.com	4 KB
2	getblueshift.com cdn.getblueshift.com api.getblueshift.com	3 KB
2	googleapis.com fonts.googleapis.com storage.googleapis.com	3 KB
2	wealthyretirement.com 2 redirects signup.wealthyretirement.com	996 B
1	wistia.net fast.wistia.net	125 KB
1	revcontent.com trends.revcontent.com	336 B
1	teads.tv criteo-sync.teads.tv	172 B
1	media.net contextual.media.net	868 B
1	adtdp.com ad.as.amanad.adtdp.com	843 B
1	tpmn.co.kr ad.tpmn.co.kr	601 B
1	rubiconproject.com pixel.rubiconproject.com	239 B
1	kargo.com crb.kargo.com	360 B
1	rlcdn.com idsync.rlcdn.com	417 B
1	newrelic.com js-agent.newrelic.com	16 KB
1	hotjar.io vc.hotjar.io	254 B
1	tribeos.io at-api.tribeos.io	73 KB
1	siteimproveanalytics.com siteimproveanalytics.com	864 B
1	ads-twitter.com static.ads-twitter.com	6 KB
1	googleadservices.com www.googleadservices.com	15 KB
1	lockerdomecdn.com cdn1.lockerdomecdn.com	1 KB
1	criteo.net static.criteo.net	14 KB
1	jquery.com code.jquery.com	30 KB
1	cloudflare.com cdnjs.cloudflare.com	5 KB
1	bootstrapcdn.com stackpath.bootstrapcdn.com	25 KB
1	smartdataprocessor.com 1 redirects api.smartdataprocessor.com	270 B
1	the7at7.com 1 redirects links.daily.the7at7.com	1 KB
203	64

	Domain	Requested by
24	www.facebook.com	pro.oxfordincomeletter.com
10	connect.facebook.net	pro.oxfordincomeletter.com
9	www.google-analytics.com	pro.oxfordincomeletter.com www.googletagmanager.com
9	fast.wistia.com	pro.oxfordincomeletter.com
8	s.adroll.com	2 redirects pro.oxfordincomeletter.com
8	www.google.de	pro.oxfordincomeletter.com
8	www.google.com	pro.oxfordincomeletter.com
7	c.lytics.io	portrait-tracker.s3.amazonaws.com pro.oxfordincomeletter.com
7	pro.oxfordincomeletter.com	1 redirects pro.oxfordincomeletter.com cdn.mediago.io
6	googleads.g.doubleclick.net	pro.oxfordincomeletter.com
5	fonts.gstatic.com	fonts.googleapis.com
4	x.bidswitch.net	1 redirects
4	secure.adnxs.com	3 redirects
4	www.googletagmanager.com	portrait-tracker.s3.amazonaws.com pro.oxfordincomeletter.com
3	sp.analytics.yahoo.com	pro.oxfordincomeletter.com
3	gum.criteo.com	2 redirects pro.oxfordincomeletter.com
3	nexus.ensighten.com	pro.oxfordincomeletter.com
3	s.yimg.com	pro.oxfordincomeletter.com
3	bat.bing.com	pro.oxfordincomeletter.com
3	embedwistia-a.akamaihd.net	pro.oxfordincomeletter.com
3	portrait-tracker.s3.amazonaws.com	pro.oxfordincomeletter.com
2	fg8vvsvnieiv3ej16jby.litix.io	pro.oxfordincomeletter.com
2	trc-events.taboola.com	pro.oxfordincomeletter.com
2	bam-cell.nr-data.net	pro.oxfordincomeletter.com
2	ad.360yield.com	1 redirects
2	an.yandex.ru	1 redirects
2	r.casalemedia.com	1 redirects
2	eb2.3lift.com	1 redirects
2	simage2.pubmatic.com
2	cw.addthis.com
2	pixel.tapad.com	1 redirects
2	partner.mediawallahscript.com	1 redirects
2	dis.criteo.com
2	t.co	pro.oxfordincomeletter.com
2	analytics.twitter.com	pro.oxfordincomeletter.com
2	tr.outbrain.com	pro.oxfordincomeletter.com
2	trace.mediago.io	pro.oxfordincomeletter.com
2	a.mgid.com	pro.oxfordincomeletter.com
2	stats.g.doubleclick.net	pro.oxfordincomeletter.com
2	trc.taboola.com	pro.oxfordincomeletter.com
2	dnzkifeab6.execute-api.us-east-1.amazonaws.com	pro.oxfordincomeletter.com
2	signup.wealthyretirement.com	2 redirects
1	api.getblueshift.com	pro.oxfordincomeletter.com
1	pipedream.wistia.com	pro.oxfordincomeletter.com
1	d.adroll.com	pro.oxfordincomeletter.com
1	fast.wistia.net
1	sync-t1.taboola.com
1	trends.revcontent.com
1	criteo-sync.teads.tv
1	contextual.media.net
1	ad.as.amanad.adtdp.com
1	ad.tpmn.co.kr
1	c.bing.com
1	pixel.rubiconproject.com
1	crb.kargo.com
1	sync.outbrain.com
1	ups.analytics.yahoo.com
1	ads.yahoo.com
1	cm.g.doubleclick.net	1 redirects
1	idsync.rlcdn.com
1	distillery.wistia.com	pro.oxfordincomeletter.com
1	js-agent.newrelic.com	pro.oxfordincomeletter.com
1	widget.us.criteo.com	pro.oxfordincomeletter.com
1	sslwidget.criteo.com	1 redirects
1	storage.googleapis.com	pro.oxfordincomeletter.com
1	vc.hotjar.io	pro.oxfordincomeletter.com
1	in.hotjar.com	pro.oxfordincomeletter.com
1	mug.criteo.com	pro.oxfordincomeletter.com
1	rp4.liadm.com	pro.oxfordincomeletter.com
1	rp.liadm.com	1 redirects
1	vars.hotjar.com	pro.oxfordincomeletter.com
1	script.hotjar.com	pro.oxfordincomeletter.com
1	at-api.tribeos.io	pro.oxfordincomeletter.com
1	amplify.outbrain.com	pro.oxfordincomeletter.com
1	siteimproveanalytics.com	pro.oxfordincomeletter.com
1	static.hotjar.com	pro.oxfordincomeletter.com
1	static.ads-twitter.com	pro.oxfordincomeletter.com
1	www.googleadservices.com	pro.oxfordincomeletter.com
1	cdn1.lockerdomecdn.com	pro.oxfordincomeletter.com
1	b-code.liadm.com	pro.oxfordincomeletter.com
1	cdn.mediago.io	pro.oxfordincomeletter.com
1	static.criteo.net	pro.oxfordincomeletter.com
1	cdn.taboola.com	pro.oxfordincomeletter.com
1	cdn.getblueshift.com	portrait-tracker.s3.amazonaws.com
1	code.jquery.com	pro.oxfordincomeletter.com
1	s3.amazonaws.com	pro.oxfordincomeletter.com
1	cdnjs.cloudflare.com	pro.oxfordincomeletter.com
1	stackpath.bootstrapcdn.com	pro.oxfordincomeletter.com
1	fonts.googleapis.com	pro.oxfordincomeletter.com
1	api.smartdataprocessor.com	1 redirects
1	links.daily.the7at7.com	1 redirects
203	91

This site contains no links.

Subject Issuer	Validity	Valid
ordertracking.pubsvs.com Entrust Certification Authority - L1K	`2021-09-20` - `2022-07-21`	10 months	crt.sh
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2021-01-11` - `2022-02-11`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-10-04` - `2021-12-27`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-03-01` - `2022-02-28`	a year	crt.sh
s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2021-06-23` - `2022-07-24`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
fast.wistia.com GlobalSign Atlas R3 DV TLS CA 2020	`2021-03-22` - `2022-04-23`	a year	crt.sh
*.getblueshift.com Amazon	`2021-09-08` - `2022-10-07`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-10-04` - `2021-12-27`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-10-04` - `2021-12-27`	3 months	crt.sh
*.execute-api.us-east-1.amazonaws.com Amazon	`2021-04-09` - `2022-05-08`	a year	crt.sh
a248.e.akamai.net DigiCert SHA2 Secure Server CA	`2021-07-15` - `2022-07-20`	a year	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2021-09-30` - `2022-03-30`	6 months	crt.sh
*.taboola.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-25` - `2021-12-26`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-10-04` - `2021-12-27`	3 months	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-09-09` - `2021-12-07`	3 months	crt.sh
*.mediago.io Amazon	`2021-10-07` - `2022-11-05`	a year	crt.sh
*.liadm.com Amazon	`2021-03-02` - `2022-03-31`	a year	crt.sh
*.lockerdomecdn.com Amazon	`2021-02-24` - `2022-03-25`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-09-09` - `2021-12-08`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-10-04` - `2021-12-27`	3 months	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-21` - `2022-07-26`	a year	crt.sh
*.hotjar.com Amazon	`2020-12-25` - `2022-01-23`	a year	crt.sh
*.outbrain.com DigiCert SHA2 Secure Server CA	`2021-05-25` - `2022-06-01`	a year	crt.sh
tribeos.io Cloudflare Inc ECC CA-3	`2021-06-04` - `2022-06-03`	a year	crt.sh
*.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-09-06` - `2021-10-27`	2 months	crt.sh
nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-14` - `2022-10-12`	a year	crt.sh
www.google.com GTS CA 1C3	`2021-10-04` - `2021-12-27`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-10-04` - `2021-12-27`	3 months	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-09-09` - `2021-12-07`	3 months	crt.sh
*.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-05-24` - `2021-11-17`	6 months	crt.sh
*.hotjar.io Amazon	`2021-08-17` - `2022-09-15`	a year	crt.sh
*.storage.googleapis.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.us.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-08-21` - `2021-11-18`	3 months	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA H2 2021	`2021-10-06` - `2022-11-07`	a year	crt.sh
*.wistia.com Amazon	`2021-04-01` - `2022-04-30`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-25` - `2022-03-28`	a year	crt.sh
*.mediawallahscript.com Amazon	`2021-05-19` - `2022-06-17`	a year	crt.sh
*.tapad.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-13` - `2022-10-14`	a year	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-08-17` - `2022-02-09`	6 months	crt.sh
odc-addthis-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2021-04-25` - `2022-04-27`	a year	crt.sh
*.dev.kargo.com Amazon	`2021-03-16` - `2022-04-14`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2021-03-30` - `2022-04-04`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2020-04-23` - `2022-05-04`	2 years	crt.sh
ad.tpmn.co.kr GTS CA 1D4	`2021-09-03` - `2021-12-02`	3 months	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2021-08-04` - `2022-09-04`	a year	crt.sh
*.3lift.com Amazon	`2021-06-12` - `2022-07-11`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
bs.yandex.ru Yandex CA	`2021-05-31` - `2021-11-29`	6 months	crt.sh
*.as.amanad.adtdp.com Amazon	`2021-04-06` - `2022-05-05`	a year	crt.sh
*.media.net DigiCert SHA2 Secure Server CA	`2021-04-12` - `2022-04-20`	a year	crt.sh
teads.tv R3	`2021-08-23` - `2021-11-21`	3 months	crt.sh
revcontent.com Amazon	`2021-08-09` - `2022-09-07`	a year	crt.sh
*.360yield.com Amazon	`2021-07-29` - `2022-08-27`	a year	crt.sh
s.adroll.com Amazon	`2021-08-02` - `2022-08-31`	a year	crt.sh
*.nr-data.net DigiCert SHA2 Secure Server CA	`2020-02-05` - `2022-02-08`	2 years	crt.sh
fast.wistia.net GlobalSign Atlas R3 DV TLS CA 2020	`2021-03-22` - `2022-04-23`	a year	crt.sh
adroll.mgr.consensu.org Amazon	`2021-09-09` - `2022-10-08`	a year	crt.sh
*.litix.io Amazon	`2020-11-27` - `2021-12-26`	a year	crt.sh

This page contains 23 frames:

Primary Page: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Frame ID: 379DAEA0A88893DABE593B1E0414FD08
Requests: 147 HTTP requests in this frame

Frame: https://portrait-tracker.s3.amazonaws.com/index.html
Frame ID: D53C62BDDAC4E9A7653869F3ADE8F2F5
Requests: 1 HTTP requests in this frame

Frame: https://c.lytics.io/c/9c32784e3cc4888a693a7988ad64c63d/portrait
Frame ID: 67096A0CE211427D5804AA81DAD6FF69
Requests: 1 HTTP requests in this frame

Frame: https://pro.oxfordincomeletter.com/p/Scripts/Common.js
Frame ID: 2ADECB1734B4559A8B5D2B6A2DBA02D4
Requests: 2 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-d09a446edefba0dcce5d5143e1840e9a.html
Frame ID: ED7C36AE1F5E4F9F4268CF4CD0BA1787
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?topUrl=pro.oxfordincomeletter.com&origin=onetag
Frame ID: 0CB54480CB3619EAFDFBCB5CC7EAAC2A
Requests: 2 HTTP requests in this frame

Frame: https://pro.oxfordincomeletter.com/p/Scripts/Common.js
Frame ID: 8AD9B5B03869AC10E57210AE6FCECEA5
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 79DB97E867995D10438AAB80DA5D4631
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 5453C1B26093B3C5E440B705A7F87642
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: CA544CB66E11B384DA7219C8B740BC2E
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: B674F3FC3F0CDC753BD3400DBFE8E251
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 2E907623099ED2AA58F48E33BFFAEC51
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 95654DCE241E670116B216682EE29328
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 98CADEC6CE8C66BC4B0264BC6378B3B9
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 473C942F30E16BB9C9D5DFCE667D955F
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: E3351A30571C98766A4C6A834D992515
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: DB9E42B7F05EB06CC2488C362740D506
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 6907794934279087DF0C37BE3CAAB3DC
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 4835CC6C0F0DBCA11C04E2707E1FE342
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: F182CFD57F78EABAF3F75D2978F5837F
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: ACC4DD739A40446BA27597876F79A358
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 152139C9F0BAAF6EA0314C5B9DF088A8
Requests: 1 HTTP requests in this frame

Frame: https://idsync.rlcdn.com/397596.gif?partner_uid=fyADNVNm_E9FMQnDOVqTaf0lmwY36Mtq
Frame ID: A7E4BB926F7DC760EAEC9C59753E0B0E
Requests: 30 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

The Oxford ClubThe Oxford Club

Page URL History Show full URLs

http://links.daily.the7at7.com/u/click?_t=a06929ac1a5d4b2db9017bb4103688c8&_m=46e330cce23748aab82b39c512e29... HTTP 303
https://api.smartdataprocessor.com/leadintake?id=LM1246&email=timmermansber%40hotmail.com&siteId=318&nlp=318 HTTP 301
https://signup.wealthyretirement.com/Content/SaveFreeSignups?MultivariateId=1876604&oneClick=true&email=timmerman... HTTP 302
https://signup.wealthyretirement.com/coregconfirmation/X302XA24?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPrevi... HTTP 301
https://pro.oxfordincomeletter.com/m/1872196?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5... HTTP 301
https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-06... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AdRoll (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

(?:a|s)\.adroll\.com

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Criteo (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

//static\.criteo\.net/js/ld/ld\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Yandex.Direct (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://an\.yandex\.ru/

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

203
Requests

100 %
HTTPS

34 %
IPv6

64
Domains

91
Subdomains

80
IPs

10
Countries

3166 kB
Transfer

8461 kB
Size

87
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://links.daily.the7at7.com/u/click?_t=a06929ac1a5d4b2db9017bb4103688c8&_m=46e330cce23748aab82b39c512e297ad&_e=qqGlwdiaJGMV83pzzzsHDUyoKKzDYjXYvJzKxXkjCAINkbkiaZ21exMob8WqkPfiueFATccggVF-lRnbsaNuV_HvLD9nZRkukXwyl0gjyQIkVrfnXDn585anJrMKiqqz_EDexCuqQHQe8xLCzVL0_82h_80JnPQfFfHCrHrFEeCxTS4mBKOsVp6sDBh_uiutoi5WuEcWrwZeRwjclTP1sCx3cYKrLj1xZx5cO3Z3cDoQtgrd5xMAYnqMY2FXdnYeDlhI_30zZ3GdqQYUAz4iWklfEiktJiglVFELD3W5y6jlIQp_kBWAqPmliat1V7z1dPiwhcldCDoH0G8LCFxwXGEP905KBWdY_L5KqPWBEJrO7t6F8JVYeFxWIaaOWlTy HTTP 303
https://api.smartdataprocessor.com/leadintake?id=LM1246&email=timmermansber%40hotmail.com&siteId=318&nlp=318 HTTP 301
https://signup.wealthyretirement.com/Content/SaveFreeSignups?MultivariateId=1876604&oneClick=true&email=timmermansber@hotmail.com HTTP 302
https://signup.wealthyretirement.com/coregconfirmation/X302XA24?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5B253323%5D&MultivariateId=1876604&oneClick=true HTTP 301
https://pro.oxfordincomeletter.com/m/1872196?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true HTTP 301
https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 100

https://rp.liadm.com/j?tna=v2.1.0&aid=a-03e6&wpn=lc-bundle&pu=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&duid=84f9f284006b--01fjnjjxwadrptey31qbqc8yf9&se=e30&dtstmp=1634959194163 HTTP 302
https://rp4.liadm.com/j?tna=v2.1.0&aid=a-03e6&wpn=lc-bundle&pu=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&duid=84f9f284006b--01fjnjjxwadrptey31qbqc8yf9&se=e30&dtstmp=1634959194163&i6=MmEwMTo0Zjg6MjEyOjc4ZToyZjo6MQ%3D%3D&n3pc=true

Request Chain 104

https://gum.criteo.com/sid/json?origin=onetag&domain=oxfordincomeletter.com&sn=ChromeSyncframe&so=0&topUrl=pro.oxfordincomeletter.com&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=25k5FHwyY2FVMFBiNkF0MWN5K2ZXcEM0UTR0UElrc1ZZKzdQQkRkWGJKVEF1UGRVbm9UQTN3RG9mRHhGR05qTWtoU29zUzhmSWxkODZQSnV0WEFvKzZTZmFCeXQzNjQ4bnFiVlc3WU02Mkp4dEExcnR4MlBzWSsxRFp6LzdPZDlDWkJYZEN4akppQTZwcDJST0FrZXpoYkhTK1NaU1dQT3J5ZENMR25PNDJDc3lGUFhyaEt3RXQvZFgyY0ZEeitXbUZDK1FVRlpPZFFOVlZXcm1OS2JQSHA2ZFdhOE5aR2hQUjhaMy94T25rYUsreWJhN0tMNWp1ZWNHcnVOdlRVbm9XbVBKbjMzcWQvZE5jczgvZFNiZDFVM2JoNVF1ZXB2UDEvTEdXYzczR2I0NjdXWT18&cppv=2

Request Chain 138

https://sslwidget.criteo.com/event?a=90311&v=5.8.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&bundle=kcWodF9EamhlNmFtSGo4NDFXTUVsRzdURW1zRm8wZXJtT2g4UllsNXJKeWpTcmFjbzlGWnM1aE5LZ1diMjh3Q0RMWExHUjh0NjhYczlRUjVTaTJQd3Zsd3F2UUVIWU5aWmpiNnZqVDU0MmljSXZoRVBKMVZPRmJSR0pQV0t2ZkszTSUyQm8yTVNOak1za2RtZmRGeWxGcGIlMkZ1b3J3RXlMczR1THVaJTJCdnpQc1dJSm9KcEUlM0Q&tld=oxfordincomeletter.com&dtycbr=96254 HTTP 302
https://widget.us.criteo.com/event?a=90311&v=5.8.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&bundle=kcWodF9EamhlNmFtSGo4NDFXTUVsRzdURW1zRm8wZXJtT2g4UllsNXJKeWpTcmFjbzlGWnM1aE5LZ1diMjh3Q0RMWExHUjh0NjhYczlRUjVTaTJQd3Zsd3F2UUVIWU5aWmpiNnZqVDU0MmljSXZoRVBKMVZPRmJSR0pQV0t2ZkszTSUyQm8yTVNOak1za2RtZmRGeWxGcGIlMkZ1b3J3RXlMczR1THVaJTJCdnpQc1dJSm9KcEUlM0Q&tld=oxfordincomeletter.com&dtycbr=96254

Request Chain 149

https://gum.criteo.com/sync?c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397596.gif%3Fpartner_uid%3D%40USERID%40 HTTP 302
https://idsync.rlcdn.com/397596.gif?partner_uid=fyADNVNm_E9FMQnDOVqTaf0lmwY36Mtq

Request Chain 150

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&google_hm=ay1sWjM1alcyUk1zVkozNkZmUktCRnFnNEVPV21IM3VKcnplajMyUQ HTTP 302
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0

Request Chain 151

https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-lZ35jW2RMsVJ36FfRKBFqg4EOWmH3uJrzej32Q&custom=&tag_format=img&tag_action=sync&custom=&cb=c36bd4dc-f3a2-4410-a242-f382526389e4 HTTP 302
https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-lZ35jW2RMsVJ36FfRKBFqg4EOWmH3uJrzej32Q&custom%5B0%5D=&custom%5B1%5D=&tag_format=img&tag_action=sync&cb=c36bd4dc-f3a2-4410-a242-f382526389e4&final=true&reqid=1828a3e0-33b0-11ec-84f1-9723c735f6f8&timestamp=2021-10-23T03%3A19%3A55.423Z

Request Chain 152

https://pixel.tapad.com/idsync/ex/receive?partner_id=2926&partner_device_id=k-lZ35jW2RMsVJ36FfRKBFqg4EOWmH3uJrzej32Q HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2926&partner_device_id=k-lZ35jW2RMsVJ36FfRKBFqg4EOWmH3uJrzej32Q

Request Chain 160

https://secure.adnxs.com/setuid?entity=52&code=k--L8HxW2RMsVJ36FfRKBFqg4EOWl8ug0rcla7lQ&seg=95287 HTTP 307
https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk--L8HxW2RMsVJ36FfRKBFqg4EOWl8ug0rcla7lQ%26seg%3D95287

Request Chain 161

https://x.bidswitch.net/sync?dsp_id=46&user_id=k--L8HxW2RMsVJ36FfRKBFqg4EOWl8ug0rcla7lQ&expires=30&user_group=5 HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k--L8HxW2RMsVJ36FfRKBFqg4EOWl8ug0rcla7lQ&expires=30&user_group=5

Request Chain 165

https://eb2.3lift.com/xuid?mid=2711&xuid=k-of-FhG2RMsVJ36FfRKBFqg4EOWmTqrsk5qm7iQ&dongle=013b HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-of-FhG2RMsVJ36FfRKBFqg4EOWmTqrsk5qm7iQ&dongle=013b&gdpr=1&cmp_cs=&us_privacy=

Request Chain 166

https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-GIMbuG2RMsVJ36FfRKBFqg4EOWmLffZzL1CXDw HTTP 302
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-GIMbuG2RMsVJ36FfRKBFqg4EOWmLffZzL1CXDw&C=1

Request Chain 167

https://an.yandex.ru/mapuid/criteois/k-F1Rnd22RMsVJ36FfRKBFqg4EOWnpPKNgrYxQug HTTP 302
https://an.yandex.ru/mapuid/criteois/k-F1Rnd22RMsVJ36FfRKBFqg4EOWnpPKNgrYxQug?redir-setuniq=1

Request Chain 173

https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-FNtnT22RMsVJ36FfRKBFqg4EOWngBxPGcrIYrg HTTP 302
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-FNtnT22RMsVJ36FfRKBFqg4EOWngBxPGcrIYrg

Request Chain 181

https://secure.adnxs.com/seg?add=95287&redir=https%3A%2F%2Fsecure.adnxs.com%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID HTTP 302
https://secure.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID HTTP 302
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=8467823575902685008

Request Chain 186

https://s.adroll.com/j/exp/LIFCQSNANBDWJACZ7X23HF/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 187

https://s.adroll.com/j/pre/LIFCQSNANBDWJACZ7X23HF/4QTXPFOTHVG5LA2UNKBHDZ/fpconsent.js HTTP 302
https://s.adroll.com/j/pre/index.js

203 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request

Cookie set / Show response
pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/
Redirect Chain

http://links.daily.the7at7.com/u/click?_t=a06929ac1a5d4b2db9017bb4103688c8&_m=46e330cce23748aab82b39c512e297ad&_e=qqGlwdiaJGMV83pzzzsHDUyoKKzDYjXYvJzKxXkjCAINkbkiaZ21exMob8WqkPfiueFATccggVF-lRnbsaN...
https://api.smartdataprocessor.com/leadintake?id=LM1246&email=timmermansber%40hotmail.com&siteId=318&nlp=318
https://signup.wealthyretirement.com/Content/SaveFreeSignups?MultivariateId=1876604&oneClick=true&email=timmermansber@hotmail.com
https://signup.wealthyretirement.com/coregconfirmation/X302XA24?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5B253323%5D&MultivariateId=1876604&oneClick=true
https://pro.oxfordincomeletter.com/m/1872196?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true
https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

46 KB
21 KB

130ms
129ms

Document
text/html

192.135.136.168
14WEST-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.135.136.168 , United States, ASN11372 (14WEST-AS, US),

Reverse DNS

Software

Resource Hash

4ebfcf12dab4fdbbdcd57892e99792d15e15a3581b39f46926bbb5979d8f1b5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Host: pro.oxfordincomeletter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Cookie: 1872196=2206428; BIGipServerIRIS_PROD_HTTPS_POOL=!v2meOUdU73gdMxRj65n2UeQdagOpw1NYdfnw1jVr58GhnycGboMO49UbovMrwGBK312UP06ClsN0gKU=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
Set-Cookie: WBRKXA00=; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/; HttpOnly
Referrer-Policy: no-referrer-when-downgrade
Date: Sat, 23 Oct 2021 03:19:52 GMT
Content-Length: 20688
Strict-Transport-Security: max-age=63072000; includeSubDomains

Redirect headers

Cache-Control: private
Content-Type: text/html; charset=utf-8
Location: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Set-Cookie: 1872196=2206428; expires=Fri, 12-Nov-2021 04:19:52 GMT; path=/; HttpOnly BIGipServerIRIS_PROD_HTTPS_POOL=!v2meOUdU73gdMxRj65n2UeQdagOpw1NYdfnw1jVr58GhnycGboMO49UbovMrwGBK312UP06ClsN0gKU=; path=/; Httponly; Secure
Date: Sat, 23 Oct 2021 03:19:52 GMT
Content-Length: 9963
Strict-Transport-Security: max-age=63072000; includeSubDomains

GET
H/1.1 200
OK all.js Show response
portrait-tracker.s3.amazonaws.com/ 31 KB
31 KB 405ms
114ms Script
application/javascript 52.217.163.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://portrait-tracker.s3.amazonaws.com/all.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.163.201 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: f5c6b458bcbddc02e7a178b1c4359e0b4aa5c041e5dcd0384657a69c905cacfa

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:53 GMT
Last-Modified: Fri, 15 Oct 2021 16:48:31 GMT
Server: AmazonS3
x-amz-request-id: RF7Z5C99077TGAMJ
ETag: "69b107d7d0cf4ac420e45403398776da"
Content-Type: application/javascript
x-amz-version-id: K61QBGFDvkKd_LF7JBmbVnLyiRvl4QS_
Accept-Ranges: bytes
Content-Length: 31319
x-amz-id-2: bomaqYtUGoJoDBeRwiVWLbZEfE1GoZbENlOQvrQBgu8V8s+gHDI+lwGC+wHjoP9dx/6x2+nr180=

GET
H/1.1 200
OK Common.js Show response
pro.oxfordincomeletter.com/p/Scripts/ 2 KB
1 KB 166ms
96ms Script
application/javascript 192.135.136.168
14WEST-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pro.oxfordincomeletter.com/p/Scripts/Common.js

Requested by

Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.135.136.168 , United States, ASN11372 (14WEST-AS, US),

Reverse DNS

Software

Resource Hash

86034bbe69eebb0c08660ff7f0128dd0bd1d852176489ca3a3da7b49bd647cbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Cookie: 1872196=2206428; BIGipServerIRIS_PROD_HTTPS_POOL=!v2meOUdU73gdMxRj65n2UeQdagOpw1NYdfnw1jVr58GhnycGboMO49UbovMrwGBK312UP06ClsN0gKU=; WBRKXA00=
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:52 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 31 Mar 2020 05:43:09 GMT
ETag: "1be39421f7d61:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: no-cache
Strict-Transport-Security: max-age=63072000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 1140

GET
H/1.1 200
OK HideContent.js Show response
pro.oxfordincomeletter.com/p/Scripts/ 724 B
857 B 263ms
97ms Script
application/javascript 192.135.136.168
14WEST-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pro.oxfordincomeletter.com/p/Scripts/HideContent.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.135.136.168 , United States, ASN11372 (14WEST-AS, US),

Reverse DNS

Software

Resource Hash

809a6bdcc35b316bf93316955e29816c41204f9bcc5fefb53d8a075bba2ee6ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Cookie: 1872196=2206428; BIGipServerIRIS_PROD_HTTPS_POOL=!v2meOUdU73gdMxRj65n2UeQdagOpw1NYdfnw1jVr58GhnycGboMO49UbovMrwGBK312UP06ClsN0gKU=; WBRKXA00=
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:52 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 02 Feb 2018 07:05:29 GMT
ETag: "9d768e35f49bd31:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: no-cache
Strict-Transport-Security: max-age=63072000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 466

GET
H2 200 css2
fonts.googleapis.com/ 17 KB
2 KB 40ms
18ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Merriweather:ital,wght@0,700;1,700&family=Source+Sans+Pro:ital,wght@0,400;0,600;0,700;0,900;1,400;1,700&display=swap

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5e9a9a65ba525edd4f17e3872079fd67007a3ba3b8247ba6d59d44c8097528c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 23 Oct 2021 03:19:52 GMT
server: ESF
date: Sat, 23 Oct 2021 03:19:52 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Sat, 23 Oct 2021 03:19:52 GMT

GET
H2 200 bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/ 157 KB
25 KB 38ms
19ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Origin: https://pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:52 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 565, 617, 617
age: 7371404
cdn-cachedat: 2021-06-08 14:20:02
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:10 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: a759db8dee1fefe1f6563c0c48e6d3f6
cf-ray: 6a27d38998be6951-FRA
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H2 200 animate.min.css
cdnjs.cloudflare.com/ajax/libs/animate.css/4.0.0/ 70 KB
5 KB 32ms
13ms Stylesheet
text/css 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/animate.css/4.0.0/animate.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb2798553d86c6b1806d208320f645bd79eab0cebcf22176bddbc648e8f3ccd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:52 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3459577
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 4216
timing-allow-origin: *
last-modified: Thu, 07 May 2020 16:26:16 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb436a8-11848"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RliYUnZRyBsvqqQ0l8VfSd7cyGdtBd3xr8tOT0ZacACNplnSxgqJjOAQYu1f594cqsWbvNBk6aG0%2BqbC%2BbPJrdHdh57eu3%2BznZyZNh9LJEnD%2FcA5CVchhNGlvHHlqkwV7NuNCH88ziedgVkyCDZ16EGc"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6a27d389af996903-FRA
expires: Thu, 13 Oct 2022 03:19:52 GMT

GET
H/1.1 200
OK brk-forever.css
s3.amazonaws.com/assets.oxfordclub.com/promo/brk/forever/ 25 KB
25 KB 425ms
120ms Stylesheet
text/css 54.231.98.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.amazonaws.com/assets.oxfordclub.com/promo/brk/forever/brk-forever.css
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.231.98.83 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: db976b4527d25fe48cdf9a1c34c6520f7cad96f901e4534938f570230c105319

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:53 GMT
Last-Modified: Wed, 15 Sep 2021 19:48:03 GMT
Server: AmazonS3
x-amz-request-id: RF7RK9E32XT0ZH3B
ETag: "aef474facc0b0c0aafca879416a71c11"
Content-Type: text/css
x-amz-version-id: j6YdDNobtkBYwC.DlNDl1KY3.jlPO37Y
Accept-Ranges: bytes
Content-Length: 25562
x-amz-id-2: +5Mh58abhR9q/IVC4ecn9r7uwF7Mw6U+IdfwY0qwHw1LmmZ5dL4+qQ6PCumikNCvNPZhqnQHLd4=

GET
H2 200 jquery-3.3.1.min.js Show response
code.jquery.com/ 85 KB
30 KB 35ms
9ms Script
application/javascript 2001:4de0:ac18::1:a:1b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.3.1.min.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Origin: https://pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:52 GMT
content-encoding: gzip
last-modified: Sat, 20 Jan 2018 17:26:44 GMT
server: nginx
etag: W/"5a637bd4-1538f"
vary: Accept-Encoding
x-hw: 1634959192.dop029.fr8.t,1634959192.cds217.fr8.hn,1634959192.cds002.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30288

GET
H2 200 E-v1.js Show response
fast.wistia.com/assets/external/ 620 KB
118 KB 66ms
5ms Script
application/javascript 2a04:4e42:200::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/E-v1.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::622 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

10b3216083586185ff739310fb1bf46c7d30233d09e19c65bb97532ba7ab2924

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:53 GMT
content-encoding: br
vary: Accept-Encoding
age: 1512
x-cache: HIT, HIT
content-length: 120484
x-served-by: cache-dca17765-DCA, cache-fra19183-FRA
access-control-allow-origin: *
x-browser-version: 93
last-modified: Fri, 22 Oct 2021 18:08:10 GMT
x-timer: S1634959193.148278,VS0,VE0
etag: "6172fe0a-1d6a4"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 42

GET
H/1.1 200
OK promo.js Show response
portrait-tracker.s3.amazonaws.com/ 18 KB
19 KB 444ms
130ms Script
application/javascript 52.217.163.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://portrait-tracker.s3.amazonaws.com/promo.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.163.201 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: f579d0d389fc9ed1155d98638ef89a78721c0103ca5fbdc4d38f16a0a2515e0b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:53 GMT
Last-Modified: Tue, 12 Oct 2021 14:49:09 GMT
Server: AmazonS3
x-amz-request-id: RF7RB2ASJKP70471
ETag: "b64efa1f2a231ac9935a3f227d1b6969"
Content-Type: application/javascript
x-amz-version-id: 3hF1eIEuvb3lUaugNSh7k3Nw1G0YON87
Accept-Ranges: bytes
Content-Length: 18637
x-amz-id-2: 7dYIoTXq4eRA1nOu6xEz1qgu1imgWJUUJk9o8ZpSOUpJ0hJS3cRAC8laPkYqCjAT9cHg6Lv8fy0=

GET
H2 200 latest.min.js Show response
c.lytics.io/api/tag/9c32784e3cc4888a693a7988ad64c63d/ 64 KB
22 KB 72ms
22ms Script
application/javascript 2606:4700:20::ac43:49ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.lytics.io/api/tag/9c32784e3cc4888a693a7988ad64c63d/latest.min.js

Requested by

Host: portrait-tracker.s3.amazonaws.com
URL: https://portrait-tracker.s3.amazonaws.com/all.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:49ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ba39a3d7be55a120f9ab47147f0ef2e2acaf539e0876fa262749702d3dda8fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:53 GMT
via: 1.1 google
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2381
content-encoding: br
last-modified: Sat, 23 Oct 2021 02:40:12 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000;
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EMSj7Kp0RwRsl2B13aBgGJIfIKygrzFFddb06EPxX4BkVc1Z1PVXWjU%2BxufPlwgf1QG7eoL2nvNwD8BZUJk1mtDfFVdm7OWR9HtHVFV%2BUQC6TYk5aqyXwWZK2iaIDG0RU5c1yM0cF64k"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=7200
cf-ray: 6a27d38d4fd86389-FRA

GET
H/1.1 200
OK blueshift.js Show response
cdn.getblueshift.com/ 4 KB
2 KB 57ms
10ms Script
application/javascript 18.66.97.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.getblueshift.com/blueshift.js
Requested by: Host: portrait-tracker.s3.amazonaws.com
URL: https://portrait-tracker.s3.amazonaws.com/all.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01fcf88d0ee0ff3cc10a948024394b5a87004538985081ca233b7a95ff286a12

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:04:52 GMT
Content-Encoding: gzip
Connection: keep-alive
Last-Modified: Tue, 14 Sep 2021 21:58:07 GMT
Server: AmazonS3
Age: 903
ETag: "a3a9cba0964243c154ed1cbda397de87"
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
Cache-Control: max-age=3600
X-Amz-Cf-Pop: FRA56-P2
Accept-Ranges: bytes
Content-Length: 1960
X-Amz-Cf-Id: Q2oEm9OxcET50NOVsqr4KJGvwmFxM1HdqmbM098_cRNedNbMzzMoBQ==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 228 KB
67 KB 80ms
31ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KTM4C7C

Requested by

Host: portrait-tracker.s3.amazonaws.com
URL: https://portrait-tracker.s3.amazonaws.com/all.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2975b0127d5a785865cead3c21b26c02e2a92ccb0086dd063a8dd71584ad739d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:53 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 68272
x-xss-protection: 0
last-modified: Sat, 23 Oct 2021 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 23 Oct 2021 03:19:53 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 16 KB
16 KB 50ms
6ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Merriweather:ital,wght@0,700;1,700&family=Source+Sans+Pro:ital,wght@0,400;0,600;0,700;0,900;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efb3cdc5e4582fd67dffab6fc6e5062074ce3f8c51747346af944e97749dc309

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 21 Oct 2021 21:28:54 GMT
x-content-type-options: nosniff
age: 107459
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15948
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:32 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Fri, 21 Oct 2022 21:28:54 GMT

GET
H2 200 u-4n0qyriQwlOrhSvowK_l52xwNZWMf6.woff2
fonts.gstatic.com/s/merriweather/v25/ 19 KB
19 KB 56ms
12ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/merriweather/v25/u-4n0qyriQwlOrhSvowK_l52xwNZWMf6.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Merriweather:ital,wght@0,700;1,700&family=Source+Sans+Pro:ital,wght@0,400;0,600;0,700;0,900;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ecaf445d3f1e63f15b6e423e287813a5675461cc9454184d0b49123b286cea4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 23:43:17 GMT
x-content-type-options: nosniff
age: 185796
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 19696
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:22:18 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 20 Oct 2022 23:43:17 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 15 KB
16 KB 62ms
18ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Merriweather:ital,wght@0,700;1,700&family=Source+Sans+Pro:ital,wght@0,400;0,600;0,700;0,900;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

24f7e397faec79e62c37ff2f00b170f6dc1557fb46ac169f9f1897a9d641dd03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 22 Oct 2021 04:16:28 GMT
x-content-type-options: nosniff
age: 83005
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15764
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:17 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 22 Oct 2022 04:16:28 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 16 KB
16 KB 59ms
16ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Merriweather:ital,wght@0,700;1,700&family=Source+Sans+Pro:ital,wght@0,400;0,600;0,700;0,900;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 17 Oct 2021 11:16:30 GMT
x-content-type-options: nosniff
age: 489803
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:09 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Mon, 17 Oct 2022 11:16:30 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3iu4nwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 15 KB
15 KB 54ms
11ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3iu4nwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Merriweather:ital,wght@0,700;1,700&family=Source+Sans+Pro:ital,wght@0,400;0,600;0,700;0,900;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4ba0f48573cc9e7e9c073582fa327ed9682680e5e00a667c138881cc5709739d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 22 Oct 2021 03:39:18 GMT
x-content-type-options: nosniff
age: 85235
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15324
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:40 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 22 Oct 2022 03:39:18 GMT

GET
H/1.1 200
OK index.html Show response
portrait-tracker.s3.amazonaws.com/ Frame D53C 2 KB
2 KB 116ms
115ms Document
text/html 52.217.163.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://portrait-tracker.s3.amazonaws.com/index.html
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.163.201 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 5ee751181a92cf6d2531e6a3db04c385b52b835e6b9a977fe5da9a6dad7ae5b6

Request headers

Host: portrait-tracker.s3.amazonaws.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

x-amz-id-2: ehLgjBAXtSM7LPhPr8WZGi9rOk4QMq77PcWHYCwyT3F5OgWyFx9QRkEsBt6IyYxjXzdfTLq8I8M=
x-amz-request-id: 0EM1HRRH3TQ7AS74
Date: Sat, 23 Oct 2021 03:19:54 GMT
Last-Modified: Mon, 20 Sep 2021 14:58:54 GMT
ETag: "3901af45178e824780ab44d4d3aac075"
x-amz-version-id: Rcd5U5QarfiWjyeqgFy3uki5SfUHDF6C
Accept-Ranges: bytes
Content-Type: text/html
Server: AmazonS3
Content-Length: 1953

GET
H2 200 fa07dx1uzu.json Show response
fast.wistia.com/embed/medias/ 76 KB
28 KB 12ms
7ms Script
text/javascript 2a04:4e42:200::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/embed/medias/fa07dx1uzu.json?callback=wistiajson1

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::622 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

5aca5af8d733c500076eed0bbe2f3e2fe2661fe20c613800725a71e66fd5199c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:53 GMT
content-encoding: br
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
age: 67529
x-cache: HIT, HIT
p3p: CP="CURi ADMa DEVa IVAa IVDa CONi OUR IND DSP CAO COR"
vary: Accept-Encoding,X-Forwarded-Proto,X-ECMA-Override
content-length: 28283
x-request-id: f5b8b4ef2df66ae4605293822d6e3cef
x-served-by: cache-dca17764-DCA, cache-fra19183-FRA
x-runtime: 0.072748
access-control-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
x-timer: S1634959193.422355,VS0,VE1
etag: W/"5aca5af8d733c500076eed0bbe2f3e2f"
x-download-options: noopen
strict-transport-security: max-age=0
content-type: text/javascript; charset=utf-8
via: 1.1 varnish (Varnish/6.0), 1.1 varnish, 1.1 varnish
cache-control: public, no-cache
x-browser: chrome
x-browser-version: 93
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 1

GET
H2 200 aae40e4a-7c7c-44df-9bdd-715db5955789 Show response
c.lytics.io/api/personalize/9c32784e3cc4888a693a7988ad64c63d/user/_uid/ 28 KB
5 KB 160ms
156ms Script
application/json 2606:4700:20::ac43:49ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.lytics.io/api/personalize/9c32784e3cc4888a693a7988ad64c63d/user/_uid/aae40e4a-7c7c-44df-9bdd-715db5955789?segments=true&fields=pub_circulation_status,su_list_email_status,bi_ltv&mergestate=true&state=%7B%22_uid%22%3A%22aae40e4a-7c7c-44df-9bdd-715db5955789%22%2C%22_sesstart%22%3A%221%22%2C%22_tz%22%3A0%2C%22_ul%22%3A%22en-US%22%2C%22_sz%22%3A%221600x1200%22%2C%22_nmob%22%3A%22t%22%2C%22_device%22%3A%22desktop%22%2C%22url%22%3A%22pro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue%22%2C%22_v%22%3A%223.0.24%22%7D&ts=1634959193369&callback=u_652158658156249100

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:49ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f82ee536f31f8474c7c42ce6da4e2dafe810c4942328e7711a7e823c0e328808

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

cf-ray: 6a27d38efff96389-FRA
date: Sat, 23 Oct 2021 03:19:53 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000;
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cg07rU12%2FM%2Bl%2FOQclTJHcn5pdp%2BkqYngp5AEYK7wZGBCh1J8QlvIA735W5yU6GfW1mGc4cuH7GxpKjryaoFRAfR7dPWsQb9OU3ccm1WpXo%2BHr3LHrxybc%2Bf1gd1TVbfFPzZszI%2FObkIp"}],"group":"cf-nel","max_age":604800}
content-encoding: br
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Cookie, *

GET
H2 200 9c32784e3cc4888a693a7988ad64c63d
c.lytics.io/c/ 35 B
550 B 129ms
125ms Image
image/gif 2606:4700:20::ac43:49ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.lytics.io/c/9c32784e3cc4888a693a7988ad64c63d?_e=pv&_sesstart=1&_tz=0&_ul=en-US&_sz=1600x1200&_ts=1634959193356&_nmob=t&_device=desktop&url=pro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&_v=3.0.24&_uid=aae40e4a-7c7c-44df-9bdd-715db5955789&_getid=t

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:49ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:53 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-methods: GET, POST
content-length: 35
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000;
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G8ipHkkzJQCqJUUnXxXVVnvzbNktIFNuEMEa9yH%2FQ1Yz%2B%2Bp06sBnEmTtmmkXgMEODt83X4g7E4bAPGqJ1gs2Kn85o0bKfo5h6NGRlrnJjegTqZ3CKkKXZt1GFmMgKzswT3eOc28shHaj"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cf-ray: 6a27d38efffa6389-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Cookie, *
expires: 0

GET
H2 200 captions.js Show response
fast.wistia.com/assets/external/ 162 KB
27 KB 18ms
17ms Script
application/javascript 2a04:4e42:200::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/captions.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::622 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4974446145a917190b705f6575a0dba54fafa0acead60a10d226edb25aa60816

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:53 GMT
content-encoding: br
vary: Accept-Encoding
age: 1512
x-cache: HIT, HIT
content-length: 27304
x-served-by: cache-dca17778-DCA, cache-fra19183-FRA
access-control-allow-origin: *
x-browser-version: 93
last-modified: Fri, 22 Oct 2021 18:08:10 GMT
x-timer: S1634959194.516504,VS0,VE0
etag: "6172fe0a-6aa8"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 3

GET
H/1.1 200
OK WBRKXA00 Show response
pro.oxfordincomeletter.com/p/effortattributes/extractEffortattributes/ 747 B
1 KB 106ms
105ms XHR
application/json 192.135.136.168
14WEST-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pro.oxfordincomeletter.com/p/effortattributes/extractEffortattributes/WBRKXA00

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.135.136.168 , United States, ASN11372 (14WEST-AS, US),

Reverse DNS

Software

Resource Hash

afea74943b3dc591c3bd417429c55e87f9dc9ad5e39ba712e282a5778ac19960

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Pragma: no-cache
X-NewRelic-ID: Uw8EVVVTGwcGV1VUDwEP
Accept-Encoding: gzip, deflate, br
Host: pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Site: same-origin
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: empty
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Cookie: 1872196=2206428; BIGipServerIRIS_PROD_HTTPS_POOL=!v2meOUdU73gdMxRj65n2UeQdagOpw1NYdfnw1jVr58GhnycGboMO49UbovMrwGBK312UP06ClsN0gKU=; WBRKXA00=; seerses=e; seerid=aae40e4a-7c7c-44df-9bdd-715db5955789
Connection: keep-alive
Sec-Fetch-Mode: cors
X-NewRelic-ID: Uw8EVVVTGwcGV1VUDwEP
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:53 GMT
Referrer-Policy: no-referrer-when-downgrade
X-NewRelic-App-Data: PxQAWFVXCwMTUFdRAwcPVlwTGhE1AwE2QgNWEVlbQFtcCxYsZyIcJwJQWBMSIkxHQg0DF0NURCULX0JBDQoPB0JNfRpMSlVRRyBfB14TRyMQQkUIBBZMVkNGTVIZARtWSgEGB1ZVU1ocTwlOGn1xdAAgDCcII3EjVAQAICBBFFVRCBIHag==
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private
Content-Length: 747

OPTIONS
H2 200 GetLyticsUserData
dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/ Frame 0
0 334ms
277ms Preflight
application/json 18.66.122.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/GetLyticsUserData
Protocol: H2
Server: 18.66.122.78 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://pro.oxfordincomeletter.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-type: application/json
content-length: 3
date: Sat, 23 Oct 2021 03:19:53 GMT
x-amzn-requestid: 19ab6e37-f3c8-4b92-9874-7aa29058d608
access-control-allow-origin: *
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
x-amz-apigw-id: HpDWDGzKIAMF49Q=
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
x-cache: Miss from cloudfront
via: 1.1 da4de4427d18bee1d3254f1bbdad25f2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
x-amz-cf-id: uZ8jFe5j2eH6bIocqrZuRZ2YfXzT0RmQVWnU_olGOVs6QNFNJCEL2w==

POST
H2 200 GetLyticsUserData Show response
dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/ 16 KB
16 KB 514ms
513ms XHR
application/json 18.66.122.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/GetLyticsUserData
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.78 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4a64b8e41c0c6c0d67835f0330e18af8990685557fb203cd2276fe556561d0c4

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
via: 1.1 da4de4427d18bee1d3254f1bbdad25f2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
x-amzn-requestid: 56155f23-3918-4dfa-9cf2-17a5217b3465
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
content-type: application/json
access-control-allow-origin: *
x-amzn-trace-id: Root=1-61737f5a-08ab010f33ee082f047cb5e3;Sampled=0
x-cache: Miss from cloudfront
x-amz-apigw-id: HpDWGGQ0IAMFavQ=
content-length: 15899
x-amz-cf-id: 3sCLJ0AkTVIFMxcNPC7g98xVwFqw9wldezx8tmK_ApvzMklG-jabiQ==
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET
H2 200 fa07dx1uzu.json Show response
fast.wistia.com/embed/captions/ 140 KB
43 KB 107ms
104ms Script
text/javascript 2a04:4e42:200::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/embed/captions/fa07dx1uzu.json?callback=wistiajson2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::622 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

88d3b8fe59e5a88b413fe60386adedb716aeeda8f9ee09bc192115f06f399963

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:53 GMT
content-encoding: br
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
age: 256
x-cache: HIT, MISS
p3p: CP="CURi ADMa DEVa IVAa IVDa CONi OUR IND DSP CAO COR"
vary: Accept-Encoding,X-Forwarded-Proto,Accept-Language
content-length: 43134
x-request-id: 465add0a69bf8a455de41d2f03a9d9a9
x-served-by: cache-dca17724-DCA, cache-fra19183-FRA
x-runtime: 0.060749
access-control-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
x-timer: S1634959194.574576,VS0,VE97
etag: W/"88d3b8fe59e5a88b413fe60386adedb7"
x-download-options: noopen
strict-transport-security: max-age=0
content-type: text/javascript; charset=utf-8
via: 1.1 varnish (Varnish/6.0), 1.1 varnish, 1.1 varnish
cache-control: public, no-cache
x-browser: chrome
x-browser-version: 93
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 0

GET
H/1.1 200
OK 9208e8f4fb913f1bab1f85b25b49d48d.webp
embedwistia-a.akamaihd.net/deliveries/ 148 KB
148 KB 93ms
14ms Image
image/webp 2.16.186.8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://embedwistia-a.akamaihd.net/deliveries/9208e8f4fb913f1bab1f85b25b49d48d.webp?image_crop_resized=1920x1080
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.8 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-8.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ca5cdb970cfc816c8e7d271693c21aeee58d9ff6d2111f11ccbd363bdba1f4f5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:53 GMT
Access-Control-Request-Method: *
surrogate-key: 9208e8f4fb913f1bab1f85b25b49d48d thumbnail-delivery
Last-Modified: Thu, 23 Sep 2021 17:29:07 UTC
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: image/webp
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Origin, Content-Type, Accept, Server, x-amz-version-id, X-Cache
Cache-Control: max-age=30227132
content-disposition: inline
Connection: keep-alive
Accept-Ranges: none
Content-Length: 151448

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 124 KB
48 KB 24ms
23ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-4H7QL840N8&l=dataLayer&cx=c

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d2f346ee82d5d62dd85ab86af1294ee262487f0fd749bd0c832305b97f801595

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:53 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 49458
x-xss-protection: 0
expires: Sat, 23 Oct 2021 03:19:53 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 34ms
7ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fc27aed7787a4f63d2feba50e6bc6122ac3c5479456d40c0a445899a08ad92f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 19 Oct 2021 16:47:48 GMT
server: Golfe2
age: 4727
date: Sat, 23 Oct 2021 02:01:06 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 19887
expires: Sat, 23 Oct 2021 04:01:06 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 193 KB
49 KB 41ms
40ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NKXCSCL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d2022d29ec3b5750bf27e9338e47fcbdeb28c791c753cf1b59f678dc68066940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:53 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 50186
x-xss-protection: 0
last-modified: Sat, 23 Oct 2021 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 23 Oct 2021 03:19:53 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 218 KB
67 KB 36ms
36ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WP5R8BX

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

49f8fefaf9769967f1dbf2ac4cc7d025e9dd2c9e8746f27db4b956d95193aff3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:53 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 68816
x-xss-protection: 0
last-modified: Sat, 23 Oct 2021 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 23 Oct 2021 03:19:53 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 34 KB
10 KB 71ms
35ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: d891455e32c9a425e36e190047b1f58abeb7e3709eff687134ddea7ac9cfdd3b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:53 GMT
content-encoding: gzip
last-modified: Wed, 06 Oct 2021 19:11:47 GMT
x-msedge-ref: Ref A: 3189570229494DBCA2E87FFF90FAE2F0 Ref B: FRAEDGE1421 Ref C: 2021-10-23T03:19:53Z
etag: "805b72e6bad71:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 10001

GET
H2 200 cm
trc.taboola.com/sg/lytics/1/ 43 B
238 B 49ms
14ms Image
image/gif 2a04:4e42:600::300
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/lytics/1/cm?redirect=https%3A%2F%2Fc.lytics.io%2Fc%2Fprovider%2Ftaboola%3Ftaboola_id%3D%3CTUID%3E%26_uid%3Daae40e4a-7c7c-44df-9bdd-715db5955789%26account_id%3D9c32784e3cc4888a693a7988ad64c63d
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::300 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 0d9762a1a60deef8aa093c473ad27c38eed77184d6940e7df06d89d77cbd3e94

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-vcl-time-ms: 9
pragma: no-cache
date: Sat, 23 Oct 2021 03:19:53 GMT
via: 1.1 varnish
server: nginx
x-timer: S1634959194.727168,VS0,VE9
x-served-by: cache-fra19155-FRA
x-cache: MISS
cache-control: no-cache, no-store
accept-ranges: bytes
x-cache-hits: 0

POST
H2 200 portrait Show response
c.lytics.io/c/9c32784e3cc4888a693a7988ad64c63d/ Frame 6709 0
290 B 129ms
124ms Document
text/html 2606:4700:20::ac43:49ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.lytics.io/c/9c32784e3cc4888a693a7988ad64c63d/portrait

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:49ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

:method: POST
:authority: c.lytics.io
:scheme: https
:path: /c/9c32784e3cc4888a693a7988ad64c63d/portrait
content-length: 2324
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
cookie: seerid=aae40e4a-7c7c-44df-9bdd-715db5955789
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Sat, 23 Oct 2021 03:19:53 GMT
content-type: text/html
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Cookie, *
access-control-allow-methods: GET, POST
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
expires: 0
pragma: no-cache
strict-transport-security: max-age=63072000;
via: 1.1 google
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pGNM3LuS7TaZT3VnlFieIpmymyI49%2FpTUoBkD68GUleXQ7cxW3I2Tod%2B%2F1NpbMvPr26zlnQ1zC2YdC%2BfSmceh%2FFtccrXwyjr8uQ83XfcdyeMq5pjfiYZEzbn8AVoKgtEJckCZKNXIS%2BN"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6a27d39098226389-FRA
content-encoding: br

POST
H2 204 collect
www.google-analytics.com/g/ 0
178 B 14ms
13ms Ping
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-4H7QL840N8&gtm=2oeak0&_p=975211064&sr=1600x1200&ul=en-us&cid=188440505.1634959194&_s=1&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&dt=The%20Oxford%20Club&sid=1634959193&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1&ep.clientid=0498b74d-2155-4277-91db-1a6681ebe493&ep.storage=none
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4H7QL840N8&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:53 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
420 B 52ms
15ms XHR
text/plain 2a00:1450:400c:c0c::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j94&tid=UA-148998105-6&cid=0498b74d-2155-4277-91db-1a6681ebe493&jid=1398933737&gjid=1525175591&_gid=533841734.1634959194&_u=YKAAgAABAAAAAE~&z=1132526740

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sat, 23 Oct 2021 03:19:53 GMT
content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
155 B 7ms
6ms Image
image/gif 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j94&a=975211064&t=pageview&_s=1&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&ul=en-us&de=UTF-8&dt=The%20Oxford%20Club&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YKAAgAAB~&jid=1398933737&gjid=1525175591&cid=0498b74d-2155-4277-91db-1a6681ebe493&tid=UA-148998105-6&_gid=533841734.1634959194&gtm=2wgak0KTM4C7C&cd1=WBRKXA00&cd2=1634959192998&cd3=aae40e4a-7c7c-44df-9bdd-715db5955789&cd5=0498b74d-2155-4277-91db-1a6681ebe493&cd6=_870c2m6vwrm&cd7=BRK%20Forever&cd8=W%20-%20Internal%20Website&cd9=Website%20Link&cd10=WX%20-%20Website%20External&cd11=WEALTHRE&cd12=Subscription&cd13=promo%20page&cd14=ForeverTO49%20(Video)%20No%20Abandon&cd16=ForeverTO49%20(Video)&cd17=video&cd18=Website%20Link&cd19=BRK&cd20=FrontEnd&z=1887597753

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Oct 2021 22:14:42 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 18311
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 204 15322609.js Show response
bat.bing.com/p/action/ 0
132 B 318ms
318ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/15322609.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ARR/3.0
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sat, 23 Oct 2021 03:19:54 GMT
cache-control: private,max-age=1800
x-msedge-ref: Ref A: 60A176D14D154E39BD0FAE3450193778 Ref B: FRAEDGE1421 Ref C: 2021-10-23T03:19:53Z
x-powered-by: ARR/3.0
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
149 B 30ms
30ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=15322609&Ver=2&mid=681826ef-95a2-41e2-b977-f87cdc14c21e&sid=1725752033b011ecb264ab66375df3b5&vid=1726e75033b011ecb223077d08548e62&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=The%20Oxford%20Club&p=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&r=&lt=2738&evt=pageLoad&msclkid=N&sv=1&rn=78476
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Sat, 23 Oct 2021 03:19:53 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 9DEE203E7DA34F5E8B8221D0364B84A5 Ref B: FRAEDGE1421 Ref C: 2021-10-23T03:19:53Z
x-cache: CONFIG_NOCACHE
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1246441/ 74 KB
25 KB 230ms
204ms Script
application/javascript 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1246441/tfa.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: be68fc7b9e696fe1d0c94d496e1efaae80fdff6c91f90846a05986b05bad2974

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: 1BOr.DF6FafTrAv2TKnVw0VPmpsYauuQ
content-encoding: gzip
etag: "8bfd817205717cb831fcf2d56bfcef7f"
age: 0
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 24755
x-amz-id-2: 97BPkOK+iDDcgxC7kDaFR2koqT5h8EhP7Y41SouAMV+CN8lLgdd4iVUgR78l6q62BfZBRwt5R1U=
x-served-by: cache-fra19176-FRA
last-modified: Mon, 09 Aug 2021 10:25:51 GMT
server: AmazonS3
x-timer: S1634959194.840476,VS0,VE196
date: Sat, 23 Oct 2021 03:19:54 GMT
vary: Accept-Encoding
x-amz-request-id: V1RQ6XEJNXQ0EZFR
via: 1.1 varnish
cache-control: private,max-age=14401
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 82
x-cache-hits: 1

GET
H2 200 ld.js Show response
static.criteo.net/js/ld/ 41 KB
14 KB 101ms
44ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/ld.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: a1fddf4d5fec5f577b977db5c16c6582c1768324262382650fce903a37d73ab6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:53 GMT
content-encoding: gzip
last-modified: Tue, 05 Oct 2021 08:29:00 GMT
server: nginx
etag: W/"615c0ccc-a373"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 24 Oct 2021 03:19:53 GMT

GET
H2 200 pixel.js Show response
cdn.mediago.io/js/ 50 KB
50 KB 54ms
7ms Script
application/javascript 2600:9000:2250:8600:11:9be7:da80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mediago.io/js/pixel.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:8600:11:9be7:da80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3619564fcb70044c9486cd9e1e6cd1608298be072b370e86245a8e94c40326bf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: null
via: 1.1 f7e6fd9466c5c2a3b15f0fb077de1afa.cloudfront.net (CloudFront)
last-modified: Fri, 19 Mar 2021 06:31:13 GMT
server: AmazonS3
age: 44624
etag: "b9096ce53c2981aca3018eae3e1bed09"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Fri, 22 Oct 2021 14:56:10 GMT
x-amz-cf-pop: FRA60-P2
accept-ranges: bytes
content-length: 50770
x-amz-cf-id: dKhhGKS7sYxM7rzRMUPGcogcA8Zj7A_sNRMhgCqt2BZsjF7RIlcsEw==

GET
H2 200 a-03e6.min.js Show response
b-code.liadm.com/ 26 KB
10 KB 43ms
8ms Script
application/javascript 2600:9000:223c:0:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-03e6.min.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:0:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: ZIO-Http /
Resource Hash: c2617f22bd868fb2c199b2ccaf6df1cf44cb86bfd98427ce79447ca498adf9e3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 22 Oct 2021 08:09:12 GMT
via: 1.1 80a51c83bb9479e2a3aa1ea59b366459.cloudfront.net (CloudFront)
server: ZIO-Http
age: 69041
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=86400
x-amz-cf-pop: FRA56-P2
content-encoding: gzip
x-amz-cf-id: pF4H6Ik4aV4dHdvebQUZFPB0ns0RnPAX5cQ03zmw410pxHxXwivGaQ==

GET
H2 200 theoxfordclub_lander.js Show response
cdn1.lockerdomecdn.com/tracking/ 745 B
1 KB 90ms
7ms Script
application/javascript 2600:9000:223c:4e00:b:6268:b880:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn1.lockerdomecdn.com/tracking/theoxfordclub_lander.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:4e00:b:6268:b880:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4181a1a1202754a6b3bf4bf86f8726fb51d396251654ad7c809f61f7f9664487

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: w.S.KZ5iqal8eH2fQrjJ8KmAu_HOoMbJ
via: 1.1 cb4c4a25e4ef534686959996782c8476.cloudfront.net (CloudFront)
last-modified: Fri, 08 Jan 2021 21:54:50 GMT
server: AmazonS3
age: 38437
etag: "ba9cc8d3ba3137f302e0d39848e07850"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Fri, 22 Oct 2021 16:39:17 GMT
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
content-length: 745
x-amz-cf-id: MiJCfvSVW4nW_hKDwuQICh6GDWBRv4XhSZCrw3GhvBZIvu8GemJHCQ==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
26 KB 24ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4b5e988359c30afd1d84b7a5118296f1fc33f4527d530b096ca27aa7fbfef99a

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 25969
x-xss-protection: 0
pragma: public
x-fb-debug: C6tJ2kp3MXvyVy7DRitbBJvL5LAbwB6fN80TvLTCjDLdNHhPqnNqWfqlGwk6qfcONdRBv9cfVPwjWddPXUqIJA==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Sat, 23 Oct 2021 03:19:53 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 37 KB
15 KB 39ms
16ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

ea0ccf3eab05a27a83fdc3a0c60ede70d4d2f18bf8be6cbdcc221d43ad5686ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14430
x-xss-protection: 0
server: cafe
etag: 16924264664223707549
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 23 Oct 2021 03:19:53 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
69 B 15ms
14ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j94&a=975211064&t=pageview&_s=1&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&ul=en-us&de=UTF-8&dt=The%20Oxford%20Club&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aKDAAEABAAAAAG~&jid=788388072&gjid=919456455&cid=188440505.1634959194&tid=UA-112639049-5&_gid=1979524766.1634959194&_r=1&gtm=2wgak0WP5R8BX&z=890039303

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 14 KB
6 KB 41ms
6ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:53 GMT
content-encoding: gzip
last-modified: Mon, 20 Sep 2021 23:58:10 GMT
etag: "8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-geo-cc_and_ra: DE-HE
cache-control: no-cache
x-cache: HIT, HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 5410
x-served-by: cache-iad-kcgs7200095-IAD, cache-fra19144-FRA

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
68 B 14ms
13ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j94&a=975211064&t=pageview&_s=1&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&ul=en-us&de=UTF-8&dt=The%20Oxford%20Club&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aKDAAEABAAAAAG~&jid=1231872143&gjid=1671054088&cid=188440505.1634959194&tid=UA-148806141-1&_gid=1979524766.1634959194&_r=1&gtm=2wgak0WP5R8BX&z=1423689962

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 mgsensor.js Show response
a.mgid.com/ 12 KB
4 KB 145ms
112ms Script
application/javascript 104.19.133.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.mgid.com/mgsensor.js?d=1634959193818&source=gtm
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.133.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b127181486c082afd048feabd5f69153c3993ccccc57085e4018609ed68f43c3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
content-encoding: br
cf-cache-status: DYNAMIC
x-mg-request-uuid: 8e5821b1-fede-481a-8a98-d3c62786db0e
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 6a27d391f9632c36-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
server: cloudflare

GET
H2 200 hotjar-925909.js Show response
static.hotjar.com/c/ 9 KB
3 KB 26ms
8ms Script
application/javascript 18.66.97.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-925909.js?sv=6

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.97.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

06700a581a344e55ed2950b8ad4be0f9c280da1327dd4cfabf0fee7c829f7c29

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:37 GMT
content-encoding: br
x-content-type-options: nosniff
cache-control: max-age=60
age: 16
etag: W/95e7d292ccab0d4a88866059967f9d72
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
x-amz-cf-pop: FRA56-P2
x-amz-cf-id: EgUS2gU8JTTqPZPY2fuU_b6L6JMek8gwhITgrT_EZvai3R52cOgENA==
via: 1.1 03ffca0f67e3596b9a0c92342fe91598.cloudfront.net (CloudFront)

GET
H2 200 siteanalyze_6255350.js Show response
siteimproveanalytics.com/js/ 48 B
864 B 46ms
15ms Script
application/javascript 2606:4700:3031::ac43:91b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://siteimproveanalytics.com/js/siteanalyze_6255350.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:91b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8708150ed307463ea1670f6644f73ec82e3b6e8d6ff95be629b1ba4727f31ac7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:53 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 144
cf-ray: 6a27d391f8475bfd-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 68
x-amz-id-2: VR4FQhagsbz084HW9KKAHPI0TtXE6br+2Gj6SdB7iqkOBGOrKF9xfksPXqvZA1VyMuew6HbcUhQ=
last-modified: Fri, 23 Aug 2019 22:14:39 GMT
server: cloudflare
etag: "6ef42917cbd55a82896411683d106194"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LfmDjB11yox860YFb71RMR0P9GxGdTz8a%2BZhA%2FlULaHSSp7YtW5uzQ9%2B8yS6RE3QEYUDjwJGjoX1NSbKjVX6Sz8mCWekYGi%2FHjAke5hjp2muv4pNP2xbmG1aIG3HgsIdO6E%2B%2FW2%2F4kxNgzSQeV9cQjhtakbM6I4%3D"}],"group":"cf-nel","max_age":604800}
x-amz-request-id: N4BJHMD443KMNZG2
cache-control: max-age=86400, no-transform
accept-ranges: bytes
content-type: application/javascript; charset=utf-8

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 8 KB
3 KB 34ms
7ms Script
application/x-javascript 2.18.234.190
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-190.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 998d9415269d92557b561a936955f7590d5052865044a9191a528b5a36f3afc9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:53 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Oct 2021 12:12:10 GMT
Server: AkamaiNetStorage
ETag: "973e2603f46b719eecf8139c22b897a0:1633349530.816673"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3150
Expires: Sat, 23 Oct 2021 03:39:53 GMT

GET
H2 200 setup.js Show response
at-api.tribeos.io/a/5e554fee6b742527f85286135595/ 272 KB
73 KB 117ms
55ms Script
application/javascript 104.26.12.105
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://at-api.tribeos.io/a/5e554fee6b742527f85286135595/setup.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.105 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d6f1b5f056c6c046b95445a24615abd8cdbb41a3242e94fbee1b650b66dab0a0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:53 GMT
content-encoding: br
cf-cache-status: STALE
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5072774
access-control-allow-methods: PUT, GET, POST, DELETE, OPTIONS, PATCH
last-modified: Wed, 25 Aug 2021 10:13:39 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4Y4eqKalal5eKoBv49GuRIFIGHi9JBQAHdmL2Q2i%2BAQZvQ6t73YYQei%2F5i2Y24x7uelwH0enE7YyIcC03149dXzoMLH1SpfK1Ai222hTAK3CLGGswHJMxcpmEW1LLvVnRIEl"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Range
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 6a27d3922ede691f-FRA
access-control-allow-headers: authorization, Origin, X-Requested-With, Content-Type, Accept

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 15 KB
6 KB 22ms
7ms Script
application/javascript 2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

b9e6c38b3493790e6525ba6715ad839211cab5db3ddc80c7f70f20f92679fee6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Sat, 23 Oct 2021 03:13:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 385
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 5639
x-amz-id-2: kNLqez4DKuglgf5FWFffMDaPDEmVKSGP9GnO8jI3cq8kyVrXgiCyy4/VCYNz87xS62qE0gaWmE0=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Sat, 02 Jul 2022 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Thu, 27 May 2021 13:00:20 GMT
server: ATS
etag: "6de43f1c725d89777edaa2bc5d679ecb-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: JFZQD2B9T398JSP8
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: Bv0RNzsjZsSn6kGrZjdvdggYqc20u__d
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/choozle/10601/ 28 KB
9 KB 33ms
7ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/10601/Bootstrap.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ae0883bbbe025eb521b7d73a647ff8e637f863801eb16bbbc4f94069bc17e483

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:53 GMT
content-encoding: gzip
last-modified: Tue, 04 May 2021 17:13:48 GMT
server: nginx
etag: W/"609180cc-6e77"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300

GET
H2 200 ec.js Show response
www.google-analytics.com/plugins/ua/ 3 KB
2 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ec.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:05:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 841
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1306
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 23 Oct 2021 04:05:52 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
472 B 42ms
18ms Image
image/gif 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j94&tid=UA-148998105-6&cid=0498b74d-2155-4277-91db-1a6681ebe493&jid=1398933737&_u=YKAAgAABAAAAAE~&z=2007782109

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
472 B 40ms
17ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j94&tid=UA-148998105-6&cid=0498b74d-2155-4277-91db-1a6681ebe493&jid=1398933737&_u=YKAAgAABAAAAAE~&z=2007782109

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 18ms
17ms XHR
text/plain 2a00:1450:400c:c0c::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j94&tid=UA-112639049-5&cid=188440505.1634959194&jid=788388072&gjid=919456455&_gid=1979524766.1634959194&_u=aKDAAEABAAAAAG~&z=551034226

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sat, 23 Oct 2021 03:19:53 GMT
content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 val Show response
trace.mediago.io/api/html/ Frame 2ADE 12 KB
13 KB 208ms
160ms Document
text/html 2600:9000:2250:f000:b:c1a2:7dc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trace.mediago.io/api/html/val?acid=null
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:f000:b:c1a2:7dc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4cbf6dc99915177f6304fca1e7cbaf149e86e9871836362ef9ba56454c807765

Request headers

:method: GET
:authority: trace.mediago.io
:scheme: https
:path: /api/html/val?acid=null
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/html; charset=utf-8
date: Sat, 23 Oct 2021 03:19:54 GMT
x-cache: Miss from cloudfront
via: 1.1 f49c99d2326b14738507e1c2ddcae1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
x-amz-cf-id: mNkspQf074k0V-dQTMm6rjqQw_EeacSuS6_3Q3qMF2u8vu2Bdr77uA==

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/665056240/ 3 KB
2 KB 47ms
21ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/665056240/?random=1634959193910&cv=9&fst=1634959193910&num=1&label=g1uXCMPu6dEBEPDnj70C&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3e3343f90766917d535d0c4f6508f66caaef47a4fc052acbc93197effaab1faf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1202
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/780296261/ 3 KB
1 KB 47ms
24ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/780296261/?random=1634959193914&cv=9&fst=1634959193914&num=1&label=y7pgCJrV4YwBEMXAifQC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b9e8061dc06bd46ed9ced0307804168ec17b011dc31cb2ed15ae60f91c0dcb6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1202
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/780277278/ 2 KB
1 KB 43ms
22ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/780277278/?random=1634959193916&cv=9&fst=1634959193916&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2d64dd38087add46d4e02b06bda9e90bd24c70cc574f7dff5ea0ebf22b6b5ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1151
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/757445324/ 3 KB
1 KB 42ms
22ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/757445324/?random=1634959193917&cv=9&fst=1634959193917&num=1&label=-SKMCMq43JYBEMzllukC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

26719123d5d754f1ea5d46daaddc5c9405b856369c1c7952998bb68d1e7b3e5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1202
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/780266039/ 2 KB
1 KB 41ms
22ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/780266039/?random=1634959193918&cv=9&fst=1634959193918&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

20dbfb86f0c32d2df915d14abfa11ff1efada9bc6e36f017081c1c75b58559cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1151
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/707706541/ 3 KB
1 KB 40ms
23ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/707706541/?random=1634959193919&cv=9&fst=1634959193919&num=1&label=OO1KCIrRjqwBEK39utEC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4e34183431c030f57274b9fdc0c6516af44b04bf964ad017ab8fd6bbf06e81de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1196
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 modules.bff3b8d60820fc90decc.js Show response
script.hotjar.com/ 222 KB
59 KB 40ms
12ms Script
application/javascript 52.222.236.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.bff3b8d60820fc90decc.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.122 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-122.fra56.r.cloudfront.net

Software

Resource Hash

da4c70755f82ff615c0fd3cad94bf62b19a9d5c25ab87268097eaa9609098bec

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 21 Oct 2021 13:21:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 136728
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 59887
access-control-allow-origin: *
last-modified: Thu, 21 Oct 2021 13:20:57 GMT
etag: "e6ca8fed932ccfd7b742e0e3ecb6d422"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 3431ec594cac61983aae2d9ffaf23981.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-P4
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: sptP2SjfahpMCIVo5DRHTAzjSJD1zyk7wR3yiSWt7UmnRxA80v3uHA==

GET
H2 200 383440592325124 Show response
connect.facebook.net/signals/config/ 490 KB
144 KB 13ms
13ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/383440592325124?v=2.9.47&r=stable

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2f49135953f2aa0b4193440472228c5bf6e88512cc2fcc95622a78ec1ed1452e

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 146802
x-xss-protection: 0
pragma: public
x-fb-debug: ef0s85k7M3dX4/kM6Wlg/yZHgeNczF7aGP4fJoLVSC5kE+zeja6WJgJHgoq5vrrI3g3NsfulZkVvN5jxGjdWsw==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Sat, 23 Oct 2021 03:19:54 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK cachedClickId Show response
tr.outbrain.com/ 35 B
239 B 390ms
85ms Script
application/javascript 70.42.32.31
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to

Full URL: https://tr.outbrain.com/cachedClickId?marketerId=00b7a913e0b9a7393b20d834711f3a1ceb,0040752ca591876c6ab7eb366d24329d4d
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.31 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: 1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:54 GMT
content-encoding: gzip
X-TraceId: f1ca61d9258256ce3045980ef724d38a
Content-Length: 56
Content-Type: application/javascript

GET
H/1.1 200
OK unifiedPixel
tr.outbrain.com/ 43 B
256 B 407ms
92ms Image
image/gif 70.42.32.31
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.outbrain.com/unifiedPixel?marketerId=00b7a913e0b9a7393b20d834711f3a1ceb,0040752ca591876c6ab7eb366d24329d4d&obApiVersion=1.1&obtpVersion=1.5.2&name=PAGE_VIEW&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&optOut=false&bust=05221670435021799
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.31 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: 33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:54 GMT
Cache-Control: no-cache
X-TraceId: 13419a0d31f182120f0026cfbad41252
content-encoding: gzip
Content-Length: 60
Content-Type: image/gif;

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 28ms
22ms Image
image/gif 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j94&tid=UA-112639049-5&cid=188440505.1634959194&jid=788388072&_u=aKDAAEABAAAAAG~&z=779457136

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 26ms
20ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j94&tid=UA-112639049-5&cid=188440505.1634959194&jid=788388072&_u=aKDAAEABAAAAAG~&z=779457136

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 10090329.json Show response
s.yimg.com/wi/config/ 2 B
194 B 27ms
9ms XHR
application/json 2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10090329.json

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 02:34:28 GMT
x-content-type-options: nosniff
age: 2726
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: NWMMW2ENHKRBJWRC
x-amz-id-2: RI5UFeszXM0TQoERQRUUQWzNil6jAXUl0OLhwVnkGx5xT6PygWxNSu0QDtcJVI0M5JSz0+5aFtA=
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
content-length: 2

GET
H2 200 10150636.json Show response
s.yimg.com/wi/config/ 46 B
683 B 25ms
9ms XHR
application/octet-stream 2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10150636.json

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

49ab5900241048e3f52a32cf9cf405ec5403001dceef55eba1f128b7809cef2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 22 Oct 2021 11:42:47 GMT
x-content-type-options: nosniff
age: 56228
x-amz-server-side-encryption: AES256
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: QE1KVE1H1VZWE0AJ
x-amz-id-2: xermVu1j/2jjw8Jd/6lvleKV56pq8WSLMeFs3NhKU4MuopCsNAOVdfb84gz3cXpisTfwNQRArrU=
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Fri, 23 Sep 2022 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Wed, 18 Aug 2021 21:49:33 GMT
server: ATS
etag: "19b8572021b9e0a07b89bf86a82652ee"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
x-amz-version-id: PCzhmtl0iZMXZ32Xz0RDQ5FGZ03eVIDB
access-control-allow-origin: *
x-xss-protection: 1; mode=block
content-length: 46
content-type: application/octet-stream

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
675 B 146ms
121ms Script
application/javascript 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o2hf4&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=c36d8a0e-794b-41b1-abac-1fcaf4654584&tw_document_href=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tpx_cb=twttr.conversion.loadPixels

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 114
pragma: no-cache
last-modified: Sat, 23 Oct 2021 03:19:54 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 5242e967f42ec5e88328621fbcd10f191ce705078cbfadb4eb7e518efe36f4ea
x-transaction: e39cb9d1ac2a3935
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
238 B 156ms
131ms Script
application/javascript 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o4a95&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=fb5024db-76de-4785-acfe-fb21f1b122a5&tw_document_href=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tpx_cb=twttr.conversion.loadPixels

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 120
pragma: no-cache
last-modified: Sat, 23 Oct 2021 03:19:54 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 5242e967f42ec5e88328621fbcd10f191ce705078cbfadb4eb7e518efe36f4ea
x-transaction: cf5eecaf44a1a0fa
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
470 B 146ms
121ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o2hf4&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=c36d8a0e-794b-41b1-abac-1fcaf4654584&tw_document_href=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 113
pragma: no-cache
last-modified: Sat, 23 Oct 2021 03:19:54 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: afaccd695f1b3a0b7ca7adc870a7fe512874af05c73d77ae1eda38c14ea8186e
x-transaction: ac9c3d1f47475d91
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
124 B 149ms
124ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o4a95&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=fb5024db-76de-4785-acfe-fb21f1b122a5&tw_document_href=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 117
pragma: no-cache
last-modified: Sat, 23 Oct 2021 03:19:54 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: afaccd695f1b3a0b7ca7adc870a7fe512874af05c73d77ae1eda38c14ea8186e
x-transaction: 41b1f00744946fbe
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 wistia-mux.js Show response
fast.wistia.com/assets/external/ 92 KB
25 KB 7ms
7ms Script
application/javascript 2a04:4e42:200::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/wistia-mux.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::622 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6b2b48ca0a09e592b566062a53b111ebc09d2a34a1f04a3b05b00eba9e9760b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
content-encoding: br
vary: Accept-Encoding
age: 1513
x-cache: HIT, HIT
content-length: 24815
x-served-by: cache-dca17723-DCA, cache-fra19183-FRA
access-control-allow-origin: *
x-browser-version: 93
last-modified: Fri, 22 Oct 2021 18:08:10 GMT
x-timer: S1634959194.068702,VS0,VE0
etag: "6172fe0a-60ef"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 13

GET
H2 200 box-d09a446edefba0dcce5d5143e1840e9a.html Show response
vars.hotjar.com/ Frame ED7C 2 KB
1 KB 27ms
7ms Document
text/html 18.66.112.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-d09a446edefba0dcce5d5143e1840e9a.html
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.109 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 69ae95b7f73e2899d0c398ed4fb9faba242bbec4d0a58b182e4dd0e7808f01ac

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-d09a446edefba0dcce5d5143e1840e9a.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/html
content-length: 1044
date: Wed, 20 Oct 2021 07:15:05 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
etag: "63e08f928469ab67d9dac30c065ed182"
last-modified: Wed, 20 Oct 2021 07:15:01 GMT
x-amz-server-side-encryption: AES256
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 fb49d852ca52c03c834ce98098b51517.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
x-amz-cf-id: A96IdLJDyC0HQpN0bJdAm9yNnKj5dfR-S1muTk-V4kBmgpxRP2vLNA==
age: 245089

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 0CB5 11 KB
5 KB 60ms
16ms Document
text/html 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?topUrl=pro.oxfordincomeletter.com&origin=onetag

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

9413ac70f0dfa293eae8e934799be6a1cde8cd96db876ce9bd127c41630847ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: gum.criteo.com
:scheme: https
:path: /syncframe?topUrl=pro.oxfordincomeletter.com&origin=onetag
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

cache-control: private, max-age=3600
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 4268
set-cookie: uid=40cfe817-bb2b-40cd-9e2d-b9876a4a6aed; expires=Thu, 17 Nov 2022 03:19:54 GMT; domain=.criteo.com; path=/; secure; samesite=none
date: Sat, 23 Oct 2021 03:19:53 GMT
content-length: 4683

GET
H/1.1 200
OK sp.pl
sp.analytics.yahoo.com/ 43 B
964 B 120ms
45ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Sat%2C%2023%20Oct%202021%2003%3A19%3A54%20GMT&n=0&b=The%20Oxford%20Club&.yp=10150636&f=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&enc=UTF-8&yv=1.10.1&tagmgr=gtm%2Censighten

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 , Switzerland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:54 GMT
X-Content-Type-Options: nosniff
Age: 0
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Server: ATS
X-Frame-Options: DENY
Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security: max-age=31536000
Content-Type: image/gif
Cache-Control: no-cache, private, must-revalidate
Accept-Ranges: bytes
Expires: Sat, 23 Oct 2021 03:19:54 GMT

GET
H/1.1 200
OK sp.pl
sp.analytics.yahoo.com/ 43 B
964 B 112ms
36ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&b=The%20Oxford%20Club&.yp=10090329&f=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&enc=UTF-8&yv=1.10.1&tagmgr=gtm%2Censighten

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 , Switzerland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:54 GMT
X-Content-Type-Options: nosniff
Age: 0
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Server: ATS
X-Frame-Options: DENY
Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security: max-age=31536000
Content-Type: image/gif
Cache-Control: no-cache, private, must-revalidate
Accept-Ranges: bytes
Expires: Sat, 23 Oct 2021 03:19:54 GMT

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/choozle/10601/ 274 B
416 B 22ms
22ms Script
text/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/10601/serverComponent.php?r=86.85538857792834&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/choozle/10601/code/&publishedOn=Tue%20May%2004%2017:13:48%20GMT%202021&ClientID=923&PageID=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 846453961b33d6feb0c32e8c65cd76badd5ec41b3a76d7711294cb6b6cd39d66

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
cache-control: no-cache, no-store
server: nginx
content-type: text/javascript
content-length: 274
expires: Sat, 23 Oct 2021 03:19:53 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/665056240/ 42 B
108 B 35ms
33ms Image
image/gif 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/665056240/?random=1634959193910&cv=9&fst=1634958000000&num=1&label=g1uXCMPu6dEBEPDnj70C&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=2726990497&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/665056240/ 42 B
108 B 22ms
20ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/665056240/?random=1634959193910&cv=9&fst=1634958000000&num=1&label=g1uXCMPu6dEBEPDnj70C&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=2726990497&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/780277278/ 42 B
154 B 22ms
21ms Image
image/gif 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/780277278/?random=1634959193916&cv=9&fst=1634958000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=3181162602&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/780277278/ 42 B
154 B 20ms
19ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/780277278/?random=1634959193916&cv=9&fst=1634958000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=3181162602&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/757445324/ 42 B
108 B 22ms
21ms Image
image/gif 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/757445324/?random=1634959193917&cv=9&fst=1634958000000&num=1&label=-SKMCMq43JYBEMzllukC&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=3912334947&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/757445324/ 42 B
108 B 20ms
19ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/757445324/?random=1634959193917&cv=9&fst=1634958000000&num=1&label=-SKMCMq43JYBEMzllukC&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=3912334947&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/780266039/ 42 B
108 B 20ms
19ms Image
image/gif 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/780266039/?random=1634959193918&cv=9&fst=1634958000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=3284294898&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/780266039/ 42 B
108 B 18ms
17ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/780266039/?random=1634959193918&cv=9&fst=1634958000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=3284294898&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/707706541/ 42 B
108 B 19ms
18ms Image
image/gif 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/707706541/?random=1634959193919&cv=9&fst=1634958000000&num=1&label=OO1KCIrRjqwBEK39utEC&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=763912004&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/707706541/ 42 B
108 B 28ms
27ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/707706541/?random=1634959193919&cv=9&fst=1634958000000&num=1&label=OO1KCIrRjqwBEK39utEC&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=763912004&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/780296261/ 42 B
108 B 18ms
17ms Image
image/gif 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/780296261/?random=1634959193914&cv=9&fst=1634958000000&num=1&label=y7pgCJrV4YwBEMXAifQC&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=4221429867&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/780296261/ 42 B
108 B 19ms
18ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/780296261/?random=1634959193914&cv=9&fst=1634958000000&num=1&label=y7pgCJrV4YwBEMXAifQC&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=4221429867&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 json Show response
trc.taboola.com/1246441/trc/3/ 2 KB
1 KB 23ms
22ms Script
application/javascript 2a04:4e42:600::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1246441/trc/3/json?tim=1634959194128&data=%7B%22id%22%3A833%2C%22ii%22%3A%22%2Fp%2Fforeverto79brklt2yrdsosaosalttot%2Fwbrkxa00%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1634959194117%2C%22cv%22%3A%2220210809-3-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Doxfordclub-sc-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1634959194127%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue%22%2C%22tos%22%3A7%2C%22ssd%22%3A1%2C%22scd%22%3A100%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::300 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 7f46d5fe65eb99e80cc1a6738a936b62ff370885b1e20c07f18f1d54b857c460

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-vcl-time-ms: 16
date: Sat, 23 Oct 2021 03:19:54 GMT
content-encoding: gzip
server: nginx
x-timer: S1634959194.194672,VS0,VE16
x-served-by: cache-fra19155-FRA
vary: Accept-Encoding
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
access-control-allow-credentials: true
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
x-cache-hits: 0

GET
H2 200 1x1.gif
a.mgid.com/ 43 B
107 B 128ms
126ms Image
image/gif 104.19.133.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.mgid.com/1x1.gif?id=444673&type=c&tg=&r=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&utmc=0&utmt=0&nv=1&utms=&utmcp=&utmm=&clid=&cmgid=0&cmtid=0&cmtuid=0&d=1634959194150
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.133.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6a27d393da772c36-FRA
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?tna=v2.1.0&aid=a-03e6&wpn=lc-bundle&pu=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-06598519...
https://rp4.liadm.com/j?tna=v2.1.0&aid=a-03e6&wpn=lc-bundle&pu=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-0659851...

13 B
569 B

409ms
101ms

XHR
application/json

54.146.217.90
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rp4.liadm.com/j?tna=v2.1.0&aid=a-03e6&wpn=lc-bundle&pu=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&duid=84f9f284006b--01fjnjjxwadrptey31qbqc8yf9&se=e30&dtstmp=1634959194163&i6=MmEwMTo0Zjg6MjEyOjc4ZToyZjo6MQ%3D%3D&n3pc=true

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.146.217.90 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-146-217-90.compute-1.amazonaws.com

Software

nginx/1.18.0 /

Resource Hash

efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
x-pixel-event-id: 233ebf6d-23a0-4c24-a86b-0b3bdf32e3db
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
request-time: 0
vary: Origin
content-length: 13
x-xss-protection: 1; mode=block
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
server: nginx/1.18.0
x-frame-options: DENY
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json
access-control-allow-origin: null
access-control-allow-credentials: true
trace-id: b1206880337a567a

Redirect headers

date: Sat, 23 Oct 2021 03:19:54 GMT
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
server: nginx/1.18.0
vary: Origin
location: https://rp4.liadm.com/j?tna=v2.1.0&aid=a-03e6&wpn=lc-bundle&pu=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&duid=84f9f284006b--01fjnjjxwadrptey31qbqc8yf9&se=e30&dtstmp=1634959194163&i6=MmEwMTo0Zjg6MjEyOjc4ZToyZjo6MQ%3D%3D&n3pc=true
x-frame-options: DENY
access-control-allow-origin: https://pro.oxfordincomeletter.com
x-xss-protection: 1; mode=block
x-permitted-cross-domain-policies: master-only
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
trace-id: 5b20af0f503dd7f7
request-time: 0
content-length: 0
x-content-type-options: nosniff

GET
H2 200 427462362080626 Show response
connect.facebook.net/signals/config/ 307 KB
87 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/427462362080626?v=2.9.47&r=stable

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e678bac0260919547057d60ccc55c1fe197b651b1676fc227186fceb8ef2b189

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 89142
x-xss-protection: 0
pragma: public
x-fb-debug: 5iZA/BdtoAVkZWrkLqhfezTvpiEYU7/siwtbrnzi0KruL1P47d4ft+Etx8QDwtFjFoxlts6EXbpWUVvnY51Dqg==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Sat, 23 Oct 2021 03:19:54 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
313 B 22ms
7ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=383440592325124&ev=PageView&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&rl=&if=false&ts=1634959194226&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=30&fbp=fb.1.1634959194224.1621462962&it=1634959193931&coo=false&exp=p1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Sat, 23 Oct 2021 03:19:54 GMT

GET
H2 200 dc351ef2c1b360e6750940e41d872348.js Show response
nexus.ensighten.com/choozle/10601/code/ 2 KB
553 B 8ms
7ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/10601/code/dc351ef2c1b360e6750940e41d872348.js?conditionId0=421905
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: c1a3eadb48a1958597631aa02d82267a534882124011e5de97cbf2be2e490c56

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
content-encoding: gzip
last-modified: Tue, 20 Apr 2021 16:02:55 GMT
server: nginx
etag: W/"607efb2f-746"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2

200

sid Show response
mug.criteo.com/ Frame 0CB5
Redirect Chain

https://gum.criteo.com/sid/json?origin=onetag&domain=oxfordincomeletter.com&sn=ChromeSyncframe&so=0&topUrl=pro.oxfordincomeletter.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=25k5FHwyY2FVMFBiNkF0MWN5K2ZXcEM0UTR0UElrc1ZZKzdQQkRkWGJKVEF1UGRVbm9UQTN3RG9mRHhGR05qTWtoU29zUzhmSWxkODZQSnV0WEFvKzZTZmFCeXQzNjQ4bnFiVlc3WU02Mkp4dEExcnR4MlBzWSsxRFp6Lz...

444 B
640 B

302ms
17ms

Fetch
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=25k5FHwyY2FVMFBiNkF0MWN5K2ZXcEM0UTR0UElrc1ZZKzdQQkRkWGJKVEF1UGRVbm9UQTN3RG9mRHhGR05qTWtoU29zUzhmSWxkODZQSnV0WEFvKzZTZmFCeXQzNjQ4bnFiVlc3WU02Mkp4dEExcnR4MlBzWSsxRFp6LzdPZDlDWkJYZEN4akppQTZwcDJST0FrZXpoYkhTK1NaU1dQT3J5ZENMR25PNDJDc3lGUFhyaEt3RXQvZFgyY0ZEeitXbUZDK1FVRlpPZFFOVlZXcm1OS2JQSHA2ZFdhOE5aR2hQUjhaMy94T25rYUsreWJhN0tMNWp1ZWNHcnVOdlRVbm9XbVBKbjMzcWQvZE5jczgvZFNiZDFVM2JoNVF1ZXB2UDEvTEdXYzczR2I0NjdXWT18&cppv=2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

3ddaab281ad27c329b846970baf37d57a32e30030fa5514defe4ad7a61d4d478

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Sat, 23 Oct 2021 03:19:53 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2585
expires: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Sat, 23 Oct 2021 03:19:53 GMT
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=25k5FHwyY2FVMFBiNkF0MWN5K2ZXcEM0UTR0UElrc1ZZKzdQQkRkWGJKVEF1UGRVbm9UQTN3RG9mRHhGR05qTWtoU29zUzhmSWxkODZQSnV0WEFvKzZTZmFCeXQzNjQ4bnFiVlc3WU02Mkp4dEExcnR4MlBzWSsxRFp6LzdPZDlDWkJYZEN4akppQTZwcDJST0FrZXpoYkhTK1NaU1dQT3J5ZENMR25PNDJDc3lGUFhyaEt3RXQvZFgyY0ZEeitXbUZDK1FVRlpPZFFOVlZXcm1OS2JQSHA2ZFdhOE5aR2hQUjhaMy94T25rYUsreWJhN0tMNWp1ZWNHcnVOdlRVbm9XbVBKbjMzcWQvZE5jczgvZFNiZDFVM2JoNVF1ZXB2UDEvTEdXYzczR2I0NjdXWT18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 1952
content-length: 567
expires: 0

GET
H2 200 pathfora.min.js Show response
c.lytics.io/static/ 101 KB
22 KB 22ms
22ms Script
text/javascript 2606:4700:20::ac43:49ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.lytics.io/static/pathfora.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:49ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3026705f0b903b7d393557aa659e53895313ccdc657e5118e8976a9254d2b00e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

cf-ray: 6a27d39468846389-FRA
date: Sat, 23 Oct 2021 03:19:54 GMT
via: 1.1 google
cf-cache-status: HIT
last-modified: Fri, 01 Oct 2021 22:29:24 GMT
server: cloudflare
age: 310
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=016Qm6ZzoZl1ZrPUK9A3A7hGhMKSotR5oqOuBlH%2FY3EB%2B6DDDJgAsTzOGj2PyqKIoNqj9Opzz9EkqRNtUJWc3F1vzEK73cphQ445PIX4wNIPyA15IMpJLqGPCvKqmkc6vb4VZ0JAHg%2F%2B"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript; charset=utf-8
cache-control: max-age=7200
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=63072000;
content-encoding: br

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/925909/ 146 B
323 B 116ms
34ms XHR
application/json 99.81.27.250
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/925909/visit-data?sv=6
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.81.27.250 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-81-27-250.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: ab95872c4726727a3b09b1f8c28490c70b7e407e97fd93bbfb75a2ecc5faac36

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
content-encoding: br
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store
access-control-allow-credentials: true

GET
H2 204 925909 Show response
vc.hotjar.io/sessions/ 0
254 B 57ms
34ms XHR
text/plain 18.66.112.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vc.hotjar.io/sessions/925909?s=0.25&r=0.19669594031063276
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Python/3.7 aiohttp/3.5.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
via: 1.1 91dc0292eef4e22508a3ae73fe64bbf5.cloudfront.net (CloudFront)
server: Python/3.7 aiohttp/3.5.4
x-amz-cf-pop: FRA56-P5
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-store
x-amz-cf-id: haoFQ3lA97eyf70tTtntl1qQwd--485jgVO07nu9-2I-4C1LYFAMfA==

GET
H2 200 2337243036594698 Show response
connect.facebook.net/signals/config/ 226 KB
68 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/2337243036594698?v=2.9.47&r=stable

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9a5802a33aa6c4d99c7f536c19a93283ff9fa11cec89b837d489dd1ead7caabf

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 69086
x-xss-protection: 0
pragma: public
x-fb-debug: SDArR1ecjVAnxLYTwystYPENMCGKP5IOEKmKrWSTVtQ47CwZtkYnblhQnKRWSNR5cQ+oy6Gtw1kg1tj4YQymcw==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Sat, 23 Oct 2021 03:19:54 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
101 B 7ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=427462362080626&ev=PageView&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&rl=&if=false&ts=1634959194281&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=30&fbp=fb.1.1634959194224.1621462962&it=1634959193931&coo=false&exp=p1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Sat, 23 Oct 2021 03:19:54 GMT

GET
H2 200 pathfora.min.css
c.lytics.io/static/ 20 KB
4 KB 17ms
15ms Stylesheet
text/css 2606:4700:20::ac43:49ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.lytics.io/static/pathfora.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:49ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

58aa5964d6f5dc68b2180e943ea63b6031c0ba83e44d9815e724b10f2f615f9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

cf-ray: 6a27d394b88c6389-FRA
date: Sat, 23 Oct 2021 03:19:54 GMT
via: 1.1 google
cf-cache-status: HIT
last-modified: Fri, 01 Oct 2021 22:31:15 GMT
server: cloudflare
age: 303
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FD2RMLMk8m4bWQjih%2Fc%2B3VuiuAe6ADi61s%2F7kMX7RWOYiGJk2Uov4uChMZHiY5rNeeltIwlRWaT921H64iXVOlVIJyD09Fcj2yLLp34mZS1RKduMODPYZvNKJT4TWlPGwArWO%2FQT5Ov7"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: max-age=7200
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=63072000;
content-encoding: br

GET
H2 200 lytics_overrides.min.css
storage.googleapis.com/lioservices/2470-oxford-club/ 602 B
1 KB 29ms
7ms Stylesheet
text/css 2a00:1450:4001:829::2010
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/lioservices/2470-oxford-club/lytics_overrides.min.css
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:829::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 0efd1a0f2f52ed3d1bbd90257616b1f3f057163e50e3ed7d36af06ffa10b7b06

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:37 GMT
age: 257
x-guploader-uploadid: ADPycdtxPe-MOnprGGDo8Goq1pr3LbEnyWNFUmG0RX0avC20jvEL0C2fPq7QPvZ1j_HJYdnkpWxFtCfwWzFi7afaONFYvwY3hA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 602
last-modified: Thu, 04 Oct 2018 21:47:26 GMT
server: UploadServer
etag: "9df2d5ae6031369aa6e0f3685608cd8c"
x-goog-hash: crc32c=VZEimQ==, md5=nfLVrmAxNpqm4PNoVgjNjA==
x-goog-generation: 1538689646128559
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=3600
x-goog-stored-content-length: 602
accept-ranges: bytes
content-type: text/css
expires: Sat, 23 Oct 2021 04:15:37 GMT

GET
H/1.1 200
OK Common.js Show response
pro.oxfordincomeletter.com/p/Scripts/ Frame 2ADE 2 KB
1 KB 97ms
96ms Document
application/javascript 192.135.136.168
14WEST-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pro.oxfordincomeletter.com/p/Scripts/Common.js

Requested by

Host: cdn.mediago.io
URL: https://cdn.mediago.io/js/pixel.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.135.136.168 , United States, ASN11372 (14WEST-AS, US),

Reverse DNS

Software

Resource Hash

86034bbe69eebb0c08660ff7f0128dd0bd1d852176489ca3a3da7b49bd647cbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Host: pro.oxfordincomeletter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Encoding: gzip, deflate, br
Cookie: 1872196=2206428; BIGipServerIRIS_PROD_HTTPS_POOL=!v2meOUdU73gdMxRj65n2UeQdagOpw1NYdfnw1jVr58GhnycGboMO49UbovMrwGBK312UP06ClsN0gKU=; WBRKXA00=; seerses=e; seerid=aae40e4a-7c7c-44df-9bdd-715db5955789; _ga_4H7QL840N8=GS1.1.1634959193.1.0.1634959193.0; _uetsid=1725752033b011ecb264ab66375df3b5; _uetvid=1726e75033b011ecb223077d08548e62; _gcl_au=1.1.559061431.1634959194; _ga=GA1.2.188440505.1634959194; _gid=GA1.2.1979524766.1634959194; _gat_UA-112639049-5=1; _gat_UA-148806141-1=1; _li_dcdm_c=.oxfordincomeletter.com; _lc2_fpi=84f9f284006b--01fjnjjxwadrptey31qbqc8yf9; _hjid=31885b54-17c8-496a-9fcc-2832d4e74dac; _hjFirstSeen=1; MgidSensorNVis=1; MgidSensorHref=https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true; _fbp=fb.1.1634959194224.1621462962; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=1; _hjIncludedInSessionSample=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

Cache-Control: no-cache
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Tue, 31 Mar 2020 05:43:09 GMT
Accept-Ranges: bytes
ETag: "1be39421f7d61:0"
Vary: Accept-Encoding
Referrer-Policy: no-referrer-when-downgrade
Date: Sat, 23 Oct 2021 03:19:53 GMT
Content-Length: 1140
Strict-Transport-Security: max-age=63072000; includeSubDomains

GET
H2 200 2275199989273587 Show response
connect.facebook.net/signals/config/ 224 KB
67 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/2275199989273587?v=2.9.47&r=stable

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3b5ff3b4df2c343f0c504d2e28bb9a67991b2737859191ba10e35e3c3af45b86

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 68802
x-xss-protection: 0
pragma: public
x-fb-debug: PR9YX4vuoYMEGKoR/Z0AgC3UqLPX6ADlc18ihAc2r26dlIBkuuU28iDrB+IZAUr1mJNZvAziW3AWG3kmYMUW3g==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Sat, 23 Oct 2021 03:19:54 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
101 B 6ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2337243036594698&ev=PageView&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&rl=&if=false&ts=1634959194307&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=28&fbp=fb.1.1634959194224.1621462962&it=1634959193931&coo=false&exp=p1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Sat, 23 Oct 2021 03:19:54 GMT

GET
H2 200 config.js Show response
c.lytics.io/api/program/campaign/config/9c32784e3cc4888a693a7988ad64c63d/ 353 B
728 B 196ms
196ms Script
application/javascript 2606:4700:20::ac43:49ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.lytics.io/api/program/campaign/config/9c32784e3cc4888a693a7988ad64c63d/config.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:49ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8144dd81871ff83480f71004b56e62a6cf2aa40cc9e3e1fa6c8f4a8a3bb6090f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

cf-ray: 6a27d394f8906389-FRA
date: Sat, 23 Oct 2021 03:19:54 GMT
via: 1.1 google
cf-cache-status: EXPIRED
last-modified: Sat, 23 Oct 2021 01:10:51 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Sb02Yl5ny4aXDQpyAFvIrCDUFs5w55oJZxPvda0P0pINnTrz1NxxEn1Pq%2BqzFH47L3jHlR1EWOrlcoF2UQprzriPayD3FGBAPnff3B5YutxNFQQ2zqaKtVsIUa4vcrozbRbT4f3PFPdo"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=7200
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=63072000;
content-encoding: br

GET
H2 200 514616809480893 Show response
connect.facebook.net/signals/config/ 39 KB
10 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/514616809480893?v=2.9.47&r=stable

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

986468b7e0e23a8da5cc30417d149761ec9d7c072fd1d8601260d079b6cbb139

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 10619
x-xss-protection: 0
pragma: public
x-fb-debug: 5owmXiroROdvyCxK1gKsJjXaRM9wCIOE9xpdRWlxIqXkz8X/xb+xrBDAZWgQYVVnC7NrF4LuHj9qT3ZlBPpz6g==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Sat, 23 Oct 2021 03:19:54 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
101 B 6ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2275199989273587&ev=PageView&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&rl=&if=false&ts=1634959194334&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=28&fbp=fb.1.1634959194224.1621462962&it=1634959193931&coo=false&exp=p1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Sat, 23 Oct 2021 03:19:54 GMT

GET
H2 200 434538323874406 Show response
connect.facebook.net/signals/config/ 490 KB
143 KB 17ms
17ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/434538323874406?v=2.9.47&r=stable

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

db0155bffd297eceb7a60b7a2bd0e9c84bb9cb02e85380a76bfc06db3c285d70

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 146694
x-xss-protection: 0
pragma: public
x-fb-debug: XKdjnhpkwai3BnfIusYetWy1GgKYQAV43yoem5i1qyu1jDVVZzo3GoWnFtdNS6H8Dua7J+ugXcbzl9wiPMTj7g==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Sat, 23 Oct 2021 03:19:54 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
101 B 6ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=514616809480893&ev=PageView&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&rl=&if=false&ts=1634959194350&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=28&fbp=fb.1.1634959194224.1621462962&it=1634959193931&coo=false&exp=p1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Sat, 23 Oct 2021 03:19:54 GMT

GET
H2 200 334214824326985 Show response
connect.facebook.net/signals/config/ 307 KB
87 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/334214824326985?v=2.9.47&r=stable

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e77bf6dbfb04b5c3b173c0200b90751306befe5c2e55c6172e7e69dc16b24795

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 89204
x-xss-protection: 0
pragma: public
x-fb-debug: 5bTJPTR318UIzDs5Rlmbje+mvdpwVC3Jt8kB0OvP+mDf95mx4usOZPzqANFQYV6nC60eW0TTe+SrcKDwTbqKBw==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Sat, 23 Oct 2021 03:19:54 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
101 B 6ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=434538323874406&ev=PageView&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&rl=&if=false&ts=1634959194399&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=30&fbp=fb.1.1634959194224.1621462962&it=1634959193931&coo=false&exp=p1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Sat, 23 Oct 2021 03:19:54 GMT

GET
H2 200 val Show response
trace.mediago.io/api/html/ Frame 8AD9 12 KB
13 KB 10ms
10ms Document
text/html 2600:9000:2250:f000:b:c1a2:7dc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trace.mediago.io/api/html/val?acid=null
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:f000:b:c1a2:7dc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4cbf6dc99915177f6304fca1e7cbaf149e86e9871836362ef9ba56454c807765

Request headers

:method: GET
:authority: trace.mediago.io
:scheme: https
:path: /api/html/val?acid=null
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/html; charset=utf-8
date: Sat, 23 Oct 2021 03:19:54 GMT
x-cache: Hit from cloudfront
via: 1.1 f49c99d2326b14738507e1c2ddcae1dc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
x-amz-cf-id: nzD3b-8Tw5-x8aB6aIiAj6bHxUAC9NJOD_IPjAcg5-cV60zXT0o7OQ==

GET
H2 200 3743232669037879 Show response
connect.facebook.net/signals/config/ 490 KB
144 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/3743232669037879?v=2.9.47&r=stable

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d9f71363b0fd2a7538e42a4c2bc2c2c7063a03ca1d56c818aad803b994ba9c16

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 146775
x-xss-protection: 0
pragma: public
x-fb-debug: Ygw0BsShaLSqcU/sA2pcG0Uo3+g4knZe4XTm3EnXGRUKUSJ1yvJGyHWn/sX48pCCiERRtPi5LXlwN73g48ssxQ==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Sat, 23 Oct 2021 03:19:54 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
101 B 6ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=334214824326985&ev=PageView&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&rl=&if=false&ts=1634959194442&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=30&fbp=fb.1.1634959194224.1621462962&it=1634959193931&coo=false&exp=p1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Sat, 23 Oct 2021 03:19:54 GMT

GET
H2 200 1762270674080693 Show response
connect.facebook.net/signals/config/ 307 KB
87 KB 7ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1762270674080693?v=2.9.47&r=stable

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

17f24b54a4a13fc2883ed410149e187bcae4a2cdcf3767ef06d94e585956d390

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 89099
x-xss-protection: 0
pragma: public
x-fb-debug: ZYmjaYZHc0l0pRvsRxY/msfZJxtSN5rUHaHfHSiBDNN7sZbxqZSXHKEonUoopXUsRjq6bOTLq5mm2FVcmXQ0eg==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Sat, 23 Oct 2021 03:19:54 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
101 B 6ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=3743232669037879&ev=PageView&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&rl=&if=false&ts=1634959194482&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=30&fbp=fb.1.1634959194224.1621462962&it=1634959193931&coo=false&exp=p1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Sat, 23 Oct 2021 03:19:54 GMT

GET
H/1.1 200
OK Common.js Show response
pro.oxfordincomeletter.com/p/Scripts/ Frame 8AD9 2 KB
1 KB 97ms
96ms Document
application/javascript 192.135.136.168
14WEST-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pro.oxfordincomeletter.com/p/Scripts/Common.js

Requested by

Host: cdn.mediago.io
URL: https://cdn.mediago.io/js/pixel.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.135.136.168 , United States, ASN11372 (14WEST-AS, US),

Reverse DNS

Software

Resource Hash

86034bbe69eebb0c08660ff7f0128dd0bd1d852176489ca3a3da7b49bd647cbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Host: pro.oxfordincomeletter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Encoding: gzip, deflate, br
Cookie: 1872196=2206428; BIGipServerIRIS_PROD_HTTPS_POOL=!v2meOUdU73gdMxRj65n2UeQdagOpw1NYdfnw1jVr58GhnycGboMO49UbovMrwGBK312UP06ClsN0gKU=; WBRKXA00=; seerses=e; seerid=aae40e4a-7c7c-44df-9bdd-715db5955789; _ga_4H7QL840N8=GS1.1.1634959193.1.0.1634959193.0; _uetsid=1725752033b011ecb264ab66375df3b5; _uetvid=1726e75033b011ecb223077d08548e62; _gcl_au=1.1.559061431.1634959194; _ga=GA1.2.188440505.1634959194; _gid=GA1.2.1979524766.1634959194; _gat_UA-112639049-5=1; _gat_UA-148806141-1=1; _li_dcdm_c=.oxfordincomeletter.com; _lc2_fpi=84f9f284006b--01fjnjjxwadrptey31qbqc8yf9; _hjid=31885b54-17c8-496a-9fcc-2832d4e74dac; _hjFirstSeen=1; MgidSensorNVis=1; MgidSensorHref=https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true; _fbp=fb.1.1634959194224.1621462962; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=1; _hjIncludedInSessionSample=1; outbrain_cid_fetch=true
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

Cache-Control: no-cache
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Tue, 31 Mar 2020 05:43:09 GMT
Accept-Ranges: bytes
ETag: "1be39421f7d61:0"
Vary: Accept-Encoding
Referrer-Policy: no-referrer-when-downgrade
Date: Sat, 23 Oct 2021 03:19:54 GMT
Content-Length: 1140
Strict-Transport-Security: max-age=63072000; includeSubDomains

GET
H2 200 /
www.facebook.com/tr/ 44 B
101 B 7ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1762270674080693&ev=PageView&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&rl=&if=false&ts=1634959194512&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=30&fbp=fb.1.1634959194224.1621462962&it=1634959193931&coo=false&exp=p1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Sat, 23 Oct 2021 03:19:54 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 79DB 0
91 B 7ms
6ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2244
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
date: Sat, 23 Oct 2021 03:19:54 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 5453 0
31 B 6ms
6ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2244
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
date: Sat, 23 Oct 2021 03:19:54 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame CA54 0
31 B 7ms
6ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2245
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
date: Sat, 23 Oct 2021 03:19:54 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame B674 0
31 B 8ms
6ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2245
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
date: Sat, 23 Oct 2021 03:19:54 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 2E90 0
31 B 8ms
6ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2244
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
date: Sat, 23 Oct 2021 03:19:54 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 9565 0
31 B 6ms
6ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2244
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
date: Sat, 23 Oct 2021 03:19:54 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 98CA 0
31 B 6ms
6ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2265
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
date: Sat, 23 Oct 2021 03:19:54 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 473C 0
31 B 8ms
7ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2245
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
date: Sat, 23 Oct 2021 03:19:54 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame E335 0
31 B 8ms
7ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2245
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
date: Sat, 23 Oct 2021 03:19:54 GMT

GET
H2

200

event Show response
widget.us.criteo.com/
Redirect Chain

https://sslwidget.criteo.com/event?a=90311&v=5.8.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&bundle=kcWodF9EamhlNmFtSGo4NDFXTUVsRzdURW1zRm8wZXJtT2g4UllsNXJKeWpTcmFjbzlGWnM1aE5L...
https://widget.us.criteo.com/event?a=90311&v=5.8.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&bundle=kcWodF9EamhlNmFtSGo4NDFXTUVsRzdURW1zRm8wZXJtT2g4UllsNXJKeWpTcmFjbzlGWnM1aE5L...

7 KB
8 KB

396ms
109ms

Script
application/x-javascript

74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.us.criteo.com/event?a=90311&v=5.8.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&bundle=kcWodF9EamhlNmFtSGo4NDFXTUVsRzdURW1zRm8wZXJtT2g4UllsNXJKeWpTcmFjbzlGWnM1aE5LZ1diMjh3Q0RMWExHUjh0NjhYczlRUjVTaTJQd3Zsd3F2UUVIWU5aWmpiNnZqVDU0MmljSXZoRVBKMVZPRmJSR0pQV0t2ZkszTSUyQm8yTVNOak1za2RtZmRGeWxGcGIlMkZ1b3J3RXlMczR1THVaJTJCdnpQc1dJSm9KcEUlM0Q&tld=oxfordincomeletter.com&dtycbr=96254
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: Kestrel /
Resource Hash: 254db108a2fb367cbd4580d51f70521239ee4fee9aed37b0a479cf1621a3d393

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:54 GMT
content-type: application/x-javascript
server: Kestrel
p3p: NON DSP COR CURa PSA PSD OUR BUS NAV STA
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 17406302
timing-allow-origin: *
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:53 GMT
server: Kestrel
location: https://widget.us.criteo.com/event?a=90311&v=5.8.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&bundle=kcWodF9EamhlNmFtSGo4NDFXTUVsRzdURW1zRm8wZXJtT2g4UllsNXJKeWpTcmFjbzlGWnM1aE5LZ1diMjh3Q0RMWExHUjh0NjhYczlRUjVTaTJQd3Zsd3F2UUVIWU5aWmpiNnZqVDU0MmljSXZoRVBKMVZPRmJSR0pQV0t2ZkszTSUyQm8yTVNOak1za2RtZmRGeWxGcGIlMkZ1b3J3RXlMczR1THVaJTJCdnpQc1dJSm9KcEUlM0Q&tld=oxfordincomeletter.com&dtycbr=96254
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3331147
timing-allow-origin: *
content-length: 0
expires: 0

POST
H2 200 / Show response
www.facebook.com/tr/ Frame DB9E 0
31 B 27ms
19ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 86465
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
date: Sat, 23 Oct 2021 03:19:54 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 6907 0
31 B 17ms
6ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 86465
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
date: Sat, 23 Oct 2021 03:19:54 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 4835 0
54 B 27ms
20ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 86465
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
date: Sat, 23 Oct 2021 03:19:55 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame F182 0
31 B 27ms
21ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 86486
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
date: Sat, 23 Oct 2021 03:19:55 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame ACC4 0
31 B 31ms
24ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 86466
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
date: Sat, 23 Oct 2021 03:19:55 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 1521 0
31 B 30ms
24ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 86466
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
date: Sat, 23 Oct 2021 03:19:55 GMT

GET
H2 200 playPauseLoadingControl.js Show response
fast.wistia.com/assets/external/ 59 KB
12 KB 7ms
7ms Script
application/javascript 2a04:4e42:200::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/playPauseLoadingControl.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::622 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

5c0dae79785c9e089d1fe90ef85cc1d2ce86fe739c8b922ccff259ed2a75ac50

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:55 GMT
content-encoding: br
vary: Accept-Encoding
age: 1514
x-cache: HIT, HIT
content-length: 12640
x-served-by: cache-dca17756-DCA, cache-fra19183-FRA
access-control-allow-origin: *
x-browser-version: 93
last-modified: Fri, 22 Oct 2021 18:08:10 GMT
x-timer: S1634959195.278737,VS0,VE0
etag: "6172fe0a-3160"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 17

GET
H2 200 nr-spa-1211.min.js Show response
js-agent.newrelic.com/ 43 KB
16 KB 30ms
6ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-spa-1211.min.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 539877722caad874241ab2ec930b7b4aaa5327a34984b64ad813f8a2998bb862

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: CLSa7QJ2hagEFCkLjcLamPCZ0EDdPlaV
content-encoding: gzip
etag: "a5ee6c68d7de5e7446d73910964b5c10"
x-amz-request-id: 0S4XFNJFYQZN9637
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 16260
x-amz-id-2: v26Y2Ym4qOzM3icLTsVPo7p+x1EvrE6TG7atauVW/H4IwE2a7G7tJ/ZX4jGwn698O07ljqFSUSk=
x-served-by: cache-fra19151-FRA
last-modified: Mon, 27 Sep 2021 20:46:51 GMT
server: AmazonS3
x-timer: S1634959195.304150,VS0,VE0
date: Sat, 23 Oct 2021 03:19:55 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 1793

GET
H2 200 hls_video.js Show response
fast.wistia.com/assets/external/engines/ 393 KB
93 KB 7ms
7ms Script
application/javascript 2a04:4e42:200::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/engines/hls_video.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::622 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

40545e036f49a43cd530edfa21f24fbd6d9b7307d39cb117a9eb6408d5ad73ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:55 GMT
content-encoding: br
vary: Accept-Encoding
age: 1515
x-cache: HIT, HIT
content-length: 94660
x-served-by: cache-dca17782-DCA, cache-fra19183-FRA
access-control-allow-origin: *
x-browser-version: 93
last-modified: Fri, 22 Oct 2021 18:08:10 GMT
x-timer: S1634959195.282148,VS0,VE0
etag: "6172fe0a-171c4"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 15

POST
H2 204 x Show response
distillery.wistia.com/ 0
96 B 333ms
111ms XHR
text/plain 52.86.94.156
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://distillery.wistia.com/x
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.94.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-94-156.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: *
date: Sat, 23 Oct 2021 03:19:55 GMT
cache-control: max-age=0, private, must-revalidate

GET
H2

200

397596.gif
idsync.rlcdn.com/ Frame A7E4
Redirect Chain

https://gum.criteo.com/sync?c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397596.gif%3Fpartner_uid%3D%40USERID%40
https://idsync.rlcdn.com/397596.gif?partner_uid=fyADNVNm_E9FMQnDOVqTaf0lmwY36Mtq

42 B
417 B

53ms
14ms

Image
image/gif

35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/397596.gif?partner_uid=fyADNVNm_E9FMQnDOVqTaf0lmwY36Mtq
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 23 Oct 2021 03:19:55 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/397596.gif?partner_uid=fyADNVNm_E9FMQnDOVqTaf0lmwY36Mtq
strict-transport-security: max-age=31536000
cache-control: private, max-age=0, no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 2488
date: Sat, 23 Oct 2021 03:19:54 GMT
content-length: 197
content-type: text/html; charset=utf-8

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame A7E4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&google_hm=ay1sWjM1alcyUk1zVkozNkZmUktCRnFnNEVPV21IM3VKcnplajMyUQ
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0

43 B
341 B

44ms
12ms

Image
image/gif

178.250.2.151
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.151 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Kestrel /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:55 GMT
content-type: image/gif
server: Kestrel
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 135965
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 279
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

204
No Content

/
partner.mediawallahscript.com/ Frame A7E4
Redirect Chain

https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-lZ35jW2RMsVJ36FfRKBFqg4EOWmH3uJrzej32Q&custom=&tag_format=img&tag_action=sync&custom=&cb=c36bd4dc-f3a2-4410-a242-f382526...
https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-lZ35jW2RMsVJ36FfRKBFqg4EOWmH3uJrzej32Q&custom%5B0%5D=&custom%5B1%5D=&tag_format=img&tag_action=sync&cb=c36bd4dc-f3a2-441...

0
638 B

33ms
33ms

Image
text/plain

34.249.161.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-lZ35jW2RMsVJ36FfRKBFqg4EOWmH3uJrzej32Q&custom%5B0%5D=&custom%5B1%5D=&tag_format=img&tag_action=sync&cb=c36bd4dc-f3a2-4410-a242-f382526389e4&final=true&reqid=1828a3e0-33b0-11ec-84f1-9723c735f6f8&timestamp=2021-10-23T03%3A19%3A55.423Z
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.249.161.76 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-161-76.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:55 GMT
Cache-Control: private, no-cache, must-revalidate, no-store, max-age=0
Server: nginx/1.18.0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Sat, 23 Oct 2021 03:19:55 GMT
Server: nginx/1.18.0
Vary: Accept, Accept-Encoding
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: /?account_id=1043&partner_id=1048&uid=k-lZ35jW2RMsVJ36FfRKBFqg4EOWmH3uJrzej32Q&custom%5B0%5D=&custom%5B1%5D=&tag_format=img&tag_action=sync&cb=c36bd4dc-f3a2-4410-a242-f382526389e4&final=true&reqid=1828a3e0-33b0-11ec-84f1-9723c735f6f8&timestamp=2021-10-23T03%3A19%3A55.423Z
Cache-Control: private, no-cache, must-revalidate, no-store, max-age=0
Connection: keep-alive
Content-Type: text/plain; charset=utf-8
Content-Length: 294
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/ Frame A7E4
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=2926&partner_device_id=k-lZ35jW2RMsVJ36FfRKBFqg4EOWmH3uJrzej32Q
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2926&partner_device_id=k-lZ35jW2RMsVJ36FfRKBFqg4EOWmH3uJrzej32Q

95 B
425 B

15ms
15ms

Image
image/png

35.227.248.159
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2926&partner_device_id=k-lZ35jW2RMsVJ36FfRKBFqg4EOWmH3uJrzej32Q

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.227.248.159 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

159.248.227.35.bc.googleusercontent.com

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:55 GMT
via: 1.1 google
content-type: image/png
alt-svc: clear
content-length: 95
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2926&partner_device_id=k-lZ35jW2RMsVJ36FfRKBFqg4EOWmH3uJrzej32Q
date: Sat, 23 Oct 2021 03:19:55 GMT
via: 1.1 google
alt-svc: clear
content-length: 0
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H2 204 v1
ads.yahoo.com/cms/ Frame A7E4 0
299 B 16ms
6ms Image
text/plain 2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?esig=1~7315a025058f3128185459bfaf16e164414683fc&nwid=10000545908&sigv=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:55 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK spp.pl
sp.analytics.yahoo.com/ Frame A7E4 43 B
964 B 39ms
37ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/spp.pl?a=10001287818027&.yp=10028862&js=no

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 , Switzerland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:55 GMT
X-Content-Type-Options: nosniff
Age: 0
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Server: ATS
X-Frame-Options: DENY
Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security: max-age=31536000
Content-Type: image/gif
Cache-Control: no-cache, private, must-revalidate
Accept-Ranges: bytes
Expires: Sat, 23 Oct 2021 03:19:55 GMT

GET
H/1.1 204
No Content sync
ups.analytics.yahoo.com/ups/58301/ Frame A7E4 0
735 B 54ms
10ms Image
text/plain 3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58301/sync?_origin=1&uid=k-5iYrsG2RMsVJ36FfRKBFqg4EOWlNkxD-zJNAhQ

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.138 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:55 GMT
Server: ATS/7.1.2.138
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1 200
OK cookie-sync
sync.outbrain.com/ Frame A7E4 0
476 B 391ms
85ms Image
text/plain 70.42.32.31
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-wNeQUW2RMsVJ36FfRKBFqg4EOWmnGEvum1jt5g
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.31 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:55 GMT
Cache-Control: no-cache
X-TraceId: 8e5d1ffd5e4058a8b0127993fc91443d
Content-Length: 0

GET
H2 204 t.gif
cw.addthis.com/ Frame A7E4 0
428 B 229ms
173ms Image
text/plain 104.75.88.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cw.addthis.com/t.gif?pid=113&pdid=k-lZ35jW2RMsVJ36FfRKBFqg4EOWmH3uJrzej32Q
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.126 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-126.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:55 GMT
cache-control: max-age=0, no-cache, no-store
expires: Sat, 23 Oct 2021 03:19:55 GMT

GET
H/1.1 200
OK Criteo
crb.kargo.com/api/v1/dsync/ Frame A7E4 43 B
360 B 47ms
7ms Image
image/gif 3.127.62.220
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crb.kargo.com/api/v1/dsync/Criteo?exid=k-lZ35jW2RMsVJ36FfRKBFqg4EOWmH3uJrzej32Q
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.62.220 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-62-220.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 23 Oct 2021 03:19:55 GMT
Vary: Origin
Content-Type: image/gif
Cache-Control: no-cache, no-store, must-revalidate, private, max-age=0
Connection: keep-alive
Krk-Reject-Reason: consent
Content-Length: 43
X-Accel-Expires: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 204
No Content tap.php
pixel.rubiconproject.com/ Frame A7E4 0
239 B 788ms
168ms Image
image/gif 8.39.36.142
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=k-udswmW2RMsVJ36FfRKBFqg4EOWnT3z53m81WWA&expires=30
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 8.39.36.142 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 6683ee3a8662a9679fcacb9fe223a3f8
Content-Type: image/gif

GET
H/1.1

200
OK

bounce
secure.adnxs.com/ Frame A7E4
Redirect Chain

https://secure.adnxs.com/setuid?entity=52&code=k--L8HxW2RMsVJ36FfRKBFqg4EOWl8ug0rcla7lQ&seg=95287
https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk--L8HxW2RMsVJ36FfRKBFqg4EOWl8ug0rcla7lQ%26seg%3D95287

43 B
1 KB

12ms
12ms

Image
image/gif

185.33.220.242
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk--L8HxW2RMsVJ36FfRKBFqg4EOWl8ug0rcla7lQ%26seg%3D95287

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.242 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 23 Oct 2021 03:19:55 GMT
X-Proxy-Origin: 136.243.198.85; 136.243.198.85; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 49b3a04e-30ec-49f5-822b-9bc9fbac5998
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 23 Oct 2021 03:19:55 GMT
X-Proxy-Origin: 136.243.198.85; 136.243.198.85; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: cbcc8dfe-6ace-4654-88bc-c38532fd3394
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk--L8HxW2RMsVJ36FfRKBFqg4EOWl8ug0rcla7lQ%26seg%3D95287
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

sync
x.bidswitch.net/ul_cb/ Frame A7E4
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=46&user_id=k--L8HxW2RMsVJ36FfRKBFqg4EOWl8ug0rcla7lQ&expires=30&user_group=5
https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k--L8HxW2RMsVJ36FfRKBFqg4EOWl8ug0rcla7lQ&expires=30&user_group=5

43 B
495 B

9ms
9ms

Image
image/gif

18.157.70.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k--L8HxW2RMsVJ36FfRKBFqg4EOWl8ug0rcla7lQ&expires=30&user_group=5
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.157.70.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-157-70-90.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:55 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Location: https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k--L8HxW2RMsVJ36FfRKBFqg4EOWl8ug0rcla7lQ&expires=30&user_group=5
Date: Sat, 23 Oct 2021 03:19:55 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2 200 c.gif
c.bing.com/ Frame A7E4 42 B
310 B 36ms
29ms Image
image/gif 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?Red3=CTOMS_pd&cbid=k--L8HxW2RMsVJ36FfRKBFqg4EOWl8ug0rcla7lQ
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:55 GMT
etag: "af5a8b34ac1d71:0"
last-modified: Thu, 14 Oct 2021 22:27:41 GMT
x-msedge-ref: Ref A: ED2DE883A73E47099BFF0373E320AC78 Ref B: FRAEDGE1421 Ref C: 2021-10-23T03:19:55Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

GET
H2 200 pixelCt.tpmn
ad.tpmn.co.kr/ Frame A7E4 170 B
601 B 298ms
264ms Image
image/png 34.102.166.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.tpmn.co.kr/pixelCt.tpmn?tpmn_nid=26a681017b4fdc02f3aef3aa921ede3e&tpmn_buid=k-tycHLW2RMsVJ36FfRKBFqg4EOWkbat4T3hNCgg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.166.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.166.102.34.bc.googleusercontent.com
Software: /
Resource Hash: 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:55 GMT
content-encoding: gzip
vary: accept-encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
content-type: image/png;charset=utf-8
alt-svc: clear
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame A7E4 42 B
680 B 61ms
13ms Image
image/gif 185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-0yJqxm2RMsVJ36FfRKBFqg4EOWkKQBKH0SP49A
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:55 GMT
cache-control: no-store, no-cache, private
x-lat: amspug012:0:366
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

xuid
eb2.3lift.com/ Frame A7E4
Redirect Chain

https://eb2.3lift.com/xuid?mid=2711&xuid=k-of-FhG2RMsVJ36FfRKBFqg4EOWmTqrsk5qm7iQ&dongle=013b
https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-of-FhG2RMsVJ36FfRKBFqg4EOWmTqrsk5qm7iQ&dongle=013b&gdpr=1&cmp_cs=&us_privacy=

37 B
353 B

9ms
9ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-of-FhG2RMsVJ36FfRKBFqg4EOWmTqrsk5qm7iQ&dongle=013b&gdpr=1&cmp_cs=&us_privacy=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:55 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=2711&xuid=k-of-FhG2RMsVJ36FfRKBFqg4EOWmTqrsk5qm7iQ&dongle=013b&gdpr=1&cmp_cs=&us_privacy=
date: Sat, 23 Oct 2021 03:19:55 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1

200
OK

rum
r.casalemedia.com/ Frame A7E4
Redirect Chain

https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-GIMbuG2RMsVJ36FfRKBFqg4EOWmLffZzL1CXDw
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-GIMbuG2RMsVJ36FfRKBFqg4EOWmLffZzL1CXDw&C=1

43 B
1 KB

22ms
21ms

Image
image/gif

2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-GIMbuG2RMsVJ36FfRKBFqg4EOWmLffZzL1CXDw&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.141.232 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 23 Oct 2021 03:19:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 23 Oct 2021 03:19:55 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 23 Oct 2021 03:19:55 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-GIMbuG2RMsVJ36FfRKBFqg4EOWmLffZzL1CXDw&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 296
Expires: Sat, 23 Oct 2021 03:19:55 GMT

GET
H2

200

k-F1Rnd22RMsVJ36FfRKBFqg4EOWnpPKNgrYxQug
an.yandex.ru/mapuid/criteois/ Frame A7E4
Redirect Chain

https://an.yandex.ru/mapuid/criteois/k-F1Rnd22RMsVJ36FfRKBFqg4EOWnpPKNgrYxQug
https://an.yandex.ru/mapuid/criteois/k-F1Rnd22RMsVJ36FfRKBFqg4EOWnpPKNgrYxQug?redir-setuniq=1

43 B
108 B

69ms
68ms

Image
image/gif

2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/criteois/k-F1Rnd22RMsVJ36FfRKBFqg4EOWnpPKNgrYxQug?redir-setuniq=1

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:55 GMT
content-encoding: gzip
last-modified: Sat, 23 Oct 2021 03:19:55 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sat, 23 Oct 2021 03:19:55 GMT

Redirect headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:55 GMT
content-encoding: gzip
last-modified: Sat, 23 Oct 2021 03:19:55 GMT
strict-transport-security: max-age=31536000
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
location: https://an.yandex.ru/mapuid/criteois/k-F1Rnd22RMsVJ36FfRKBFqg4EOWnpPKNgrYxQug?redir-setuniq=1
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sat, 23 Oct 2021 03:19:55 GMT

GET
H2 200 sync
ad.as.amanad.adtdp.com/v1/ Frame A7E4 42 B
843 B 295ms
231ms Image
image/gif 18.66.97.123
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.as.amanad.adtdp.com/v1/sync?dsp_id=4,5&uid=k-F7WFLW2RMsVJ36FfRKBFqg4EOWnvwhFg1Mwnpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:55 GMT
via: 1.1 2af4ee189e50805a67bd62bbd51ad0dc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
x-amzn-trace-id: Root=1-00000000-000000000000000000000000
x-cache: Miss from cloudfront
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-length: 42
x-amz-cf-id: Cd8lZt52DRzD-tQl01mzvnKhxH0nl65NlM-UhBDL0uJWBTAL9HBkbQ==
expires: Thu, 01 Jan 1970 09:00:00 GMT

GET
H2 200 cksync.php
contextual.media.net/ Frame A7E4 46 B
868 B 89ms
34ms Image
image/gif 2.21.140.74
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=crt&ovsid=k-MYKRLW2RMsVJ36FfRKBFqg4EOWlXKSjGdDTHRg

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.21.140.74 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-21-140-74.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

579a172ca2c700734ebcfa06d105a134f31ec2357660e58e0874cfdee8472fd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
server: Apache
date: Sat, 23 Oct 2021 03:19:55 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 46
x-mnet-hl2: E
expires: Sat, 23 Oct 2021 03:19:55 GMT

GET
H2 200 um
criteo-sync.teads.tv/ Frame A7E4 23 B
172 B 111ms
44ms Image
image/gif 104.90.104.248
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://criteo-sync.teads.tv/um?eid=80&uid=k-MqNuLm2RMsVJ36FfRKBFqg4EOWkYzvtWuxHOIw
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.104.248 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-104-248.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.6 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:55 GMT
cache-control: max-age=0, no-cache, no-store
expires: Sat, 23 Oct 2021 03:19:55 GMT
server: akka-http/10.2.6
content-length: 23
content-type: image/gif

GET
H2 200 pixel_sync
trends.revcontent.com/cm/ Frame A7E4 35 B
336 B 142ms
40ms Image
image/gif 52.50.197.208
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trends.revcontent.com/cm/pixel_sync?bidder=151&bidder_uid=k-wIshIW2RMsVJ36FfRKBFqg4EOWlPd_Z6LmJVhw
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.50.197.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-50-197-208.eu-west-1.compute.amazonaws.com
Software: / Express
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:55 GMT
x-powered-by: Express
content-length: 35
content-type: image/gif

GET
H2 200 /
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame A7E4 0
231 B 115ms
13ms Image
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=k-rdeumW2RMsVJ36FfRKBFqg4EOWkEoMTDhV20gA
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:55 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 10549

GET
H2

200

match
ad.360yield.com/ul_cb/ Frame A7E4
Redirect Chain

https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-FNtnT22RMsVJ36FfRKBFqg4EOWngBxPGcrIYrg
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-FNtnT22RMsVJ36FfRKBFqg4EOWngBxPGcrIYrg

43 B
446 B

12ms
12ms

Image
image/gif

18.193.213.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-FNtnT22RMsVJ36FfRKBFqg4EOWngBxPGcrIYrg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.193.213.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-193-213-131.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sat, 23 Oct 2021 03:19:55 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

location: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-FNtnT22RMsVJ36FfRKBFqg4EOWngBxPGcrIYrg
date: Sat, 23 Oct 2021 03:19:55 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2 200 collect
www.google-analytics.com/ 35 B
96 B 7ms
6ms Image
image/gif 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j94&a=975211064&t=timing&_s=2&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&ul=en-us&de=UTF-8&dt=The%20Oxford%20Club&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&plt=4789&pdt=93&dns=0&rrt=1920&srt=129&tcp=0&dit=2738&clt=2738&_gst=3163&_gbt=3260&_cst=2576&_cbt=2867&_u=aKDAAEIJAAAAAG~&jid=&gjid=&cid=188440505.1634959194&tid=UA-112639049-5&_gid=1979524766.1634959194&gtm=2wgak0WP5R8BX&z=1842979813

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Oct 2021 22:14:42 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 18313
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
91 B 7ms
6ms Image
image/gif 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j94&a=975211064&t=timing&_s=2&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&ul=en-us&de=UTF-8&dt=The%20Oxford%20Club&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&plt=4789&pdt=93&dns=0&rrt=1920&srt=129&tcp=0&dit=2738&clt=2738&_gst=3163&_gbt=3260&_cst=2576&_cbt=2867&_u=aKDAAEIJAAAAAG~&jid=&gjid=&cid=188440505.1634959194&tid=UA-148806141-1&_gid=1979524766.1634959194&gtm=2wgak0WP5R8BX&z=459620376

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Oct 2021 22:14:42 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 18313
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 45 KB
15 KB 76ms
13ms Script
text/javascript 2600:9000:224a:b600:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:b600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 00a838051c95fd70f609e56b14160f3b11f9cc925ebf863b6b6d05aa05f18410

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-Amz-Version-Id: 20dI2pPzXWu4owz5yzq5GCZ31O2z_uNt
Content-Encoding: gzip
Etag: W/"42b7053581646365ea5fe1cf37686183"
X-Amz-Cf-Pop: DUS51-P1
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Access-Control-Max-Age: 600
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Mon, 18 Oct 2021 20:57:17 GMT
Server: AmazonS3
Date: Sat, 23 Oct 2021 03:18:55 GMT
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Via: 1.1 5b9a6276a0cfe21df57da85d975de2dd.cloudfront.net (CloudFront)
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: vNbHIj9hnfkRTh42IRpmfpcZTjiSqNvw0nKA6Y3re_y-G0Q3kYIjeQ==

GET
H/1.1 200
OK 65387c3314 Show response
bam-cell.nr-data.net/1/ 49 B
715 B 162ms
128ms Script
text/javascript 162.247.243.146
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bam-cell.nr-data.net/1/65387c3314?a=46346808,5284047&v=1211.ba193a8&to=YANVZUdYDxFXW0UMWllJemd2FiINWExUC0F0CVlFR1YNDlNKHilaVgJ0XltNBAxC&rst=4854&ck=1&ref=https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/&ap=30&be=2579&fe=4793&dc=2738&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1634959190423,%22n%22:0,%22f%22:1920,%22dn%22:1920,%22dne%22:1920,%22c%22:1920,%22ce%22:1920,%22rq%22:1921,%22rp%22:2050,%22rpe%22:2143,%22dl%22:2054,%22di%22:2738,%22ds%22:2738,%22de%22:2738,%22dc%22:4786,%22l%22:4789,%22le%22:4807%7D,%22navigation%22:%7B%7D%7D&fp=2739&fcp=2739&jsonp=NREUM.setToken
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.146 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:55 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
access-control-allow-credentials: true
CF-Ray: 6a27d39cafa9434b-FRA

GET
H2 200 blank.gif
fast.wistia.com/assets/images/ 1 KB
2 KB 20ms
6ms Image
image/gif 2a04:4e42:200::622
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fast.wistia.com/assets/images/blank.gif

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::622 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a78759ea185fd0fa42ca9be1fc5bca4d3167a2836dc6c85e479a19dbf57fe2c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Origin: https://pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:55 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
age: 23114
x-cache: HIT, HIT
x-cache-hits: 1, 386
content-length: 1214
x-served-by: cache-dca17747-DCA, cache-fra19173-FRA
x-browser-version: 93
last-modified: Fri, 22 Oct 2021 20:52:01 GMT
x-timer: S1634959195.406936,VS0,VE0
etag: "61732471-4be"
strict-transport-security: max-age=0
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=315360000, public
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fa07dx1uzu.vtt
fast.wistia.net/embed/captions/ 124 KB
125 KB 126ms
105ms TextTrack
text/vtt 2a04:4e42:200::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.net/embed/captions/fa07dx1uzu.vtt?language=eng

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::622 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ce2a97bacbda7013ff938be4e13c1e7bc44fe10d5c171264e3c5d124be924f2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Origin: https://pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:55 GMT
via: 1.1 varnish (Varnish/6.0), 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
age: 256
x-cache: HIT, MISS
p3p: CP="CURi ADMa DEVa IVAa IVDa CONi OUR IND DSP CAO COR"
vary: Accept-Encoding,X-Forwarded-Proto,Accept-Language
content-length: 127000
x-request-id: bb198fb0e9bad71a4610c4a825493b4f
x-served-by: cache-dca17770-DCA, cache-fra19180-FRA
x-runtime: 0.040493
referrer-policy: strict-origin-when-cross-origin
x-timer: S1634959196.666012,VS0,VE95
etag: W/"ce2a97bacbda7013ff938be4e13c1e7b"
x-download-options: noopen
strict-transport-security: max-age=0
content-type: text/vtt; charset=utf-8
access-control-allow-origin: *
cache-control: public, no-cache
x-browser: chrome
x-browser-version: 93
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 0

GET
H/1.1 200
OK v2 Show response
embedwistia-a.akamaihd.net/deliveries/9b02c3de899297c57729075a6a319110ec37e63e.m3u8/ 126 KB
127 KB 30ms
8ms XHR
application/vnd.apple.mpegurl 2.16.186.8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://embedwistia-a.akamaihd.net/deliveries/9b02c3de899297c57729075a6a319110ec37e63e.m3u8/v2
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.8 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-8.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9156c89516752ef0dc646a676fb0696fa919f4fe60e36c5fb3b26938a0a2d84c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:55 GMT
Access-Control-Request-Method: *
surrogate-key: 9b02c3de899297c57729075a6a319110ec37e63e-hls-segment purge-experiment-3e
Last-Modified: Mon, 05 Nov 2018 10:11:00 GMT
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: application/vnd.apple.mpegurl
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Server,range,Content-Length,Content-Range
Cache-Control: max-age=30517495
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 129219
Expires: Tue, 11 Oct 2022 08:24:50 GMT

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/appnexus/ Frame A7E4
Redirect Chain

https://secure.adnxs.com/seg?add=95287&redir=https%3A%2F%2Fsecure.adnxs.com%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID
https://secure.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=8467823575902685008

43 B
342 B

15ms
15ms

Image
image/gif

178.250.2.151
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=8467823575902685008
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.151 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Kestrel /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:55 GMT
content-type: image/gif
server: Kestrel
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2308716
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 23 Oct 2021 03:19:55 GMT
X-Proxy-Origin: 136.243.198.85; 136.243.198.85; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: d71077e3-934c-46d9-aa50-95a0ea2211c8
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=8467823575902685008
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame A7E4 42 B
187 B 13ms
12ms Image
image/gif 185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwMjMmdGw9MTI5NjAw&piggybackCookie=uid:k-0yJqxm2RMsVJ36FfRKBFqg4EOWkKQBKH0SP49A
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:54 GMT
cache-control: no-store, no-cache, private
x-lat: amspug017:0:368
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1 200
OK seg-1-v1-a1.ts Show response
embedwistia-a.akamaihd.net/deliveries/9b02c3de899297c57729075a6a319110ec37e63e.m3u8/v2/ 511 KB
512 KB 9ms
9ms XHR
video/mp2t 2.16.186.8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://embedwistia-a.akamaihd.net/deliveries/9b02c3de899297c57729075a6a319110ec37e63e.m3u8/v2/seg-1-v1-a1.ts
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.8 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-8.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: c4ee6e64f22407b19f1c3c3a3b04295141cb70f59c0e192957f3defdf4eb4c74

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:55 GMT
Access-Control-Request-Method: *
surrogate-key: 9b02c3de899297c57729075a6a319110ec37e63e-hls-segment purge-experiment-3e
Last-Modified: Mon, 05 Nov 2018 10:11:00 GMT
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: video/MP2T
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Server,range,Content-Length,Content-Range
Cache-Control: max-age=30677959
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 523768
Expires: Thu, 13 Oct 2022 04:59:14 GMT

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame A7E4 43 B
220 B 13ms
11ms Image
image/gif 18.157.70.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=46&user_id=k-p07xOG2RMsVJ36FfRKBFqg4EOWmhLLQKn1-B_w&expires=30&user_group=5
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.157.70.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-157-70-90.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:55 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 204 t.gif
cw.addthis.com/ Frame A7E4 0
428 B 172ms
172ms Image
text/plain 104.75.88.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cw.addthis.com/t.gif?pid=113&pdid=k-udswmW2RMsVJ36FfRKBFqg4EOWnT3z53m81WWA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.126 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-126.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:19:55 GMT
cache-control: max-age=0, no-cache, no-store
expires: Sat, 23 Oct 2021 03:19:55 GMT

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/LIFCQSNANBDWJACZ7X23HF/index.js
https://s.adroll.com/j/exp/index.js

28 B
750 B

25ms
10ms

Script
application/javascript

2600:9000:224a:b600:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:b600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 22 Oct 2021 18:20:09 GMT
Via: 1.1 5b9a6276a0cfe21df57da85d975de2dd.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: DUS51-P1
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 28
Last-Modified: Mon, 18 Oct 2021 21:07:54 GMT
Server: AmazonS3
Etag: "5816cced8568d223aa09d889f300692b"
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
X-Amz-Version-Id: VxC0v7SN4NsT_sJxZYoy27yA4ALlRfhC
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Content-Type: application/javascript
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: KcRJfR45NE29OdSCsZbSR--TcjYOnGgWk6FPukrEH1Ygv_ncb4ur2w==

Redirect headers

Date: Sat, 23 Oct 2021 01:39:12 GMT
Via: 1.1 5b9a6276a0cfe21df57da85d975de2dd.cloudfront.net (CloudFront)
Server: AmazonS3
X-Amz-Cf-Pop: DUS51-P1
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/xml
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 0
X-Amz-Cf-Id: B6J0IzEnvIoyLm5iSdWpJIklPP3KzO290mXVhuIDO1oDNhm94Wb0Ag==

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/pre/
Redirect Chain

https://s.adroll.com/j/pre/LIFCQSNANBDWJACZ7X23HF/4QTXPFOTHVG5LA2UNKBHDZ/fpconsent.js
https://s.adroll.com/j/pre/index.js

0
721 B

21ms
13ms

Script
application/javascript

2600:9000:224a:b600:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/index.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:b600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-Amz-Version-Id: nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Via: 1.1 1f16598f51b4c33e5f56e49ea72a6155.cloudfront.net (CloudFront)
Etag: "d41d8cd98f00b204e9800998ecf8427e"
X-Amz-Cf-Pop: DUS51-P1
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Last-Modified: Wed, 15 Jan 2020 23:54:18 GMT
Server: AmazonS3
Date: Sat, 23 Oct 2021 01:04:33 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: bYk0kaGDsweU9PBXKRbfjowtAEuLbuCVga3FSGMxLd8qQetAqzcwFw==

Redirect headers

Date: Sat, 23 Oct 2021 01:39:12 GMT
Via: 1.1 5b9a6276a0cfe21df57da85d975de2dd.cloudfront.net (CloudFront)
Server: AmazonS3
X-Amz-Cf-Pop: DUS51-P1
Location: https://s.adroll.com/j/pre/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/xml
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 0
X-Amz-Cf-Id: x2Tm-YNcZhHZ6N6Z2rCcD2wiW74-Z4FFa1-mxP0ZQ4VeAWMwjSKYOQ==

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/LIFCQSNANBDWJACZ7X23HF/4QTXPFOTHVG5LA2UNKBHDZ/ 4 KB
3 KB 38ms
21ms Script
text/javascript 2600:9000:224a:b600:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/LIFCQSNANBDWJACZ7X23HF/4QTXPFOTHVG5LA2UNKBHDZ/index.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:b600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 41f1e9970b646aadac0f40543bb08b21e49990bf1b09392d1ef4d71b275069ea

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-Amz-Version-Id: E9RgTEFCXSktySb61wBebWTz6M0j6nty
Content-Encoding: gzip
Etag: W/"33ed216ef4569e95a97e55fb39d91d38"
X-Amz-Cf-Pop: DUS51-P1
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Access-Control-Max-Age: 600
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Mon, 18 Oct 2021 21:15:58 GMT
Server: AmazonS3
Date: Sat, 23 Oct 2021 03:19:55 GMT
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Via: 1.1 1b18b0df6149933160ee945c6867dc2c.cloudfront.net (CloudFront)
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: XZgraOYhCwnykkx0cslFUb8on5iXRoct1e-pJhh9RC9gFTZMrYs4Kw==

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame A7E4 43 B
220 B 11ms
10ms Image
image/gif 18.157.70.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=46&user_id=k-udswmW2RMsVJ36FfRKBFqg4EOWnT3z53m81WWA&expires=30
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.157.70.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-157-70-90.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:19:55 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 LIFCQSNANBDWJACZ7X23HF Show response
d.adroll.com/consent/check/ 386 B
479 B 128ms
34ms Script
application/javascript 108.128.63.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/LIFCQSNANBDWJACZ7X23HF?arrfrr=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&_s=bb721e525c28a1e3aa129a201cf03bf7&_b=2
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.128.63.204 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-108-128-63-204.eu-west-1.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: e468b4da71b099aec19b5bff6960c3e5f1cab6ecb80b4f850228c32b33c50860

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:55 GMT
server: nginx/1.20.0
content-length: 386
content-type: application/javascript

GET
H2 204 unip Show response
trc-events.taboola.com/1246441/log/3/ 0
253 B 33ms
12ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1246441/log/3/unip?en=pre_d_eng_tb&tos=1614&scd=100&ssd=1&est=1634959194120&ver=35&isls=true&src=i&invt=1500&rv=1&tim=1634959195735&vi=1634959194117&ri=08b4a6f9010cab13830a77e651111c79&ref=null&cv=20210809-3-RELEASE&item-url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin: https://pro.oxfordincomeletter.com
pragma: no-cache
date: Sat, 23 Oct 2021 03:19:55 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H/1.1 200
OK consent_tcfv2.js Show response
s.adroll.com/j/ 397 KB
55 KB 15ms
14ms Script
application/javascript 2600:9000:224a:b600:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/consent_tcfv2.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:b600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: fff426e1f2e0f6df1fdf4fd50790a29de380123e633dde9eb76290852785221c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-Amz-Version-Id: FE38nrrp1HWTDadu3Uyr7nm1dYat8XV0
Content-Encoding: gzip
Etag: W/"d0e7c263fcf5865882cfb13022c3f4b4"
X-Amz-Cf-Pop: DUS51-P1
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Access-Control-Max-Age: 600
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Thu, 29 Jul 2021 18:15:16 GMT
Server: AmazonS3
Date: Sat, 23 Oct 2021 03:16:20 GMT
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Via: 1.1 1b18b0df6149933160ee945c6867dc2c.cloudfront.net (CloudFront)
Cache-Control: max-age=300, must-revalidate
Access-Control-Allow-Credentials: false
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: gAOvUVHGZ3WzS8gPIoogXLvoXOkdSYkdB6lFKIrXt8QWNIrMOFnNAQ==

GET
H/1.1 200
OK nextroll-32x32.png
s.adroll.com/i/favicon/ 2 KB
2 KB 13ms
13ms Image
image/png 2600:9000:224a:b600:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.adroll.com/i/favicon/nextroll-32x32.png
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:b600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 02:20:18 GMT
Via: 1.1 1b18b0df6149933160ee945c6867dc2c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: DUS51-P1
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 1615
Last-Modified: Mon, 28 Jun 2021 18:19:21 GMT
Server: AmazonS3
Etag: "403a0a7dcf2d617e7ea852bfb9d11945"
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
X-Amz-Version-Id: eTpwxbAIDHDUN.4tfrROIgU_pzKN9Xh0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Content-Type: image/png
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: 0e9hVFiYzzkfb4ZcUq9QQwLgNRRv-SRlS56gMto4a0VONzmozJxd7Q==

POST
H2 200 mput Show response
pipedream.wistia.com/ 2 B
136 B 348ms
104ms XHR
text/plain 34.237.200.61
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pipedream.wistia.com/mput?topic=metrics
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.237.200.61 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-237-200-61.compute-1.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Sat, 23 Oct 2021 03:19:56 GMT
content-length: 2
access-control-allow-methods: POST, OPTIONS
content-type: text/plain; charset=utf-8

GET
H2 200 allIntegrations.js Show response
fast.wistia.com/assets/external/ 40 KB
9 KB 11ms
11ms Script
application/javascript 2a04:4e42:200::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/allIntegrations.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::622 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d77802915404115b7ae2d56748b9baf61a53e1b9e9c3832885fb63e9e898bcbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:56 GMT
content-encoding: br
vary: Accept-Encoding
age: 1516
x-cache: HIT, HIT
content-length: 9034
x-served-by: cache-dca17724-DCA, cache-fra19183-FRA
access-control-allow-origin: *
x-browser-version: 93
last-modified: Fri, 22 Oct 2021 18:08:10 GMT
x-timer: S1634959196.282614,VS0,VE0
etag: "6172fe0a-234a"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 2, 8

GET
H2 200 unity.gif Show response
api.getblueshift.com/ 42 B
986 B 578ms
214ms XHR
image/gif 34.209.144.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.getblueshift.com/unity.gif?t=1634959196&e=pageload&r=&z=678322&x=d02bedf323815b3e88b644f5e9687371&k=b013c2ec-5f6b-bb03-a11d-8a7747fecad2&u=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.209.144.177 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-209-144-177.us-west-2.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:19:56 GMT
x-content-type-options: nosniff
access-control-allow-origin: *
content-transfer-encoding: binary
content-disposition: inline; filename="unity.gif"
x-xss-protection: 1; mode=block
x-request-id: 3162937f-833c-4db4-9af8-e7a0d3254a88
x-runtime: 0.043283
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PATCH, PUT, DELETE, OPTIONS, HEAD
content-type: image/gif
pragma: no-cache
access-control-expose-headers: ETag
cache-control: no-cache, no-store
access-control-allow-headers: *,x-requested-with,Content-Type,If-Modified-Since,If-None-Match
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 unip Show response
trc-events.taboola.com/1246441/log/3/ 0
253 B 12ms
12ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1246441/log/3/unip?en=pre_d_eng_tb&tos=4616&scd=100&ssd=1&est=1634959194120&ver=35&isls=true&src=i&invt=3000&rv=1&tim=1634959198737&vi=1634959194117&ri=08b4a6f9010cab13830a77e651111c79&ref=null&cv=20210809-3-RELEASE&item-url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin: https://pro.oxfordincomeletter.com
pragma: no-cache
date: Sat, 23 Oct 2021 03:19:58 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

POST
H/1.1 200
OK 65387c3314 Show response
bam-cell.nr-data.net/events/1/ 24 B
514 B 129ms
128ms XHR
image/gif 162.247.243.146
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bam-cell.nr-data.net/events/1/65387c3314?a=46346808,5284047&v=1211.ba193a8&to=YANVZUdYDxFXW0UMWllJemd2FiINWExUC0F0CVlFR1YNDlNKHilaVgJ0XltNBAxC&rst=8508&ck=1&ref=https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.146 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
content-type: text/plain

Response headers

Date: Sat, 23 Oct 2021 03:19:59 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
Connection: keep-alive
CF-Ray: 6a27d3b1b872434b-FRA
Content-Length: 24

POST
H2 204 collect
www.google-analytics.com/g/ 0
54 B 14ms
14ms Ping
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-4H7QL840N8&gtm=2oeak0&_p=975211064&sr=1600x1200&ul=en-us&cid=188440505.1634959194&_s=2&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3Daabd1d21-ede9-4740-beb0-065985194b7c%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&dt=The%20Oxford%20Club&sid=1634959193&sct=1&seg=0&en=scroll&_et=1572&ep.clientid=0498b74d-2155-4277-91db-1a6681ebe493&ep.storage=none&epn.percent_scrolled=90
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4H7QL840N8&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:20:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK / Show response
fg8vvsvnieiv3ej16jby.litix.io/ 0
172 B 105ms
105ms XHR
text/plain 3.225.211.88

General

Check archive.org

Show headers Download Go to

Full URL: https://fg8vvsvnieiv3ej16jby.litix.io/
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.225.211.88 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json

Response headers

Access-Control-Allow-Origin: *
Date: Sat, 23 Oct 2021 03:20:00 GMT
Connection: keep-alive
Content-Length: 0
Access-Control-Allow-Methods: POST, GET

OPTIONS
H/1.1 200
OK /
fg8vvsvnieiv3ej16jby.litix.io/ Frame 0
0 417ms
102ms Preflight 3.225.211.88

General

Check archive.org

Show headers Download Go to

Full URL: https://fg8vvsvnieiv3ej16jby.litix.io/
Protocol: HTTP/1.1
Server: 3.225.211.88 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://pro.oxfordincomeletter.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Methods: POST, GET
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 86400
Date: Sat, 23 Oct 2021 03:20:00 GMT
Content-Length: 0
Connection: keep-alive

Verdicts & Comments Add Verdict or Comment

174 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

87 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00	1970-01-20 06:54:55	Name: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid Value: aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true=visited
.the7at7.com/	1970-01-20 06:54:55	Name: iterableEndUserId Value: timmermansber%40hotmail.com
.the7at7.com/	1970-01-19 22:10:45	Name: iterableEmailCampaignId Value: 3015184
.the7at7.com/	1970-01-19 22:10:45	Name: iterableTemplateId Value: 4131222
.the7at7.com/	1970-01-19 22:10:45	Name: iterableMessageId Value: 46e330cce23748aab82b39c512e297ad
links.daily.the7at7.com/	1969-12-31 23:59:59	Name: XSRF-TOKEN Value: bbdd8a1afdccc6ecdf5333bad6b2603da809d3cf-1634959190644-69d5f471cd09365e52c47a06
signup.wealthyretirement.com/	1969-12-31 23:59:59	Name: BIGipServerIRIS_PROD_HTTPS_POOL Value: !090xmxyhOoi691Jj65n2UeQdagOpw2G4hgAfOrRw/x7otpLcV59n2ebjtMkVmIVvQMfZDA6L1DEUqbQ=
pro.oxfordincomeletter.com/	1970-01-19 22:38:10	Name: 1872196 Value: 2206428
pro.oxfordincomeletter.com/	1969-12-31 23:59:59	Name: BIGipServerIRIS_PROD_HTTPS_POOL Value: !v2meOUdU73gdMxRj65n2UeQdagOpw1NYdfnw1jVr58GhnycGboMO49UbovMrwGBK312UP06ClsN0gKU=
pro.oxfordincomeletter.com/	1978-01-11 21:31:40	Name: WBRKXA00 Value:
.pro.oxfordincomeletter.com/	1970-01-19 22:09:20	Name: seerses Value: e
.pro.oxfordincomeletter.com/	1970-01-20 00:18:55	Name: seerid Value: aae40e4a-7c7c-44df-9bdd-715db5955789
.lytics.io/	1970-01-20 19:45:19	Name: seerid Value: aae40e4a-7c7c-44df-9bdd-715db5955789
.bing.com/	1970-01-20 07:30:55	Name: MUID Value: 36C4B43B2C4F63CE0054A4E22D24627F
.oxfordincomeletter.com/	1970-01-19 22:10:45	Name: _uetsid Value: 1725752033b011ecb264ab66375df3b5
.oxfordincomeletter.com/	1970-01-20 07:30:55	Name: _uetvid Value: 1726e75033b011ecb223077d08548e62
.oxfordincomeletter.com/	1970-01-20 00:18:55	Name: _gcl_au Value: 1.1.559061431.1634959194
.oxfordincomeletter.com/	1970-01-20 15:40:31	Name: _ga Value: GA1.2.188440505.1634959194
.oxfordincomeletter.com/	1970-01-19 22:10:45	Name: _gid Value: GA1.2.1979524766.1634959194
.oxfordincomeletter.com/	1970-01-19 22:09:19	Name: _gat_UA-112639049-5 Value: 1
.oxfordincomeletter.com/	1970-01-19 22:09:19	Name: _gat_UA-148806141-1 Value: 1
.mgid.com/	1970-01-25 20:31:23	Name: muidn Value: l9mRBxi2Tijk
.mgid.com/	1970-01-19 22:09:20	Name: __cf_bm Value: c18048041354f65cf707b07c6a1c984e90ec26e5-1634959194-0-AXBVYqoczFyCKf5Dvjs3apbN2ZI2Q/zrYJ/coGej7/eZe0huth022a/t+IkQRlm6oMAIt1GkI15bcr4G3Ol8568=
.oxfordincomeletter.com/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .oxfordincomeletter.com
.oxfordincomeletter.com/	1970-01-20 15:40:31	Name: _lc2_fpi Value: 84f9f284006b--01fjnjjxwadrptey31qbqc8yf9
.criteo.com/	1970-01-20 07:30:55	Name: uid Value: 40cfe817-bb2b-40cd-9e2d-b9876a4a6aed
.oxfordincomeletter.com/	1970-01-20 06:54:55	Name: _hjid Value: 31885b54-17c8-496a-9fcc-2832d4e74dac
.oxfordincomeletter.com/	1970-01-19 22:09:20	Name: _hjFirstSeen Value: 1
.twitter.com/	1970-01-20 15:40:31	Name: personalization_id Value: "v1_8naE+ZxTRbADj5bm4cJHeQ=="
pro.oxfordincomeletter.com/	1970-01-20 00:18:55	Name: MgidSensorNVis Value: 1
pro.oxfordincomeletter.com/	1970-01-20 00:18:55	Name: MgidSensorHref Value: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=aabd1d21-ede9-4740-beb0-065985194b7c&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
.oxfordincomeletter.com/	1970-01-20 00:18:55	Name: _fbp Value: fb.1.1634959194224.1621462962
pro.oxfordincomeletter.com/	1970-01-19 22:09:19	Name: _hjIncludedInPageviewSample Value: 1
.oxfordincomeletter.com/	1970-01-19 22:09:20	Name: _hjAbsoluteSessionInProgress Value: 1
pro.oxfordincomeletter.com/	1970-01-19 22:09:19	Name: _hjIncludedInSessionSample Value: 1
pro.oxfordincomeletter.com/	1970-01-19 22:09:19	Name: outbrain_cid_fetch Value: true
.liadm.com/	1970-01-20 15:40:31	Name: lidid Value: 28ee7f37-15f1-490d-9ea5-f36fa6f1b3e4
.oxfordincomeletter.com/	1970-01-20 07:38:43	Name: cto_bundle Value: kcWodF9EamhlNmFtSGo4NDFXTUVsRzdURW1zRm8wZXJtT2g4UllsNXJKeWpTcmFjbzlGWnM1aE5LZ1diMjh3Q0RMWExHUjh0NjhYczlRUjVTaTJQd3Zsd3F2UUVIWU5aWmpiNnZqVDU0MmljSXZoRVBKMVZPRmJSR0pQV0t2ZkszTSUyQm8yTVNOak1za2RtZmRGeWxGcGIlMkZ1b3J3RXlMczR1THVaJTJCdnpQc1dJSm9KcEUlM0Q
.oxfordincomeletter.com/	1970-01-20 15:40:31	Name: _ga_4H7QL840N8 Value: GS1.1.1634959193.1.0.1634959195.0
.tapad.com/	1970-01-19 23:35:43	Name: TapAd_TS Value: 1634959195330
.tapad.com/	1970-01-19 23:35:43	Name: TapAd_DID Value: 42fb803b-66e0-42b3-b3f1-b4f60ef0f985
.analytics.yahoo.com/	1970-01-20 06:56:21	Name: IDSYNC Value: 18zh~2143
.yahoo.com/	1970-01-20 06:55:16	Name: A3 Value: d=AQABBFp_c2ECEIV9NXpO5t_99mkMWfRoVngFEgEBAQHQdGF9YQAAAAAA_eMAAA&S=AQAAAucBgxr-0wU6K72MwxkmLQg
.doubleclick.net/	1970-01-20 07:30:55	Name: IDE Value: AHWqTUlYtnmaUwSpPJeS5pMc34ZOpcW4hz1UW0pUBU9UTnJi3JvI1dhgku7fsqjR5Dw
.adnxs.com/	1970-01-20 00:18:55	Name: uuid2 Value: 8467823575902685008
.rlcdn.com/	1970-01-20 06:54:55	Name: rlas3 Value: QNzGTpZTGHxQdbumPXmzFrTWrVwv9cdKuc9ibKoyXoM=
.rlcdn.com/	1970-01-19 23:35:43	Name: pxrc Value: CAA=
.tapad.com/	1970-01-19 23:35:43	Name: TapAd_3WAY_SYNCS Value:
.pubmatic.com/	1970-01-19 22:52:31	Name: KRTBCOOKIE_97 Value: 3385-uid:k-0yJqxm2RMsVJ36FfRKBFqg4EOWkKQBKH0SP49A&KRTB&23286-uid:k-0yJqxm2RMsVJ36FfRKBFqg4EOWkKQBKH0SP49A&KRTB&23287-uid:k-0yJqxm2RMsVJ36FfRKBFqg4EOWkKQBKH0SP49A&KRTB&23288-uid:k-0yJqxm2RMsVJ36FfRKBFqg4EOWkKQBKH0SP49A
.pubmatic.com/	1970-01-19 22:52:31	Name: PugT Value: 1634959195
.pubmatic.com/	1970-01-20 00:18:55	Name: PUBMDCID Value: 3
.3lift.com/	1970-01-20 00:18:55	Name: tluid Value: 13856133288298317785
.mediawallahscript.com/	1970-01-20 15:40:31	Name: mCookie Value: 182dd400-33b0-11ec-9cde-6b349271f280
.mediawallahscript.com/	1970-01-20 15:40:31	Name: mUserCookie Value: %7B%22undefined%22%3A%5B%22%22%2C%22%22%2C%22%22%5D%7D
.bidswitch.net/	1970-01-20 06:54:55	Name: tuuid Value: 19cfe5c0-4695-479c-b5c3-df9ab47525ae
.bidswitch.net/	1970-01-20 06:54:55	Name: c Value: 1634959195
.bidswitch.net/	1970-01-20 06:54:55	Name: tuuid_lu Value: 1634959195
.addthis.com/	1970-01-20 07:30:55	Name: ouid Value: 61737f5b00010086275c3d090eccfdc5487b946ed5983dea6751
.addthis.com/	1970-01-20 07:30:55	Name: uid Value: 61737f5b156c40f5
.addthis.com/	1970-01-20 07:30:55	Name: na_id Value: 2021102303195544400925831198
.casalemedia.com/	1970-01-20 06:54:55	Name: CMID Value: YXN-W4Vv.VMPj6V2O4al1gAA
.casalemedia.com/	1970-01-20 00:18:55	Name: CMPS Value: 5237
.casalemedia.com/	1970-01-20 00:18:55	Name: CMPRO Value: 1190
.casalemedia.com/	1970-01-20 06:54:55	Name: CMRUM3 Value: 1461737f5b2760k-GIMbuG2RMsVJ36FfRKBFqg4EOWmLffZzL1CXDw
.casalemedia.com/	1970-01-19 22:10:45	Name: CMST Value: YXN-W2Fzf1sA
.media.net/	1970-01-20 06:54:55	Name: visitor-id Value: 2779607957739724000V10
.media.net/	1970-01-19 22:52:31	Name: data-c-ts Value: 1634959195
.media.net/	1970-01-19 22:52:31	Name: data-c Value: k-MYKRLW2RMsVJ36FfRKBFqg4EOWlXKSjGdDTHRg~~3
.media.net/	1970-01-20 02:35:43	Name: gdpr_status Value: 1
.yandex.ru/	1970-01-23 13:45:19	Name: yuidss Value: 608648591634959195
.yandex.ru/	1970-01-23 13:45:19	Name: yandexuid Value: 608648591634959195
.taboola.com/	1970-01-20 06:54:55	Name: t_gid Value: 5974a6c2-8c0d-44c9-9ea9-36174ff4399a-tuct86d04db
.tpmn.co.kr/	1970-01-20 06:54:55	Name: uuid Value: a106cc8bd7124a34ad86ef29ce40f4eb
.tpmn.co.kr/	1970-01-19 22:52:31	Name: criteo Value: k-tycHLW2RMsVJ36FfRKBFqg4EOWkbat4T3hNCgg
.revcontent.com/	1970-02-07 04:09:19	Name: __ID Value: ea79b1a0db0c42bbbcdd6349e6b07300
.revcontent.com/	1970-01-19 22:52:31	Name: v1_151 Value: 1
.adnxs.com/	1970-01-20 00:18:55	Name: anj Value: dTM7k!M4/rD>6NRF']wIg2GVTs-O>%!fss0=RroE7VW]Fp9TuvL1zEOKy-o8M2UW'8D!KwwTSZST-qP_di*ZEl6vp=UQ_#>IweKMIz<Nl$]kNya!tNhToIth8xp
.360yield.com/	1970-01-20 00:18:55	Name: tuuid Value: f9426c59-994d-4448-9f98-d44bfe826f49
.360yield.com/	1970-01-20 00:18:55	Name: tuuid_lu Value: 1634959195
.360yield.com/	1970-01-20 00:18:55	Name: um Value: !38,HCWVaickBphxlIkTAzZa2jrhlhfhldMwjV7u4Y0-rvZqogkQDsQrBsI4u1qcj.6aPI1VQ-AG,1642735195
.360yield.com/	1970-01-20 00:18:55	Name: umeh Value: !38,0,1697167195,-1
.outbrain.com/	1970-01-20 00:18:55	Name: obuid Value: 845185f0-767b-49a7-8a3d-40b66d591550
.outbrain.com/	1970-01-19 22:52:31	Name: criteo Value: k-wNeQUW2RMsVJ36FfRKBFqg4EOWmnGEvum1jt5g
.adtdp.com/	1970-01-20 15:40:31	Name: uid Value: dbc3602b-8be3-43f3-8d1d-e98882caee57
.adtdp.com/	1970-01-20 15:40:31	Name: pr Value: aja
.nr-data.net/	1969-12-31 23:59:59	Name: JSESSIONID Value: 2dc1a9ac94e8e00c
.pro.oxfordincomeletter.com/	1970-01-20 06:54:55	Name: _bs Value: b013c2ec-5f6b-bb03-a11d-8a7747fecad2

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.mgid.com
ad.360yield.com
ad.as.amanad.adtdp.com
ad.tpmn.co.kr
ads.yahoo.com
amplify.outbrain.com
an.yandex.ru
analytics.twitter.com
api.getblueshift.com
api.smartdataprocessor.com
at-api.tribeos.io
b-code.liadm.com
bam-cell.nr-data.net
bat.bing.com
c.bing.com
c.lytics.io
cdn.getblueshift.com
cdn.mediago.io
cdn.taboola.com
cdn1.lockerdomecdn.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
code.jquery.com
connect.facebook.net
contextual.media.net
crb.kargo.com
criteo-sync.teads.tv
cw.addthis.com
d.adroll.com
dis.criteo.com
distillery.wistia.com
dnzkifeab6.execute-api.us-east-1.amazonaws.com
eb2.3lift.com
embedwistia-a.akamaihd.net
fast.wistia.com
fast.wistia.net
fg8vvsvnieiv3ej16jby.litix.io
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
gum.criteo.com
idsync.rlcdn.com
in.hotjar.com
js-agent.newrelic.com
links.daily.the7at7.com
mug.criteo.com
nexus.ensighten.com
partner.mediawallahscript.com
pipedream.wistia.com
pixel.rubiconproject.com
pixel.tapad.com
portrait-tracker.s3.amazonaws.com
pro.oxfordincomeletter.com
r.casalemedia.com
rp.liadm.com
rp4.liadm.com
s.adroll.com
s.yimg.com
s3.amazonaws.com
script.hotjar.com
secure.adnxs.com
signup.wealthyretirement.com
simage2.pubmatic.com
siteimproveanalytics.com
sp.analytics.yahoo.com
sslwidget.criteo.com
stackpath.bootstrapcdn.com
static.ads-twitter.com
static.criteo.net
static.hotjar.com
stats.g.doubleclick.net
storage.googleapis.com
sync-t1.taboola.com
sync.outbrain.com
t.co
tr.outbrain.com
trace.mediago.io
trc-events.taboola.com
trc.taboola.com
trends.revcontent.com
ups.analytics.yahoo.com
vars.hotjar.com
vc.hotjar.io
widget.us.criteo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
x.bidswitch.net
104.19.133.78
104.244.42.133
104.244.42.67
104.26.12.105
104.75.88.126
104.90.104.248
108.128.63.204
13.248.245.213
141.226.228.48
142.250.185.162
142.250.185.226
151.101.1.44
151.101.12.157
151.101.2.137
162.247.243.146
178.250.0.157
178.250.0.163
178.250.2.151
18.157.70.90
18.193.213.131
18.195.42.228
18.66.112.109
18.66.112.79
18.66.122.78
18.66.97.105
18.66.97.123
18.66.97.49
185.33.220.242
185.64.189.110
192.135.136.168
2.16.186.8
2.18.234.190
2.21.140.74
2.21.141.232
2001:4de0:ac18::1:a:1b
212.82.100.181
2600:1f18:730:b120:5b38:df27:617f:9396
2600:9000:223c:0:8:8845:1500:93a1
2600:9000:223c:4e00:b:6268:b880:93a1
2600:9000:224a:b600:6:9280:1080:93a1
2600:9000:2250:8600:11:9be7:da80:93a1
2600:9000:2250:f000:b:c1a2:7dc0:93a1
2606:4700:20::ac43:49ec
2606:4700:3031::ac43:91b0
2606:4700::6810:125e
2606:4700::6812:acf
2620:1ec:c11::200
2a00:1288:80:800::7000
2a00:1450:4001:803::2003
2a00:1450:4001:808::2002
2a00:1450:4001:808::2003
2a00:1450:4001:829::200e
2a00:1450:4001:829::2010
2a00:1450:4001:830::2004
2a00:1450:4001:831::2008
2a00:1450:4001:831::200a
2a00:1450:400c:c0c::9d
2a02:2638:1::13
2a02:2638::3
2a02:6b8::90
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a04:4e42:200::622
2a04:4e42:600::300
3.126.56.137
3.127.62.220
3.225.211.88
34.102.166.132
34.209.144.177
34.237.200.61
34.249.161.76
35.227.248.159
35.244.174.68
52.217.163.201
52.222.236.122
52.50.197.208
52.71.102.166
52.86.94.156
54.146.149.67
54.146.217.90
54.231.98.83
70.42.32.31
74.119.119.150
8.39.36.142
99.81.27.250
00a838051c95fd70f609e56b14160f3b11f9cc925ebf863b6b6d05aa05f18410
01fcf88d0ee0ff3cc10a948024394b5a87004538985081ca233b7a95ff286a12
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
06700a581a344e55ed2950b8ad4be0f9c280da1327dd4cfabf0fee7c829f7c29
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
0d9762a1a60deef8aa093c473ad27c38eed77184d6940e7df06d89d77cbd3e94
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
0efd1a0f2f52ed3d1bbd90257616b1f3f057163e50e3ed7d36af06ffa10b7b06
10b3216083586185ff739310fb1bf46c7d30233d09e19c65bb97532ba7ab2924
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
17f24b54a4a13fc2883ed410149e187bcae4a2cdcf3767ef06d94e585956d390
1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580
1ecaf445d3f1e63f15b6e423e287813a5675461cc9454184d0b49123b286cea4
20dbfb86f0c32d2df915d14abfa11ff1efada9bc6e36f017081c1c75b58559cb
24f7e397faec79e62c37ff2f00b170f6dc1557fb46ac169f9f1897a9d641dd03
254db108a2fb367cbd4580d51f70521239ee4fee9aed37b0a479cf1621a3d393
26719123d5d754f1ea5d46daaddc5c9405b856369c1c7952998bb68d1e7b3e5f
2975b0127d5a785865cead3c21b26c02e2a92ccb0086dd063a8dd71584ad739d
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2f49135953f2aa0b4193440472228c5bf6e88512cc2fcc95622a78ec1ed1452e
3026705f0b903b7d393557aa659e53895313ccdc657e5118e8976a9254d2b00e
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c
3619564fcb70044c9486cd9e1e6cd1608298be072b370e86245a8e94c40326bf
3b5ff3b4df2c343f0c504d2e28bb9a67991b2737859191ba10e35e3c3af45b86
3ddaab281ad27c329b846970baf37d57a32e30030fa5514defe4ad7a61d4d478
3e3343f90766917d535d0c4f6508f66caaef47a4fc052acbc93197effaab1faf
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
40545e036f49a43cd530edfa21f24fbd6d9b7307d39cb117a9eb6408d5ad73ac
4181a1a1202754a6b3bf4bf86f8726fb51d396251654ad7c809f61f7f9664487
41f1e9970b646aadac0f40543bb08b21e49990bf1b09392d1ef4d71b275069ea
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4974446145a917190b705f6575a0dba54fafa0acead60a10d226edb25aa60816
49ab5900241048e3f52a32cf9cf405ec5403001dceef55eba1f128b7809cef2b
49f8fefaf9769967f1dbf2ac4cc7d025e9dd2c9e8746f27db4b956d95193aff3
4a64b8e41c0c6c0d67835f0330e18af8990685557fb203cd2276fe556561d0c4
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b5e988359c30afd1d84b7a5118296f1fc33f4527d530b096ca27aa7fbfef99a
4ba0f48573cc9e7e9c073582fa327ed9682680e5e00a667c138881cc5709739d
4cbf6dc99915177f6304fca1e7cbaf149e86e9871836362ef9ba56454c807765
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e34183431c030f57274b9fdc0c6516af44b04bf964ad017ab8fd6bbf06e81de
4ebfcf12dab4fdbbdcd57892e99792d15e15a3581b39f46926bbb5979d8f1b5e
539877722caad874241ab2ec930b7b4aaa5327a34984b64ad813f8a2998bb862
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
579a172ca2c700734ebcfa06d105a134f31ec2357660e58e0874cfdee8472fd4
58aa5964d6f5dc68b2180e943ea63b6031c0ba83e44d9815e724b10f2f615f9f
5aca5af8d733c500076eed0bbe2f3e2fe2661fe20c613800725a71e66fd5199c
5c0dae79785c9e089d1fe90ef85cc1d2ce86fe739c8b922ccff259ed2a75ac50
5e9a9a65ba525edd4f17e3872079fd67007a3ba3b8247ba6d59d44c8097528c1
5ee751181a92cf6d2531e6a3db04c385b52b835e6b9a977fe5da9a6dad7ae5b6
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
69ae95b7f73e2899d0c398ed4fb9faba242bbec4d0a58b182e4dd0e7808f01ac
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b2b48ca0a09e592b566062a53b111ebc09d2a34a1f04a3b05b00eba9e9760b0
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7f46d5fe65eb99e80cc1a6738a936b62ff370885b1e20c07f18f1d54b857c460
809a6bdcc35b316bf93316955e29816c41204f9bcc5fefb53d8a075bba2ee6ac
8144dd81871ff83480f71004b56e62a6cf2aa40cc9e3e1fa6c8f4a8a3bb6090f
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
846453961b33d6feb0c32e8c65cd76badd5ec41b3a76d7711294cb6b6cd39d66
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
86034bbe69eebb0c08660ff7f0128dd0bd1d852176489ca3a3da7b49bd647cbd
8708150ed307463ea1670f6644f73ec82e3b6e8d6ff95be629b1ba4727f31ac7
88d3b8fe59e5a88b413fe60386adedb716aeeda8f9ee09bc192115f06f399963
9156c89516752ef0dc646a676fb0696fa919f4fe60e36c5fb3b26938a0a2d84c
9413ac70f0dfa293eae8e934799be6a1cde8cd96db876ce9bd127c41630847ee
986468b7e0e23a8da5cc30417d149761ec9d7c072fd1d8601260d079b6cbb139
998d9415269d92557b561a936955f7590d5052865044a9191a528b5a36f3afc9
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a5802a33aa6c4d99c7f536c19a93283ff9fa11cec89b837d489dd1ead7caabf
9ba39a3d7be55a120f9ab47147f0ef2e2acaf539e0876fa262749702d3dda8fc
a1fddf4d5fec5f577b977db5c16c6582c1768324262382650fce903a37d73ab6
a78759ea185fd0fa42ca9be1fc5bca4d3167a2836dc6c85e479a19dbf57fe2c2
a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
ab95872c4726727a3b09b1f8c28490c70b7e407e97fd93bbfb75a2ecc5faac36
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae0883bbbe025eb521b7d73a647ff8e637f863801eb16bbbc4f94069bc17e483
afea74943b3dc591c3bd417429c55e87f9dc9ad5e39ba712e282a5778ac19960
b127181486c082afd048feabd5f69153c3993ccccc57085e4018609ed68f43c3
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2d64dd38087add46d4e02b06bda9e90bd24c70cc574f7dff5ea0ebf22b6b5ac
b9e6c38b3493790e6525ba6715ad839211cab5db3ddc80c7f70f20f92679fee6
b9e8061dc06bd46ed9ced0307804168ec17b011dc31cb2ed15ae60f91c0dcb6a
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355
be68fc7b9e696fe1d0c94d496e1efaae80fdff6c91f90846a05986b05bad2974
c1a3eadb48a1958597631aa02d82267a534882124011e5de97cbf2be2e490c56
c2617f22bd868fb2c199b2ccaf6df1cf44cb86bfd98427ce79447ca498adf9e3
c4ee6e64f22407b19f1c3c3a3b04295141cb70f59c0e192957f3defdf4eb4c74
ca5cdb970cfc816c8e7d271693c21aeee58d9ff6d2111f11ccbd363bdba1f4f5
ce2a97bacbda7013ff938be4e13c1e7bc44fe10d5c171264e3c5d124be924f2e
d2022d29ec3b5750bf27e9338e47fcbdeb28c791c753cf1b59f678dc68066940
d2f346ee82d5d62dd85ab86af1294ee262487f0fd749bd0c832305b97f801595
d6f1b5f056c6c046b95445a24615abd8cdbb41a3242e94fbee1b650b66dab0a0
d77802915404115b7ae2d56748b9baf61a53e1b9e9c3832885fb63e9e898bcbf
d891455e32c9a425e36e190047b1f58abeb7e3709eff687134ddea7ac9cfdd3b
d9f71363b0fd2a7538e42a4c2bc2c2c7063a03ca1d56c818aad803b994ba9c16
da4c70755f82ff615c0fd3cad94bf62b19a9d5c25ab87268097eaa9609098bec
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82
db0155bffd297eceb7a60b7a2bd0e9c84bb9cb02e85380a76bfc06db3c285d70
db976b4527d25fe48cdf9a1c34c6520f7cad96f901e4534938f570230c105319
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e468b4da71b099aec19b5bff6960c3e5f1cab6ecb80b4f850228c32b33c50860
e678bac0260919547057d60ccc55c1fe197b651b1676fc227186fceb8ef2b189
e77bf6dbfb04b5c3b173c0200b90751306befe5c2e55c6172e7e69dc16b24795
ea0ccf3eab05a27a83fdc3a0c60ede70d4d2f18bf8be6cbdcc221d43ad5686ec
eb2798553d86c6b1806d208320f645bd79eab0cebcf22176bddbc648e8f3ccd4
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
efb3cdc5e4582fd67dffab6fc6e5062074ce3f8c51747346af944e97749dc309
f579d0d389fc9ed1155d98638ef89a78721c0103ca5fbdc4d38f16a0a2515e0b
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f5c6b458bcbddc02e7a178b1c4359e0b4aa5c041e5dcd0384657a69c905cacfa
f82ee536f31f8474c7c42ce6da4e2dafe810c4942328e7711a7e823c0e328808
fc27aed7787a4f63d2feba50e6bc6122ac3c5479456d40c0a445899a08ad92f3
fff426e1f2e0f6df1fdf4fd50790a29de380123e633dde9eb76290852785221c

pro.oxfordincomeletter.com Open in urlscan Pro 192.135.136.168 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

203 Requests

100 %HTTPS

34 %IPv6

64 Domains

91 Subdomains

80 IPs

10 Countries

3166 kBTransfer

8461 kBSize

87 Cookies

0 Outgoing links

Page URL History

Redirected requests

203 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

pro.oxfordincomeletter.com Open in urlscan Pro
192.135.136.168 Public Scan

Screenshot
Live screenshot

Full Image

203
Requests

100 %
HTTPS

34 %
IPv6

64
Domains

91
Subdomains

80
IPs

10
Countries

3166 kB
Transfer

8461 kB
Size

87
Cookies

203 HTTP transactions
0 data transactions