urlscan.io logo urlscan.io
SecurityTrails logo

freedomheadlines.com Open in urlscan Pro
2a06:98c1:3121::3  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://mailz.leafybranch.com/index.php/campaigns/ot6051vydsfcc/track-url/me966hgmsl0dd/591036cca653f1101c966076bd84d8a57005ff39
Effective URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&ut...
Submission: On August 28 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 45 IPs in 5 countries across 32 domains to perform 247 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is freedomheadlines.com.
TLS certificate: Issued by GTS CA 1P5 on July 29th 2023. Valid for: 3 months.
This is the only time freedomheadlines.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2600:3c00::f0... 63949 (AKAMAI-LI...)
25 2a06:98c1:312... 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
16 2a00:1450:400... 15169 (GOOGLE)
12 2606:2800:234... 15133 (EDGECAST)
9 2606:4700:e4:... 13335 (CLOUDFLAR...)
15 151.139.128.10 20446 (STACKPATH...)
9 2606:4700:10:... 13335 (CLOUDFLAR...)
5 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
3 104.244.42.200 13414 (TWITTER)
2 2a00:1450:400... 15169 (GOOGLE)
6 26 2a00:1450:400... 15169 (GOOGLE)
3 34.149.139.129 15169 (GOOGLE)
1 2001:4860:480... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
4 2606:2800:134... 15133 (EDGECAST)
2 2606:4700:440... 13335 (CLOUDFLAR...)
37 2a00:1450:400... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700:10:... 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
1 2.19.244.232 16625 (AKAMAI-AS)
6 7 2a00:1450:400... 15169 (GOOGLE)
2 142.250.185.67 15169 (GOOGLE)
12 216.58.206.34 15169 (GOOGLE)
2 151.101.2.132 54113 (FASTLY)
4 108.128.120.222 16509 (AMAZON-02)
2 34.197.86.75 14618 (AMAZON-AES)
15 2.16.100.56 20940 (AKAMAI-ASN1)
3 207.244.91.229 30633 (LEASEWEB-...)
1 34.194.83.231 14618 (AMAZON-AES)
4 18.203.210.121 16509 (AMAZON-02)
1 2 217.182.178.224 16276 (OVH)
1 2a02:26f0:780... 20940 (AKAMAI-ASN1)
1 23.82.15.161 30633 (LEASEWEB-...)
1 141.95.98.64 ()
1 34.120.133.55 ()
1 54.171.14.223 ()
1 15.197.193.217 ()
1 104.18.39.155 ()
1 141.95.98.65 ()
247 45
1    2600:3c00::f03c:93ff:fe39:3408 (Richardson, United States)

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
mailz.leafybranch.com
25    2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)
freedomheadlines.com
3    2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2606:4700:10::ac43:264e (United States)

ASN13335 (CLOUDFLARENET, US)
users.api.jeeng.com
16    2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
12    2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)
platform.twitter.com
9    2606:4700:e4::ac40:a50b (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.whizzco.com
api.whizzco.com
15    151.139.128.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: map3.hwcdn.net
cdn1.lockerdomecdn.com
cdn2.decide.dev
assets.netizen.co
assets.revcontent.com
img.revcontent.com
images.netizen.co
9    2606:4700:10::6816:3da8 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.vuukle.com
vuukle.com
api.vuukle.com
publish.vuukle.com
5    2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
3    2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
securepubads.g.doubleclick.net
3    104.244.42.200 (United States)

ASN13414 (TWITTER, US)
syndication.twitter.com
2    2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
26    2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
3    34.149.139.129 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 129.139.149.34.bc.googleusercontent.com
decide.dev
1    2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
1    2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
partner.googleadservices.com
4    2a00:1450:400c:c07::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
4    2606:2800:134:fa2:1627:1fe:edb:1665 (United States)

ASN15133 (EDGECAST, US)
cdn.syndication.twimg.com
pbs.twimg.com
2    2606:4700:4400::6812:2b5a (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.confiant-integrations.net
37    2a00:1450:4001:828::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
6    2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
2    2606:4700:10::6816:39ae (United States)

ASN13335 (CLOUDFLARENET, US)
telemetries.jeeng.com
3    2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fundingchoicesmessages.google.com
1    2.19.244.232 (Düsseldorf, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-19-244-232.deploy.static.akamaitechnologies.com
ads.pubmatic.com
7    2a00:1450:4001:812::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
2    142.250.185.67 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f3.1e100.net
p4-bxlpgat6ptlbc-24skbq56hefzhukm-if-v6exp3-v4.metric.gstatic.com
12    216.58.206.34 (United States)

ASN15169 (GOOGLE, US)
PTR: mil07s07-in-f2.1e100.net
www.googleadservices.com
2    151.101.2.132 (United States)

ASN54113 (FASTLY, US)
player.ex.co
4    108.128.120.222 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-108-128-120-222.eu-west-1.compute.amazonaws.com
trends.netizen.co
2    34.197.86.75 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-197-86-75.compute-1.amazonaws.com
collector.ex.co
15    2.16.100.56 (Düsseldorf, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-100-56.deploy.static.akamaitechnologies.com
mcd.ex.co
cdn.ex.co
3    207.244.91.229 (Brentwood, United States)

ASN30633 (LEASEWEB-USA-WDC, US)
p.channelexco.com
s-12.channelexco.com
1    34.194.83.231 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-194-83-231.compute-1.amazonaws.com
gpv.ex.co
4    18.203.210.121 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-203-210-121.eu-west-1.compute.amazonaws.com
yeet.revcontent.com
2    217.182.178.224 (Paris, France)

ASN16276 (OVH, FR)
PTR: ip224.ip-217-182-178.eu
www9.smartadserver.com
1    2a02:26f0:780::210:ca78 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
creatives.sascdn.com
1    23.82.15.161 (Manassas, United States)

ASN30633 (LEASEWEB-USA-WDC, US)
e.channelexco.com
1    141.95.98.64 (None, )

ASN- ()
id5-sync.com
1    34.120.133.55 (None, )

ASN- ()
api.rlcdn.com
1    54.171.14.223 (None, )

ASN- ()
id.crwdcntrl.net
1    15.197.193.217 (None, )

ASN- ()
match.adsrvr.org
1    104.18.39.155 (None, )

ASN- ()
htlb.casalemedia.com
1    141.95.98.65 (None, )

ASN- ()
lb.eu-1-id5-sync.com
Apex Domain
Subdomains		 Transfer
53 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 116
tpc.googlesyndication.com — Cisco Umbrella Rank: 155
892 KB
33 doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 210
googleads.g.doubleclick.net — Cisco Umbrella Rank: 42
stats.g.doubleclick.net — Cisco Umbrella Rank: 93
551 KB
25 freedomheadlines.com
freedomheadlines.com
410 KB
20 ex.co
player.ex.co — Cisco Umbrella Rank: 11177
collector.ex.co — Cisco Umbrella Rank: 11048
mcd.ex.co — Cisco Umbrella Rank: 15334
cdn.ex.co — Cisco Umbrella Rank: 11835
gpv.ex.co — Cisco Umbrella Rank: 12333
2 MB
15 twitter.com
platform.twitter.com — Cisco Umbrella Rank: 1014
syndication.twitter.com — Cisco Umbrella Rank: 1273
437 KB
13 netizen.co
assets.netizen.co — Cisco Umbrella Rank: 55886
trends.netizen.co — Cisco Umbrella Rank: 54377
images.netizen.co — Cisco Umbrella Rank: 60159
169 KB
13 googleadservices.com
partner.googleadservices.com — Cisco Umbrella Rank: 1120
www.googleadservices.com — Cisco Umbrella Rank: 150
608 B
10 google.com
fundingchoicesmessages.google.com — Cisco Umbrella Rank: 1585
www.google.com — Cisco Umbrella Rank: 2
101 KB
9 vuukle.com
cdn.vuukle.com — Cisco Umbrella Rank: 18191
vuukle.com — Cisco Umbrella Rank: 6260
api.vuukle.com — Cisco Umbrella Rank: 28231
publish.vuukle.com — Cisco Umbrella Rank: 22004
213 KB
9 whizzco.com
cdn.whizzco.com — Cisco Umbrella Rank: 63753
api.whizzco.com — Cisco Umbrella Rank: 61019
6 KB
7 revcontent.com
assets.revcontent.com — Cisco Umbrella Rank: 7352
img.revcontent.com — Cisco Umbrella Rank: 12438
yeet.revcontent.com — Cisco Umbrella Rank: 8344
16 KB
7 gstatic.com
fonts.gstatic.com
p4-bxlpgat6ptlbc-24skbq56hefzhukm-if-v6exp3-v4.metric.gstatic.com
238 KB
6 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 222
340 KB
5 decide.dev
cdn2.decide.dev — Cisco Umbrella Rank: 28516
decide.dev — Cisco Umbrella Rank: 21345
10 KB
4 channelexco.com
p.channelexco.com — Cisco Umbrella Rank: 12360
s-12.channelexco.com — Cisco Umbrella Rank: 79464
e.channelexco.com — Cisco Umbrella Rank: 11777
7 KB
4 twimg.com
cdn.syndication.twimg.com — Cisco Umbrella Rank: 3106
pbs.twimg.com — Cisco Umbrella Rank: 1054
67 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 37
region1.google-analytics.com — Cisco Umbrella Rank: 2412
21 KB
3 jeeng.com
users.api.jeeng.com — Cisco Umbrella Rank: 33261
telemetries.jeeng.com — Cisco Umbrella Rank: 21638
158 KB
3 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 45
6 KB
2 smartadserver.com
www9.smartadserver.com — Cisco Umbrella Rank: 13736
prg.smartadserver.com Failed
1 KB
2 confiant-integrations.net
cdn.confiant-integrations.net — Cisco Umbrella Rank: 1541
104 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 48
140 KB
1 eu-1-id5-sync.com
lb.eu-1-id5-sync.com
407 B
1 casalemedia.com
htlb.casalemedia.com
546 B
1 adsrvr.org
match.adsrvr.org
393 B
1 crwdcntrl.net
id.crwdcntrl.net
320 B
1 rlcdn.com
api.rlcdn.com
256 B
1 id5-sync.com
id5-sync.com
550 B
1 sascdn.com
creatives.sascdn.com — Cisco Umbrella Rank: 11485
388 B
1 pubmatic.com
ads.pubmatic.com — Cisco Umbrella Rank: 547
67 KB
1 lockerdomecdn.com
cdn1.lockerdomecdn.com — Cisco Umbrella Rank: 21049
770 B
1 leafybranch.com
mailz.leafybranch.com
713 B
247 32
Domain Requested by
37 tpc.googlesyndication.com googleads.g.doubleclick.net
pagead2.googlesyndication.com
tpc.googlesyndication.com
26 googleads.g.doubleclick.net 6 redirects pagead2.googlesyndication.com
googleads.g.doubleclick.net
25 freedomheadlines.com freedomheadlines.com
16 pagead2.googlesyndication.com freedomheadlines.com
pagead2.googlesyndication.com
googleads.g.doubleclick.net
www.googletagservices.com
tpc.googlesyndication.com
12 mcd.ex.co freedomheadlines.com
cdn.ex.co
12 www.googleadservices.com googleads.g.doubleclick.net
freedomheadlines.com
12 platform.twitter.com freedomheadlines.com
platform.twitter.com
8 images.netizen.co freedomheadlines.com
8 api.whizzco.com cdn.whizzco.com
7 www.google.com 6 redirects tpc.googlesyndication.com
6 www.googletagservices.com googleads.g.doubleclick.net
6 cdn.vuukle.com freedomheadlines.com
cdn.vuukle.com
5 fonts.gstatic.com fonts.googleapis.com
freedomheadlines.com
4 yeet.revcontent.com assets.netizen.co
4 trends.netizen.co assets.netizen.co
4 stats.g.doubleclick.net www.google-analytics.com
decide.dev
3 cdn.ex.co player.ex.co
cdn.ex.co
3 fundingchoicesmessages.google.com securepubads.g.doubleclick.net
3 pbs.twimg.com freedomheadlines.com
3 decide.dev cdn2.decide.dev
3 syndication.twitter.com platform.twitter.com
freedomheadlines.com
3 securepubads.g.doubleclick.net cdn.vuukle.com
securepubads.g.doubleclick.net
3 fonts.googleapis.com freedomheadlines.com
client
2 www9.smartadserver.com 1 redirects
2 p.channelexco.com cdn.ex.co
2 assets.revcontent.com assets.netizen.co
2 collector.ex.co player.ex.co
2 player.ex.co freedomheadlines.com
player.ex.co
2 p4-bxlpgat6ptlbc-24skbq56hefzhukm-if-v6exp3-v4.metric.gstatic.com googleads.g.doubleclick.net
p4-bxlpgat6ptlbc-24skbq56hefzhukm-if-v6exp3-v4.metric.gstatic.com
2 telemetries.jeeng.com users.api.jeeng.com
2 cdn.confiant-integrations.net cdn.vuukle.com
cdn.confiant-integrations.net
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 cdn2.decide.dev freedomheadlines.com
cdn1.lockerdomecdn.com
2 www.googletagmanager.com freedomheadlines.com
www.googletagmanager.com
1 lb.eu-1-id5-sync.com cdn.ex.co
1 htlb.casalemedia.com cdn.ex.co
1 match.adsrvr.org cdn.ex.co
1 id.crwdcntrl.net cdn.ex.co
1 api.rlcdn.com cdn.ex.co
1 id5-sync.com cdn.ex.co
1 e.channelexco.com cdn.ex.co
1 creatives.sascdn.com
1 s-12.channelexco.com
1 gpv.ex.co cdn.ex.co
1 img.revcontent.com freedomheadlines.com
1 ads.pubmatic.com assets.netizen.co
1 assets.netizen.co cdn.whizzco.com
1 cdn.syndication.twimg.com platform.twitter.com
1 partner.googleadservices.com pagead2.googlesyndication.com
1 region1.google-analytics.com www.googletagmanager.com
1 publish.vuukle.com cdn.vuukle.com
1 api.vuukle.com cdn.vuukle.com
1 vuukle.com cdn.vuukle.com
1 cdn1.lockerdomecdn.com freedomheadlines.com
1 cdn.whizzco.com freedomheadlines.com
1 users.api.jeeng.com freedomheadlines.com
1 mailz.leafybranch.com 1 redirects
0 prg.smartadserver.com Failed cdn.ex.co
247 58

This site contains links to these domains. Also see Links.

Domain
vuukle.com
smeagol.revcontent.com
www.facebook.com
twitter.com
pinterest.com
plus.google.com
Subject Issuer Validity Valid
freedomheadlines.com
GTS CA 1P5		 2023-07-29 -
2023-10-27		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-08-07 -
2023-10-30		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-08-07 -
2023-10-30		 3 months crt.sh
jeeng.com
Cloudflare Inc ECC CA-3		 2023-07-14 -
2024-07-13		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-08-07 -
2023-10-30		 3 months crt.sh
*.twimg.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-07-28 -
2024-07-26		 a year crt.sh
whizzco.com
Cloudflare Inc ECC CA-3		 2023-03-31 -
2024-03-30		 a year crt.sh
cdn1.lockerdomecdn.com
R3		 2023-07-05 -
2023-10-03		 3 months crt.sh
cdn2.decide.dev
R3		 2023-07-05 -
2023-10-03		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-05-05 -
2024-05-04		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2023-08-07 -
2023-10-30		 3 months crt.sh
syndication.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2023-02-05 -
2024-02-05		 a year crt.sh
decide.dev
GTS CA 1D4		 2023-08-18 -
2023-11-16		 3 months crt.sh
*.googleadservices.com
GTS CA 1C3		 2023-08-07 -
2023-10-30		 3 months crt.sh
confiant-integrations.net
GTS CA 1P5		 2023-07-23 -
2023-10-21		 3 months crt.sh
assets.netizen.co
R3		 2023-07-06 -
2023-10-04		 3 months crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2023-08-07 -
2023-10-30		 3 months crt.sh
*.google.com
GTS CA 1C3		 2023-08-07 -
2023-10-30		 3 months crt.sh
*.pubmatic.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-01-25 -
2024-01-24		 a year crt.sh
www.googleadservices.com
GTS CA 1C3		 2023-08-07 -
2023-10-30		 3 months crt.sh
*.ex.co
Go Daddy Secure Certificate Authority - G2		 2023-06-08 -
2024-07-09		 a year crt.sh
netizen.co
Amazon RSA 2048 M01		 2023-08-28 -
2024-09-23		 a year crt.sh
assets.revcontent.com
R3		 2023-07-10 -
2023-10-08		 3 months crt.sh
img.revcontent.com
R3		 2023-07-11 -
2023-10-09		 3 months crt.sh
cdn.ex.co
R3		 2023-08-16 -
2023-11-14		 3 months crt.sh
images.netizen.co
R3		 2023-07-04 -
2023-10-02		 3 months crt.sh
*.channelexco.com
R3		 2023-07-23 -
2023-10-21		 3 months crt.sh
revcontent.com
Amazon RSA 2048 M02		 2023-05-18 -
2024-06-16		 a year crt.sh
*.sascdn.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-07-14 -
2024-07-17		 a year crt.sh
*.id5-sync.com
R3		 2023-08-22 -
2023-11-20		 3 months crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2023-02-02 -
2024-03-03		 a year crt.sh
*.crwdcntrl.net
Amazon RSA 2048 M01		 2022-11-07 -
2023-12-06		 a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2023-04-12 -
2024-05-13		 a year crt.sh
casalemedia.com
Cloudflare Inc ECC CA-3		 2023-05-21 -
2024-05-20		 a year crt.sh
*.eu-1-id5-sync.com
R3		 2023-08-22 -
2023-11-20		 3 months crt.sh

This page contains 30 frames:

Primary Page: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Frame ID: E499979805BD852DBCD9D6D02ACB6ED7
Requests: 121 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Ffreedomheadlines.com
Frame ID: B438CC3BCBA33B050716990C621FD4CA
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230823/r20190131/zrt_lookup.html
Frame ID: FB416D2CD25E44C951DA06C40059AD09
Requests: 1 HTTP requests in this frame

Frame: https://decide.dev/lad/14305628449616998?pubid=ld-1613-6204&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=780&path=%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Frame ID: 8A5E624EA254B0A501B7D61CA328E3D9
Requests: 2 HTTP requests in this frame

Frame: https://decide.dev/lad/14305626872558694?pubid=ld-9377-335&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=780&path=%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Frame ID: BC7DF23A83ADD4BA44F0C535A7ED9CAB
Requests: 2 HTTP requests in this frame

Frame: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOltdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2ZvbGxvd2VyX2NvdW50X3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9iYWNrZW5kIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19yZWZzcmNfc2Vzc2lvbiI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfZm9zbnJfc29mdF9pbnRlcnZlbnRpb25zX2VuYWJsZWQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X21peGVkX21lZGlhXzE1ODk3Ijp7ImJ1Y2tldCI6InRyZWF0bWVudCIsInZlcnNpb24iOm51bGx9LCJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3Nob3dfYmlyZHdhdGNoX3Bpdm90c19lbmFibGVkIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdXNlX3Byb2ZpbGVfaW1hZ2Vfc2hhcGVfZW5hYmxlZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfbGVnYWN5X3RpbWVsaW5lX3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1694099334516642113&lang=en&origin=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&sessionId=085754ac85675148371d156177accaf7951a9cf7&theme=light&widgetsVersion=aaf4084522e3a%3A1674595607486&width=550px
Frame ID: A9E06D03F766677FEA0AF56071FED85A
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&adk=1812271804&adf=3025194257&lmt=1693235172&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=188x810_l%7C188x810_r&format=0x0&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&ea=0&pra=5&wgl=1&easpi=0&asro=0&asrtr=1&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372481&bpp=3&bdt=317&idt=208&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3401048158439&frm=20&pv=2&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=231
Frame ID: E50409C14C53F27D687DB289206340F1
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9983601263&adk=3783032378&adf=3194834441&pi=t.ma~as.9983601263&w=800&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=800x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372484&bpp=2&bdt=320&idt=232&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=210&ady=228&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=iq91xKOlnJ&p=https%3A//freedomheadlines.com&dtd=238
Frame ID: 380D23254FD00508F191FE1B83B37FCD
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=8095804527&adk=1256974889&adf=1803170222&pi=t.ma~as.8095804527&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=298&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=768&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=DtpwuWusDU&p=https%3A//freedomheadlines.com&dtd=300
Frame ID: 187D194A63B08D59AB0BFDB53859B0F3
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=1338824485&adk=2385089580&adf=636453947&pi=t.ma~as.1338824485&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=318&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=1450&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=6bTkhJBiCn&p=https%3A//freedomheadlines.com&dtd=321
Frame ID: F5F2BC9AC894BE73F85B2C9BFB3CAE3C
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=2460334462&adk=1888080162&adf=1599616005&pi=t.ma~as.2460334462&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=400&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=2045&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=sIpVMAzNQf&p=https%3A//freedomheadlines.com&dtd=402
Frame ID: 6818C9A2D13BAF96EA2E9C98B277E140
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=7329517760&adk=1851110203&adf=1936646016&pi=t.ma~as.7329517760&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=438&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3203&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=a3jmjrX9MK&p=https%3A//freedomheadlines.com&dtd=440
Frame ID: 4653B49800114F9F893E6D6C2E86CB1E
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9572537723&adk=2027367073&adf=2444534581&pi=t.ma~as.9572537723&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=450&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D0b5b07eb8b8de6eb-22e69c165fde0065%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MZG9A1pc5vb0F5esQL9iZw22nOIKg&gpic=UID%3D00000c69a68e8849%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MY_LfWJZwfbjugP0UdrN1kslLFx7A&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3902&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=8GRgyAgS8H&p=https%3A//freedomheadlines.com&dtd=452
Frame ID: 411E0A4EBF4466852925BAA78DA3FC28
Requests: 10 HTTP requests in this frame

Frame: https://decide.dev/lad/14729220068684902?pubid=ld-14729220068684902&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=1560&path=%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Frame ID: EA6640B6D57D363AE37D957E7C6ED4F1
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 954C5190226A5CAF7ED81F23D94BF6BD
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 63EAC417005415F93C6EAFE48E38310D
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: DF5F823581D8A2533741C56A82750A99
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 9EACC8AC5F06552DC09ADB93605ABFA2
Requests: 2 HTTP requests in this frame

Frame: https://p4-bxlpgat6ptlbc-24skbq56hefzhukm-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html
Frame ID: 9AEF94CEB222DC18B7DB367AEEB42041
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: F8013BFB70D20EB3FFA250E9CBE52B49
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
Frame ID: BFB19B0B5E315F49EF0F2979BBEB4434
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
Frame ID: 410F9D5F7542F63B9CD44A86F3052FF6
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
Frame ID: CA25E4D509955376E44E4C32E09C32B8
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
Frame ID: C06E71B6B9FFC34C50D6CC385B1A79B7
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
Frame ID: 78D87AFFD10AC016C2D79F15030BC6A0
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 30A67E84C8867DC90F2568E523A0AE09
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
Frame ID: 988387F08CBBD67DD70F53ADEEB6ADD7
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 4986FF5165FEDC9A6C2B05018A769F8F
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: DF8E8E68FA1BAB2A611672FF1A6ED4F3
Requests: 2 HTTP requests in this frame

Frame: https://cdn.ex.co/prebid/production/release/1.6.1/latest/expb.js
Frame ID: 40EA786681235A8D6028F1D68B4D8EB8
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Former Mar-a-Lago Employee FLIPS on Trump – Freedom Headlines | Top Political News USA | USA Politics

Page URL History Show full URLs

  1. https://mailz.leafybranch.com/index.php/campaigns/ot6051vydsfcc/track-url/me966hgmsl0dd/591036cca653f1101c... HTTP 301
    https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com
Overall confidence: 100%
Detected patterns
  • //platform\.twitter\.com/widgets\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

247
Requests

96 %
HTTPS

53 %
IPv6

32
Domains

58
Subdomains

45
IPs

5
Countries

5550 kB
Transfer

14026 kB
Size

12
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://mailz.leafybranch.com/index.php/campaigns/ot6051vydsfcc/track-url/me966hgmsl0dd/591036cca653f1101c966076bd84d8a57005ff39 HTTP 301
    https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 130
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 134
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 145
  • https://googleads.g.doubleclick.net/pagead/adview?ai=Cw4YKBNTsZI6_M4LKtwe96JPYBPnGxZ1xvbHJ6akRv-EeEAEg-833lQFglYKAgKwHoAGVmOnHAsgBAqgDAcgDyQSqBLgCT9C1EEXLM0NjZ-H8Y3bM7U3bDBHHKyfszhI3cOWN8PjUWYg1dBAB7jbIrUOFl2Bn0cTwbTKvyO6Z5O9jxQMBL1z1oN92XNIFKRf6WgmviZDxCCa11OH-wQXVbRpTXYFNJnTKYTiXvc0r-8VqAL7IUGfiMpXVQBmDuqyui_JnbfZ815aJSHZrO3yxKf00Cw1rY-zA-VQsmZ2cpQpCdUEPvKefci3uwwWb68Y7rpMyNO6dfIqoMD4BGRCDK0NPAJDCawzhtaMnnEQIpYoFtH5c0mb3jiqjtT6S0UEqqejwpRZenHyhr8XYtbZKGyKoOylmDzCAqjqrr9utVFpVVh19uYNr72_v2gVaKeVCGmKetuexG_NEGuqkfdTZ0J8X4OT8QQCkSJnHMvvPMHZZSjHst4YOmvf2Z_dowATrwJziwwSIBdywu7RLkgUECAQYAZIFBAgFGASgBgKAB_722cYBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQjJUV0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOpoJYmh0dHBzOi8vZHJhdXNzZW5mZWV0LmRlL3Byb2R1Y3RzLzMxMzA2LWhlcnJlbi1mcnVobGluZy1zb21tZXItZ2VzY2hsb3NzZW4ta2xldHR2ZXJzY2hsdXNzLXNhbmRhbGVugAoByAsB2BMM0BUBgBcBshccChoIABIUcHViLTg4OTgwNzY0MjM2MDAzNTIYAA&sigh=caA0C2LZzQg&uach_m=[UACH]&ase=2&cid=CAQSGwBpAlJWS7bkM0k7_m_0yQvdzgCHozw_P5g8ChgB&cbvp=2&vis=1 HTTP 302
  • https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%225734965869933055012%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22687492117%22],%224%22:[%2208-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%221888465040357297121%22}&andc=true
Request Chain 147
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 148
  • https://googleads.g.doubleclick.net/pagead/adview?ai=C6CLRBNTsZKumLsOGtwfOorywCsW_pYtx55-x5KoOv-EeEAEg-833lQFglYKAgKwHoAGVmOnHAsgBAqgDAcgDyQSqBLgCT9CKMKYFDVCdJSpkoS35qs7m_CF4sLuU8vGz1rKZ4ILOsDG-4HYsPGy2WCb_jPt3b6RD6OgO5AlxeKDeb0VEDzE0xHki36v7GgHYcdivJPwkzCwczDi9ArrXic6Dj60oo5EN5kfJaiL0Dn_i14zMRZ49P063c6csgNBHAJoMvDfuTiiWOwRiJzPi4BDkT0LaMUazrA9bueHO17FKZeURCnaIi67tUtcEqzcC63hOO4qm7sG7Ex9kUDqLXkkS4ZmcCsYHn7sMQO9hGQl1Yy64ThHrzssb7rKyo5srZRlzVguWX13mS-MC6hsp2n_lG-LaqFMXZ4JCSmx9mYvvjB1DFd_aKpSIpAyH_q4_TGm-moqia3OqnSB84OU44HWlIY1WIb7BDnwd74v5sPfHR2pMdSFzmxf5P-blwATM8tSq2AOIBeWYgaU1kgUECAQYAZIFBAgFGASgBgKAB_722cYBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQ37wP0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOpoJbmh0dHBzOi8vZHJhdXNzZW5mZWV0LmRlL3Byb2R1Y3RzLzMxMzQ1LWhlcnJlbi1zaWRlLXppcHBlci1jb21meS1oYW5kLXN0aXRjaGluZy1taWNyb2Zhc2VyLWxlZGVyLWZyZWl6ZWl0c2NodWhlgAoByAsB2BMM0BUBgBcBshccChoIABIUcHViLTg4OTgwNzY0MjM2MDAzNTIYAA&sigh=T3zFIeBJIMM&uach_m=[UACH]&ase=2&cid=CAQSGwBpAlJWbRESGxMBc9BLUHmSrXNXJw3QadCBtBgB&cbvp=2&vis=1 HTTP 302
  • https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229240836217993212486%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22687492117%22],%224%22:[%2208-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%222142912527629721377%22}&andc=true
Request Chain 154
  • https://googleads.g.doubleclick.net/pagead/adview?ai=C6vFeBNTsZJijMoPJtwecuor4AcW_pYtx55-x5KoOv-EeEAEg-833lQFglYKAgKwHoAGVmOnHAsgBAqgDAcgDyQSqBLgCT9B8SB5bj2j8gwwmiUnnSi19tpI9C4Rq_d1rOaanDuebEcZtca9J3_VSL8jEdMwDy5TB_IizIZlA631yOneDNRdDUViL10heN0Vsr3zOrqESlzBfipD9hyhs6ccQ3CA35SWeWFWhISVx0S-mGLoZKBjktooSQSZ3Q0NEsiehN6pbWgQisvf6ElIYwZvp-kjYz6GhFNWrTDBQ2MqOjTe6juw-FgmVkqywl7DbRiYT52rCF2uIouvEWIJjmEER8452Op6AtGPZ-9OKFCXHyjXgWJgASSyC8kGfikbd1J4_fW6DeCgNpgMy-6hm7Unk2PfbeLRDm5FJ8ENKrN6TKaKKVyp8a4If2q74aIU_4Z2_GX5y8UzF2_xa1SyAJ1p1A0jYxBz1Uyod16QRVsUW508G9-UIRSw6iT2WwATM8tSq2AOIBeWYgaU1kgUECAQYAZIFBAgFGASgBgKAB_722cYBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQ0tgP0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOpoJbmh0dHBzOi8vZHJhdXNzZW5mZWV0LmRlL3Byb2R1Y3RzLzMxMzQ1LWhlcnJlbi1zaWRlLXppcHBlci1jb21meS1oYW5kLXN0aXRjaGluZy1taWNyb2Zhc2VyLWxlZGVyLWZyZWl6ZWl0c2NodWhlgAoByAsB2BMM0BUBgBcBshccChoIABIUcHViLTg4OTgwNzY0MjM2MDAzNTIYAA&sigh=HYs2ADwUkDc&uach_m=[UACH]&ase=2&cid=CAQSGwBpAlJW__cYjTMMkItj_BaRhyCw7DG8R-7SrhgB&cbvp=2&vis=1 HTTP 302
  • https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%226049087037511669549%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22687492117%22],%224%22:[%2208-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2213558716057050218513%22}&andc=true
Request Chain 156
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 161
  • https://googleads.g.doubleclick.net/pagead/adview?ai=C20iwBNTsZPSpO82ItwfT4rfoB_nGxZ1xvbHJ6akRv-EeEAEg-833lQFglYKAgKwHoAGVmOnHAsgBAqgDAcgDyQSqBLgCT9BCbLbw1XiO57xhmDu00dMjEd2ayAyKa_jXoiWeCOST0hLW_xmqQ8w9XIIu9Gk1IbBqafNEZKEE4YhWhLogtMO-XK0AMIhw4to2zXKBzlGKYA4I6ONseLIu6ah9CgshEbvgQW43UPauG7g2NcgE5CPRrr7U8ldN2bAtnRJ7Dilfyadi99KZx0_f9NlmrXBslXVIrkcwTh5ajvaATbrYfN0QVmT8ioIy4sonQN3Y0BbzgCCcwe1itikm40wgwYaaVWgvJxk5v99CjpwXnptsyGfI0Q2_vNdVDulmholqgs6RWAbA4SQ6IcZJGDLKDHkB-etHdytfAH1nCwzYm903Pqo7TGUNi4Me_4Kb-L70shwhQe-D6E7237xYRJ3KS7wImhAzWWuka6d9mmu5K0tT7UAmW_q0W7pdwATrwJziwwSIBdywu7RLkgUECAQYAZIFBAgFGASgBgKAB_722cYBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQkIEU0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOpoJYmh0dHBzOi8vZHJhdXNzZW5mZWV0LmRlL3Byb2R1Y3RzLzMxMzA2LWhlcnJlbi1mcnVobGluZy1zb21tZXItZ2VzY2hsb3NzZW4ta2xldHR2ZXJzY2hsdXNzLXNhbmRhbGVugAoByAsB2BMM0BUBgBcBshccChoIABIUcHViLTg4OTgwNzY0MjM2MDAzNTIYAA&sigh=vsaq9tpPfuc&uach_m=[UACH]&ase=2&cid=CAQSGwBpAlJWIquroOQH6YCJ7eHcXZfeAV8U8gtIhRgB&cbvp=2&vis=1 HTTP 302
  • https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229173197325081411856%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22687492117%22],%224%22:[%2208-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2211091382014766269441%22}&andc=true
Request Chain 162
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 172
  • https://googleads.g.doubleclick.net/pagead/adview?ai=CkPBfBNTsZKqFOYiPtwfR1L6gCMW_pYtx55-x5KoOv-EeEAEg-833lQFglYKAgKwHoAGVmOnHAsgBAqgDAcgDyQSqBLgCT9CYJIw8oOUUTOPcCBYSYUfFl9WP1XD6POqvZh3esae3SVLaDFPby_-8PxE_YW-OicDQo9Fn_UOnhlAkPNG-GQivNEjVQIOP9WysqyCxLXv6EhkQy_0OM4mYlJf3jV2Y-soXkd233RNElMPLscWUTwhGDzsly1j0ms9_FQhkMapwkBzwvz6hjneM73qGSsP1GXVeJg_1NWXuwzsFUeA2Y_0uXiNlMBxpAP6vOYdEBspmT1_s1iG_K8Y5IJCjPbVNrHI8KdVvoVgOoCQSdosRFBFzKYUOiVp49H3FQjO5koM3qXutH9oEFMEA96culDCy6GZRivkPjqX77K_rGElVH55fTj7Y7kblL5w9dloHXWpgbwz3o6-Dq-uE1_cg-h8eTTtMGyQsoOhrTZJqPFrrNgHuvybyqQLrwATM8tSq2AOIBeWYgaU1kgUECAQYAZIFBAgFGASgBgKAB_722cYBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQm74T0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOpoJbmh0dHBzOi8vZHJhdXNzZW5mZWV0LmRlL3Byb2R1Y3RzLzMxMzQ1LWhlcnJlbi1zaWRlLXppcHBlci1jb21meS1oYW5kLXN0aXRjaGluZy1taWNyb2Zhc2VyLWxlZGVyLWZyZWl6ZWl0c2NodWhlgAoByAsB2BMM0BUBgBcBshccChoIABIUcHViLTg4OTgwNzY0MjM2MDAzNTIYAA&sigh=70jL5whm2_s&uach_m=[UACH]&ase=2&cid=CAQSGwBpAlJWUYn6zMyPNS7gRcAPoiAfUXBw24rJiRgB&cbvp=2&vis=1 HTTP 302
  • https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%228194861747882031559%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22687492117%22],%224%22:[%2208-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2215115089796095446033%22}&andc=true
Request Chain 195
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 196
  • https://googleads.g.doubleclick.net/pagead/adview?ai=CSiJgBNTsZP_WO8_1twfLspWYA_nGxZ1xvbHJ6akRv-EeEAEg-833lQFglYKAgKwHoAGVmOnHAsgBAqgDAcgDyQSqBL4CT9C48vMjU0o1pOi821oKBEcggrflbKE5slCh4935G4royHaBxRtiVnpw_kdY50ROUC3gz_FpCUs2kglhvv8ESlNBadVpis-2vb3hFyye-152f6rGoWnioOd9rvmnnUBsIa-3ALr9PuYnd0qsfu4DfoRARWPkevML93hTiZsqv2UNrrnKUeCDJnV7blCKl1Vb4WhsKSJIJrLaPhs5AQrPl7nAiVAXRiRohCxO8btVWi3DJqKOoSrkXEwS7dnfwTlA3dCccH9yG0l77GV1R0lGc3_eoNqIwvqLJyfD8mw88HSJlLOahAZJZKs2j66o0L0mcOYORsykRmZHi6oAwUtOCdoUJaEdH3ublOXzVT19Y1QiqJOQRxuab4pTtfkI9DU3tvvH9Cn4wvvf6ahIq_bNokgjWt4SyU8q1jVJm9qFwATrwJziwwSIBdywu7RLkgUECAQYAZIFBAgFGASgBgKAB_722cYBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQuuYY0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOpoJYmh0dHBzOi8vZHJhdXNzZW5mZWV0LmRlL3Byb2R1Y3RzLzMxMzA2LWhlcnJlbi1mcnVobGluZy1zb21tZXItZ2VzY2hsb3NzZW4ta2xldHR2ZXJzY2hsdXNzLXNhbmRhbGVugAoByAsB2BMM0BUBgBcBshccChoIABIUcHViLTg4OTgwNzY0MjM2MDAzNTIYAA&sigh=_WlR8f5OPOI&uach_m=[UACH]&ase=2&cid=CAQSSwBpAlJWpLONrGlyz30VrjtAaOvv6L8MheOmtwqnRS8BL6UX2uq3Ir9zkN73UaqNwnwWpd8LAO9rStzcdSLlC_e_La94O1hq5DHbORgB&cbvp=2&vis=1 HTTP 302
  • https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%22237003494481396863%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22687492117%22],%224%22:[%2208-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%229628732740585557025%22}&andc=true
Request Chain 226
  • https://www9.smartadserver.com/ac?siteid=215340&pgid=1352541&fmtid=63953&ab=1&tgt=&oc=1&out=vast4&ps=1&pb=0&visit=S&vcn=s&tmstp=1693242376593&pgdomain=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&vph=438&vpw=780&gdpr_consent=&us_privacy=&schain=1.0%2C1!playbuzz.com%2C0010J00002G2BxCQAV%2C1%2C%2C%2Cfreedomheadlines.com&gdpr=1 HTTP 302
  • https://www9.smartadserver.com/ac?siteid=215340&pgid=1352541&fmtid=63953&ab=1&tgt=&oc=1&out=vast4&ps=1&pb=0&visit=S&vcn=s&tmstp=1693242376593&pgdomain=https%3a%2f%2ffreedomheadlines.com%2ffreedom-wire%2fformer-mar-a-lago-employee-flips-on-trump%2f&vph=438&vpw=780&gdpr_consent=&us_privacy=&schain=1.0%2c1!playbuzz.com%2c0010J00002G2BxCQAV%2c1%2c%2c%2cfreedomheadlines.com&gdpr=1&cklb=1

247 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/
Redirect Chain
  • https://mailz.leafybranch.com/index.php/campaigns/ot6051vydsfcc/track-url/me966hgmsl0dd/591036cca653f1101c966076bd84d8a57005ff39
  • https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
54 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7fabbc3f5264e158a35ffb9da2a25feeb2afa430edd64e1842cb32d3c35edfb1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7fde24b89eec3a60-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Mon, 28 Aug 2023 17:06:12 GMT
fastcgi-cache
BYPASS
link
<https://freedomheadlines.com/wp-json/>; rel="https://api.w.org/" <https://freedomheadlines.com/wp-json/wp/v2/posts/28071>; rel="alternate"; type="application/json" <https://freedomheadlines.com/?p=28071>; rel=shortlink
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IG%2FfuRK%2BmyFcOWVTpbqJvaL%2Fn47wZ%2FfPGPKZ%2B8r%2B1QDkMPCmQusXX%2F%2BfyG96VUrlvBN80OdFxbuLBTU1utlqDqSNbtomqopyeofYsom50TaBzqfxew5IBaPDasBCnHea6lg%2Bz%2F7i2Jvc%2BaImFSP%2BZdeW9w%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate post-check=0, pre-check=0
Connection
Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Mon, 28 Aug 2023 17:06:11 GMT
Expires
Mon, 26 Jul 1997 05:00:00 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Mon, 28 Aug 2023 17:06:11 GMT
Location
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Pragma
no-cache
Referrer-Policy
no-referrer
Server
Apache/2.4.56 (Debian)
X-Content-Type-Options
nosniff
X-Frame-Options
deny
X-Robots-Tag
noindex
X-XSS-Protection
1; mode=block
style.min.css
freedomheadlines.com/wp-includes/css/dist/block-library/ 		81 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/wp-includes/css/dist/block-library/style.min.css?ver=5.9.7
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4156105
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 21 Oct 2022 02:17:02 GMT
server
cloudflare
etag
W/"6352011e-145db"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ybpwCqgrtohK4YdZqCJOOcpI%2Bm%2FWrDk4id2hq9r3gmgyoe%2FfJBxcbzLgpW7m0lxAgwrNaiDHKywnCRQu8gVfkcNMwfb4r4aP6JaUuhMrs%2Brjv7sHm4ugWc0Ce%2FZYL9DWQ8LbgDrdiq5DQoYkyi1WKjqDWA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31536000
cf-ray
7fde24ba192c3a60-FRA
expires
Sun, 19 May 2024 07:01:06 GMT
mediaelementplayer-legacy.min.css
freedomheadlines.com/wp-includes/js/mediaelement/ 		11 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.16
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1632237
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 21 Oct 2022 02:17:01 GMT
server
cloudflare
etag
W/"6352011d-2bf8"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7D6STLMxvgT6qO3liSu63hRLjRrsiijtgGh2hJzZ2OjCajkk%2Fg7haZHZtez8%2F0I7qDbGB1bUFaCRqbqdkeCEaVZSlwb5w%2BvveRRfjnyxdMsHuEupjHo4PjxmpyzK2HlC%2Fng0UuxrXO9k1X8atWFfj4i6xQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31536000
cf-ray
7fde24ba192e3a60-FRA
expires
Fri, 17 May 2024 21:48:44 GMT
wp-mediaelement.min.css
freedomheadlines.com/wp-includes/js/mediaelement/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=5.9.7
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
8662470
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 21 Oct 2022 02:17:02 GMT
server
cloudflare
etag
W/"6352011e-105a"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=694tfrWcxElkNRkS%2BA4DJpgrwKFwCLO7KKscX9u1CsgGV5RHgSiohhpbBTT84NhK%2BlswaPe88FCM9h9REXr2KG5o7VgBvp%2Bk944x%2FYkdM8b3eivzj4k5k%2BNDkTww1vBiNL%2BKbnVU7LwSUExOsannHRNhqA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31536000
cf-ray
7fde24ba19303a60-FRA
expires
Sun, 19 May 2024 07:01:06 GMT
components.css
freedomheadlines.com/wp-content/themes/breena/inc/assets/css/ 		52 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/wp-content/themes/breena/inc/assets/css/components.css?ver=5.9.7
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
76bbe117102ce802cd20b57f9722133d7924bb3395bfe201f8f0b515a81c46dc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
8662470
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 21 Oct 2022 02:17:19 GMT
server
cloudflare
etag
W/"6352012f-cf80"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iZeosMer43ukkfq1wuW%2BEvSRNpzjHffcT%2F%2FcjQW0NbPYcQ2vfhrl%2Bgor9lN%2BDIxeGDj%2F2QwXdG%2FWovAHzXq%2FN6ogS7%2FG4njAZ0wZiTi%2BoiKo1RMRIL%2FFIznr42BVwK8%2B02B710gXXvAcfQCwIlL9edCs7g%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31536000
cf-ray
7fde24ba19313a60-FRA
expires
Sun, 19 May 2024 07:01:27 GMT
style.css
freedomheadlines.com/wp-content/themes/breena/ 		106 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/wp-content/themes/breena/style.css?ver=5.9.7
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f673a8adc98789a6eca1dd65c67fb782787f2571ba2730bb8c5f69bea7b5bc0f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1632237
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 21 Oct 2022 01:58:37 GMT
server
cloudflare
etag
W/"6351fccd-1a9ae"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DAvYI%2BOv22TRvjMn94HoTiWgoECkcEFh4nt%2FJLrvZR3D8M37tv0vi0bl%2Fz7O%2FwUmUc2MqtTYItoLqnM63sNGLtyxvPCDud%2B9C%2FHS6ny0CLnqM8MQ9JS%2FdBAksRW6l7BVsvbjwaELlR9J8YBxxD5bWb3%2FfA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31536000
cf-ray
7fde24ba19323a60-FRA
expires
Sun, 19 May 2024 07:01:06 GMT
responsive.css
freedomheadlines.com/wp-content/themes/breena/inc/assets/css/ 		15 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/wp-content/themes/breena/inc/assets/css/responsive.css?ver=5.9.7
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2e99d9f642cf26e56bad3ff3705fd8ab8ea028ffa302405d1642bb7456d796a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
8662470
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 21 Oct 2022 02:17:19 GMT
server
cloudflare
etag
W/"6352012f-3c33"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U0sOowlv2QDfZ2OmnT2VrmZfdjsk7qtUnH%2F6pCcYuPoCgVd1tfgDib%2FLAQ7oMl3QhjNJ7m1m%2F5l60YIBt6cU01HXLn%2FCxCt72mo%2FAx9Clm9hYf%2FWYedue2U%2ByZ%2B6cPUh0edwsg0y0iscZNYBFrraCUW%2FKA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31536000
cf-ray
7fde24ba19333a60-FRA
expires
Sun, 19 May 2024 07:01:27 GMT
font-awesome.min.css
freedomheadlines.com/wp-content/themes/breena/inc/assets/css/font-awesome/css/ 		30 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/wp-content/themes/breena/inc/assets/css/font-awesome/css/font-awesome.min.css?ver=5.9.7
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
8662470
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 21 Oct 2022 02:17:20 GMT
server
cloudflare
etag
W/"63520130-7918"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ke9TbUBDINvKFTMkQo5FTnOswDjFnaV7ZdbYfG0cUXdcc9%2Fi4nhhZ3NBrb8LbwgkRx8sebmdlhJIEpyB4U%2B8lkkAS0z9MQzmeWljfqRraTBEoHflSeOPWvZjAxrCA6EIguN9ToGVi11YZi0jOdWhikepZw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31536000
cf-ray
7fde24ba19343a60-FRA
expires
Sun, 19 May 2024 07:01:10 GMT
css
fonts.googleapis.com/ 		30 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C300%2C300italic%2C400italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%7CLato%3A300%2C300i%2C400%2C700&subset=latin%2Clatin-ext
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
3d2540ed92f01b9f61c6a2c43f15284a9f9f3aff2decbee06ba69a4d4208d935
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 28 Aug 2023 17:06:12 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 28 Aug 2023 17:06:12 GMT
jquery.min.js
freedomheadlines.com/wp-includes/js/jquery/ 		87 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1795711
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 21 Oct 2022 02:17:02 GMT
server
cloudflare
etag
W/"6352011e-15db1"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nM5FGpBsnxSY2wVmf4I2qSX%2F5LS68C30qi%2BK2Ojxg34IlOYTGXSxQsv7%2B09JBN2dFNnvKRnM4zNwcOr3cBd3MwG7fp%2B6TD6lO6WKlUKSUG5GzvQvF7M6DOi3qiO1H4YWWfojiuTjPj80ULSNtjwH9qTDVA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31536000
cf-ray
7fde24ba19353a60-FRA
expires
Fri, 17 May 2024 21:49:14 GMT
jquery-migrate.min.js
freedomheadlines.com/wp-includes/js/jquery/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
8794873
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 21 Oct 2022 02:17:04 GMT
server
cloudflare
etag
W/"63520120-2bd8"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bDGfKJC5YWgleyZFrKxXN1fzP9MB6ztcGsqWpjNQ4mYyQ6r5h86bBAEUQGBLFna%2FlBz5zoaXsECHd4%2BJZ9kTDdoMli31g4o0FQgkGcJS6kmryJ8S%2BCjoQcrD2yCnmoYRCbZ84C2twdcuniD%2BW8sPzeDPhQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31536000
cf-ray
7fde24ba19383a60-FRA
expires
Fri, 17 May 2024 21:49:14 GMT
js
www.googletagmanager.com/gtag/ 		179 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-32644619-11
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
7415bd123062cb453f55c7a40f933f45e9392008038e167b5526cf816db961dd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
66643
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 28 Aug 2023 17:06:12 GMT
/
users.api.jeeng.com/users/domains/mO6DXK83XA/sdk/ 		539 KB
158 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://users.api.jeeng.com/users/domains/mO6DXK83XA/sdk/
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:264e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
cb90795dbe3c8c356226de6cde47f6715914c2b4e098c634a5348ab0086b885c
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
cf-cache-status
EXPIRED
server
cloudflare
x-powered-by
Express
etag
W/"86b45-bWcd5YxQH96SoD9tzsoCosRvQac"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
7fde24baccc337d4-FRA
FH-2021-sized-1.jpg
freedomheadlines.com/wp-content/uploads/2021/01/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://freedomheadlines.com/wp-content/uploads/2021/01/FH-2021-sized-1.jpg
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e5f4f96e32a749a3c07b566aceb9b84a8445c71ca9713a4bfce9b7d28731fc33
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
14503312
alt-svc
h3=":443"; ma=86400
content-length
28587
x-xss-protection
1; mode=block
last-modified
Fri, 08 Jan 2021 19:00:26 GMT
server
cloudflare
etag
"5ff8abca-6fab"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DLye0ilJXLoNLUp5yLDl%2FOXmU05HrCh1Ly%2B59ZGx01PBUk5tY1h%2FZ%2BbxI2Qo4y%2F0Q68W%2BkoN78NUPAJMMmceVNiXVZ7RyJ%2BGc9PwNY9ls3rZ7Ll6UxqASOcrTr%2B0dVUyMnpUcFuIWnQu%2FNiU1MPcQYa1Aw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
vary
Accept-Encoding
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
7fde24ba8a5718cd-FRA
expires
Tue, 08 Aug 2023 15:15:38 GMT
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		151 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-8898076423600352
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8829d6c0a640ecd61f313eb34c3f4a6b4f273f4c9511d6a7c17e9408286d21eb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://freedomheadlines.com/
Origin
https://freedomheadlines.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
51250
x-xss-protection
0
server
cafe
etag
16237174311231788304
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 28 Aug 2023 17:06:12 GMT
trump-sitting-800x450.jpg
freedomheadlines.com/wp-content/uploads/2022/11/ 		32 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://freedomheadlines.com/wp-content/uploads/2022/11/trump-sitting-800x450.jpg
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
593153dbbbef6388337f89d44620bd526272d6fe1f63ec1176f8eee8bd04386d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
315850
alt-svc
h3=":443"; ma=86400
content-length
32606
x-xss-protection
1; mode=block
last-modified
Wed, 30 Nov 2022 19:35:16 GMT
server
cloudflare
etag
"6387b074-7f5e"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f2AUO%2BoA2eXKgdYcNEUa4j39c6nhJbZVPBDo3GGc4dJJtVwL7eOT458mjfRWLhCskubs0XQZL7fLQm1BmziQoam6f7bxyXZF7c%2B5n73JIuoOrZ0JRWW445siP0nw26LO9v%2BM2n0HFqGqPTREp%2BwCejr5UA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
vary
Accept-Encoding
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
7fde24ba8a5818cd-FRA
expires
Fri, 23 Aug 2024 05:32:24 GMT
trump-sitting-650x366.jpg
freedomheadlines.com/wp-content/uploads/2022/11/ 		23 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://freedomheadlines.com/wp-content/uploads/2022/11/trump-sitting-650x366.jpg
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f64677954eef2eeffed47aabe1fa8b3ba4221dab739945ce652d74b249720a00
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
328713
alt-svc
h3=":443"; ma=86400
content-length
23694
x-xss-protection
1; mode=block
last-modified
Wed, 30 Nov 2022 19:35:18 GMT
server
cloudflare
etag
"6387b076-5c8e"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J96jMUNkXsMqWx6kePfhD%2F5Wb%2FEpgvNpLr3JiJKBGE8GHfOdKvK%2Bzov8AblfmAXGY8g2AnVLD%2FgGGfiPm9NCu9ogJJVFTWWOFq3h%2FgUa5O06g0xLDaGMssTysI6SnlFBqCz%2Bd3B3qXvg%2F5itt%2B9twKWACw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
vary
Accept-Encoding
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
7fde24ba8a5b18cd-FRA
expires
Fri, 23 Aug 2024 06:14:15 GMT
widgets.js
platform.twitter.com/ 		91 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67D3) /
Resource Hash
392c9fa9cd1273a2a89d1a83a69cd1f63f21d1d55e7be21e1d8f51f25145668b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Mon, 28 Aug 2023 17:06:12 GMT
Content-Encoding
gzip
Age
1281
x-amz-server-side-encryption
AES256
X-Cache
HIT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length
27630
Last-Modified
Tue, 24 Jan 2023 21:41:51 GMT
Server
ECS (frb/67D3)
Etag
"9e99725b7a4cd730a934afba2a438bb5+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
x-tw-cdn
VZ
Cache-Control
public, max-age=1800
widget_v3.js
cdn.whizzco.com/scripts/widget/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.whizzco.com/scripts/widget/widget_v3.js
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e4::ac40:a50b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4d8562efd8364015edd8080e72d8bd98f0a92019058f15df14e03f9951e01876

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
via
1.1 52804153974851170879aec22b7dcd28.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
CDG52-P4
age
3415
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Sun, 05 Mar 2023 13:26:38 GMT
server
cloudflare
etag
W/"af75195749ffac29c536aae88fdbda39"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L%2Bejzpl7JGbOJZQpdrGDbhe26Ce%2FjWTrjEbra7R4OqSu6Y6191oT%2B0XAxZIuGbOrA%2BE85shr2hl1rYXGX6H68Re9vlWLCZiARz2LYiyxBRnm%2BVNWLsiJ5OfnGDni8qlAlnDWY4wrxxj1jdEsOfo%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7fde24badbef91d5-FRA
x-amz-cf-id
aeV-lmHVTTmPQygKAobvbCYVDkUmXrSOhEuS1j5ye82fNJYmj2xEEg==
email-decode.min.js
freedomheadlines.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 23 Aug 2023 13:09:20 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"64e60500-4d7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VHjoI9GRMUOa%2BFmWxuayZyvuEAj97LmSL65DvZff5dM0CtgxbSEuuvXT2KX55Waxj29FWGJcXGwDQFQ9T4LCiRSDGRfkXfEKW6GqfVEu4syM8T5xh%2FtpYnXrd28ejjGpgk5YEkTZNPacR8WtuaikBdaOBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-frame-options
DENY
cache-control
max-age=172800, public
cf-ray
7fde24ba59f918cd-FRA
expires
Wed, 30 Aug 2023 17:06:12 GMT
freedomheadlines_freedomheadlines_sticky.js
cdn1.lockerdomecdn.com/embeds/ 		1003 B
770 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn1.lockerdomecdn.com/embeds/freedomheadlines_freedomheadlines_sticky.js
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
AmazonS3 /
Resource Hash
2bcf7c31dad5a7352c5b9750d4e991939473441aef5d9ea22c036a47df0e1dca

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
gzip
x-amz-version-id
2FslkIyxepjVYcj6UqIyjxnPoJ3KBM3m
last-modified
Thu, 05 Jan 2023 17:31:35 GMT
server
AmazonS3
x-amz-request-id
56WE7SBW38K595Z5
etag
"c33cc7321d972455c359a8bc75ba8455"
x-hw
1693242372.cds342.fr8.hn,1693242372.cds205.fr8.sc,1693242372.cds205.fr8.pr
content-type
application/javascript
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
https://lockerdome.com
content-length
380
x-amz-id-2
LHUfhSOzvRYTZ55kR1gjb4lCSiVOgdTz3uJYZvHk3oe+bnyHYtso9oF1bdFQIyVhRidI+FTT0vA=
components.js
freedomheadlines.com/wp-content/themes/breena/inc/assets/js/ 		241 KB
67 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/wp-content/themes/breena/inc/assets/js/components.js?ver=5.9.7
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1bcf2aae786aa72292ec28f330390b1e324f4c273f9ca993150b5163620d862
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
8661111
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 21 Oct 2022 02:17:20 GMT
server
cloudflare
etag
W/"63520130-3c5ec"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UkQxPpqSLF1bRdUAa1A7xwmLQkTAWyrWKuA3j1qL5wwCPzJpvdzPzJwwzeG0vdmSMQgCdnvZT1sQz%2Fm%2BNvHZCDldm1GH54zHHnQdlykiGZXVGXxwZIwS8aXS%2FOq1c28NgujnbgzwJ4e6EsApJ7cN%2BTxcsw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31536000
cf-ray
7fde24ba6a1618cd-FRA
expires
Sun, 19 May 2024 07:01:27 GMT
breena.js
freedomheadlines.com/wp-content/themes/breena/inc/assets/js/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/wp-content/themes/breena/inc/assets/js/breena.js?ver=5.9.7
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f6f14681142e16db6027f013840dc46f68cce2f3c5ccf8814d2361d06b5127d8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
8661110
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 21 Oct 2022 02:17:18 GMT
server
cloudflare
etag
W/"6352012e-356e"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fru4hRbssmTDEAurveAWgol4N9YePCxH88TBRoD44lg8BmjbOoP4F7lR3FWPzqBeT14shkHUHJQK8lyCFMWS04WZ1cUvAbyyGWCh2202Ot1sbQJEifiBo9fblShlzv4D5TWzpWYsw3vHm5VYszToy3H4%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31536000
cf-ray
7fde24ba7a2b18cd-FRA
expires
Sun, 19 May 2024 07:01:10 GMT
mediaelement-and-player.min.js
freedomheadlines.com/wp-includes/js/mediaelement/ 		154 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/wp-includes/js/mediaelement/mediaelement-and-player.min.js?ver=4.2.16
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
443ba0af7a7ed827223c7fb3c008c02b9ff1d651b6492e9c270378b07d9f6008
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
8794908
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 21 Oct 2022 02:17:04 GMT
server
cloudflare
etag
W/"63520120-267aa"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Dhn0FHW7AFwfEzlnq%2BZaFlAJ%2Fw1wn6yCVAK6xKhosg5XITlhhTYzIX2sG6bSI2LVY%2Bh3AIA1ly1fAic4wmmG%2FZE2EtMzkSehSv5x7Aq979dfuVnYI%2BSeZkvgOu%2BqYFGa3e7%2BJpMtyfHdZxBEe0sMMfYK5w%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31536000
cf-ray
7fde24ba8a4e18cd-FRA
expires
Fri, 17 May 2024 21:48:44 GMT
mediaelement-migrate.min.js
freedomheadlines.com/wp-includes/js/mediaelement/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/wp-includes/js/mediaelement/mediaelement-migrate.min.js?ver=5.9.7
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f34b768792b90cf0b04fced2470e43d8fab7644f6565d5178fbfb49c4859cee
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
8661110
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 21 Oct 2022 02:17:04 GMT
server
cloudflare
etag
W/"63520120-4a9"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vlTGnh6GXL5nInaJcP2DNJb4SG9E5mMCtUCmzNK52BndMomYgCWMxynuMvFHcvfTwaA1QPutnh438%2F14p9h%2BiZyMNkZBSiHIvi557Oblw1Jqh5t4t5Ma%2FB6No%2BUTS%2BKP7o%2Br5i3AkyOy8Wygely6afC8Ag%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31536000
cf-ray
7fde24ba8a5018cd-FRA
expires
Sun, 19 May 2024 07:01:27 GMT
wp-mediaelement.min.js
freedomheadlines.com/wp-includes/js/mediaelement/ 		906 B
988 B 		Script
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/wp-includes/js/mediaelement/wp-mediaelement.min.js?ver=5.9.7
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3e6131330963c472b950b8aaf544ba3829735b8ccb103d614ba7793e3a786550
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
8661110
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 21 Oct 2022 02:17:04 GMT
server
cloudflare
etag
W/"63520120-38a"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qZviOE0Gpe5tiUYUssIFq07Or3ZjbfqOxY2XSNRJYpVJ73zGD6p9LJDiJvenevCOqfFmg24IEfmDMBE7hKUKjR4fKcAVr2aD8YnXeuL9NBiGylQ%2Bu0VEPdjktgDguZ6S8Nz8AMdmFPpKj90H4kr5GVlFNg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31536000
cf-ray
7fde24ba8a5218cd-FRA
expires
Sun, 19 May 2024 07:01:06 GMT
comment-reply.min.js
freedomheadlines.com/wp-includes/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/wp-includes/js/comment-reply.min.js?ver=5.9.7
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a10b9570a1c7858442b42f1cd48b69a191638269f37e4046607bf5fe188e38bf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
8664716
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 21 Oct 2022 02:17:03 GMT
server
cloudflare
etag
W/"6352011f-ba3"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JGFEbj4AFQ%2Bq9D6CdOEPG2Z905d3AHI6nENl9vQe8KWPe8PzaWomL2mTHWKWZ4ZNmTBFE3lmg7ad2zZwwn7BpC4G0638B0%2BBSqAMfgtDsH12JPwd%2BRDRdBHMWFky8FKsHPBsoVvcwfYjE9C1R5QYS9lbiA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31536000
cf-ray
7fde24ba8a5518cd-FRA
expires
Sun, 19 May 2024 07:01:10 GMT
wp-emoji-release.min.js
freedomheadlines.com/wp-includes/js/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/wp-includes/js/wp-emoji-release.min.js?ver=5.9.7
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
8661110
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 21 Oct 2022 02:17:04 GMT
server
cloudflare
etag
W/"63520120-4705"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tNF38EiyhkvOMAegZzZ9%2BVNq8Gw%2FzAq5z%2Fzfd8X1pZFQ5jhtNi14ZA%2FKtU54zqyAKeTgJFm0T2RHmiIKvkzHMBRcc4FFUEN04ClYs4ox3YDFAcSQzufj0xuIInK48QADCVyvLgK0tcVm3fTXVEHRoFUDfA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31536000
cf-ray
7fde24ba8a5c18cd-FRA
expires
Sun, 19 May 2024 07:01:06 GMT
ajs.js
cdn2.decide.dev/_js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn2.decide.dev/_js/ajs.js
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
/
Resource Hash
3dffa84e13fbc367c907ff31e293923484de18c4c06cac97109e4b9a1b19752c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
gzip
via
1.1 google
last-modified
Sun, 27 Aug 2023 18:30:33 GMT
etag
W/"1a71-18a3843105d"
x-hw
1693242372.cds291.fr8.hn,1693242372.cds167.fr8.c
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=86400
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2973
platform.js
cdn.vuukle.com/ 		230 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.vuukle.com/platform.js
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0feb4c88f50e33d36eca5a644f9e33d80b55e5ef08a8c5c553e68c946bd4ff70

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
br
cf-cache-status
HIT
age
22075
cf-polished
origSize=235593
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Mon, 28 Aug 2023 10:55:38 GMT
server
cloudflare
etag
W/"64ec7d2a-39849"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Range
cache-control
max-age=1800
cf-ray
7fde24bae8d490d7-FRA
access-control-allow-headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C300%2C300italic%2C400italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%7CLato%3A300%2C300i%2C400%2C700&subset=latin%2Clatin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://freedomheadlines.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 21:18:33 GMT
x-content-type-options
nosniff
age
157659
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23040
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:07:25 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 25 Aug 2024 21:18:33 GMT
fontawesome-webfont.woff2
freedomheadlines.com/wp-content/themes/breena/inc/assets/css/font-awesome/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://freedomheadlines.com/wp-content/themes/breena/inc/assets/css/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/wp-content/themes/breena/inc/assets/css/font-awesome/css/font-awesome.min.css?ver=5.9.7
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer
https://freedomheadlines.com/wp-content/themes/breena/inc/assets/css/font-awesome/css/font-awesome.min.css?ver=5.9.7
Origin
https://freedomheadlines.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
8802678
alt-svc
h3=":443"; ma=86400
content-length
77160
last-modified
Fri, 21 Oct 2022 02:17:20 GMT
server
cloudflare
etag
"63520130-12d68"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=634pKnMalFPUsNtz6joCDlVHKwNzzFdsq4s20frO3DKfNh2z8zQBlTBuzs8%2FmRV7mC5uZJObGLQg2DC7gMR9fifvg07i3l%2F%2BqHWu%2BQaeABZQkaFrMKMM7DTOtKK6sWVAU4GSQFySCttAmc2Y52kRoMS6pA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
7fde24baaa7318cd-FRA
expires
Fri, 17 May 2024 18:54:55 GMT
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ 		47 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C300%2C300italic%2C400italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%7CLato%3A300%2C300i%2C400%2C700&subset=latin%2Clatin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://freedomheadlines.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 00:05:03 GMT
x-content-type-options
nosniff
age
234069
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48412
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:08:53 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 25 Aug 2024 00:05:03 GMT
S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C300%2C300italic%2C400italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%7CLato%3A300%2C300i%2C400%2C700&subset=latin%2Clatin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://freedomheadlines.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 21:23:50 GMT
x-content-type-options
nosniff
age
157342
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23580
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:17:22 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 25 Aug 2024 21:23:50 GMT
josh-olalde-Ygu9Qx309s-unsplash-150x150.jpg
freedomheadlines.com/wp-content/uploads/2023/08/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://freedomheadlines.com/wp-content/uploads/2023/08/josh-olalde-Ygu9Qx309s-unsplash-150x150.jpg
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e5d56fe59d66dbc305c2cf34cbdc44d372993747d08689f3f5d618d6d0fede13
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
8209
alt-svc
h3=":443"; ma=86400
content-length
9434
x-xss-protection
1; mode=block
last-modified
Fri, 25 Aug 2023 16:40:51 GMT
server
cloudflare
etag
"64e8d993-24da"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fOdleQTWWsJILL%2BHnnFL1dHuIwfnCI5rlIFysY12KaLo%2Bb9d59R22w0YNwud1sJbn7kTVTemUD5s6kQjoUIZQuiAiSe5uxnVck%2FWNLjPh011RTZdj4M9BmKFzGI4JLlmn99Iu7RQ%2Fr28t4SsD1VLPJ26SA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
vary
Accept-Encoding
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
7fde24baba9d18cd-FRA
expires
Tue, 27 Aug 2024 04:14:18 GMT
truck-flags-150x150.jpg
freedomheadlines.com/wp-content/uploads/2023/08/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://freedomheadlines.com/wp-content/uploads/2023/08/truck-flags-150x150.jpg
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e06bff99505017fa9b63d5a432f579a856661ce141325b33e78770dff671877e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
5248
x-xss-protection
1; mode=block
last-modified
Fri, 25 Aug 2023 19:58:32 GMT
server
cloudflare
etag
"64e907e8-1480"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=timpXP8mMdtkgaA6PTDwga4yXkw3sGjAmmN9QL52skXhvNcpdjJOfBeFc2a02NySmrtLThBnOw4GfAmG0Us6bQoxshePQT5OGYePMRqDtFUGKBbpMwba7DCdmHunGz198OUFcSbauRHhls%2BSwDhurwVc7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
vary
Accept-Encoding
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
7fde24babaa018cd-FRA
expires
Tue, 27 Aug 2024 04:09:15 GMT
trump-14th-150x150.jpg
freedomheadlines.com/wp-content/uploads/2023/08/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://freedomheadlines.com/wp-content/uploads/2023/08/trump-14th-150x150.jpg
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
74a9ed0d0eeb65ed7f945bbbe969f49dbbb73adad845e50bed4e8e92bac7bdc2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
7739
x-xss-protection
1; mode=block
last-modified
Mon, 28 Aug 2023 03:39:11 GMT
server
cloudflare
etag
"64ec16df-1e3b"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SQsHyTwfBIbIFQ9ZF%2FIFbiJqZIuWLlpush1gLdlEA2glSMM8exp5AhnsQnHdoYwxTesPIYAEWGDButkcV481J7ToJ7OqW367hc7OWoMFmIfUimt90E2Mwd1xcH0nUeqFyiQS9ebPWgwjoNk%2Bo3CGJQxKzw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
vary
Accept-Encoding
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
7fde24babaa218cd-FRA
expires
Tue, 27 Aug 2024 04:09:15 GMT
rtads
api.whizzco.com/demand/v1/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.whizzco.com/demand/v1/rtads
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e4::ac40:a50b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://freedomheadlines.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET, POST, HEAD, OPTIONS
access-control-allow-origin
https://freedomheadlines.com
access-control-max-age
1800
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7fde24bb4d46bbc2-FRA
content-length
0
date
Mon, 28 Aug 2023 17:06:12 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e6Dz77DkPyxUWdgGn2bRzhqXkpZVrhjv0qtWNzz0IsqenB07Add7gqZNeBYCL%2B5Ir3NrSuCQbNiwV4CJejfTd5yUhrYfe%2FsqsqDuQq6FSN8rIOsyWk%2BPgzq3ZD2nMRNbRcVzJ2DXJ27o77EGJGE%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
rtads
api.whizzco.com/demand/v1/ 		597 B
819 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.whizzco.com/demand/v1/rtads
Requested by
Host: cdn.whizzco.com
URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:e4::ac40:a50b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a510f33342f4f7df0d7e1baa52a55fe5496103e25b8eb894513ebc632a209f24

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-type
application/json; charset=UTF-8

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RLNKM%2FH9PtKGD57aBtVadE%2BKoQ6G67ril%2F8fSpMhxNDVwLydk0R5OrsbvxlViZQVemnYLJEDyW%2FlqBLcfygUmwChR65soachgHs9aiQJR8yUvtZ74X52ow24y2vUk3r%2BNevpvE3%2FHGMj%2Bzb7dk0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
https://freedomheadlines.com
access-control-allow-credentials
true
cf-ray
7fde24bd9fcc92b4-FRA
alt-svc
h3=":443"; ma=86400
priority
u=1,i
widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html
platform.twitter.com/widgets/ Frame B438 		320 KB
104 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Ffreedomheadlines.com
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/675D) /
Resource Hash
4002d65e95f94dc87ae8ad170eb8dbc3644921032ac76dcb376537d9304a6fbf

Request headers

Referer
https://freedomheadlines.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
994310
Cache-Control
public, max-age=315360000
Content-Encoding
gzip
Content-Length
105435
Content-Type
text/html; charset=utf-8
Date
Mon, 28 Aug 2023 17:06:12 GMT
Etag
"95e1b50b0c179aefb47b5b211bb347b5+gzip"
Last-Modified
Tue, 24 Jan 2023 21:41:13 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (frb/675D)
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary
Accept-Encoding
X-Cache
HIT
x-amz-server-side-encryption
AES256
x-tw-cdn
VZ
getGeo
vuukle.com/ 		90 B
361 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vuukle.com/getGeo
Requested by
Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
53f98bb0b288d162a288ce2caf8406c00c1fd474f0c73a58b5893098271621a9

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
br
accept-ch
sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-viewport-width
server
cloudflare
vary
Accept-Encoding
access-control-max-age
86400
access-control-allow-methods
GET,HEAD,POST,OPTIONS
access-control-allow-origin
*
content-type
application/json;charset=UTF-8
cf-ray
7fde24bbcd0e9268-FRA
alt-svc
h3=":443"; ma=86400
loadVuukle
api.vuukle.com/api/v1/Comments/ 		12 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.vuukle.com/api/v1/Comments/loadVuukle?apiKey=92fd8992-dbb2-4d42-9cc3-1b8101c44b9b&articleId=28071&globalRecommendation=false&host=freedomheadlines.com&start=0&uri=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&quizEnabled=false
Requested by
Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca64614f2f9ffdf928c305e883f9db5af2fa43980050b9e784d60879470d5c51
Security Headers
Name Value
X-Xss-Protection 1

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
via
1.1 varnish (Varnish/6.2)
content-encoding
br
cf-cache-status
DYNAMIC
age
0
alt-svc
h3=":443"; ma=86400
x-xss-protection
1
pragma
no-cache
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, PATCH, OPTIONS
x-varnish
255314108
content-type
application/json; charset=utf-8
access-control-allow-origin
https://freedomheadlines.com
cache-control
no-store,no-cache
access-control-allow-credentials
true
access-control-allow-credentiails
true
cf-ray
7fde24bbeaac4dcd-FRA
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		0
29 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29220
x-xss-protection
0
server
cafe
etag
720 / 19597 / m202308220101 / config-hash: 8635181794651748832
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Mon, 28 Aug 2023 17:06:12 GMT
freedomheadlines.com.js
cdn.vuukle.com/domain-configs/ 		139 B
199 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.vuukle.com/domain-configs/freedomheadlines.com.js
Requested by
Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bdf47e9be1ad651fcad55288d534fbeeba846ce487322a2b8f1f7e0f6dfaab12

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
br
cf-cache-status
HIT
age
8209
cf-polished
origSize=186
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Sat, 26 Aug 2023 10:40:40 GMT
server
cloudflare
etag
W/"64e9d6a8-ba"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Range
cache-control
max-age=1800
cf-ray
7fde24bba9ed90d7-FRA
access-control-allow-headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
settings
syndication.twitter.com/ Frame B438 		869 B
658 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://syndication.twitter.com/settings?session_id=085754ac85675148371d156177accaf7951a9cf7
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Ffreedomheadlines.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.200 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
302da628a6afc3e93f1b86bf7c65e4d6536d8283d78266964822a76d1c645aa4
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

x-response-time
118
date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
gzip
strict-transport-security
max-age=631138519
last-modified
Mon, 28 Aug 2023 17:06:12 GMT
server
tsa_o
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
x-transaction-id
10a7c36b4738d385
cache-control
must-revalidate, max-age=600
access-control-allow-credentials
true
perf
7626143928
x-connection-hash
0448e32ac9dbd7e546aceb779f4f3280ec04ea6b1b595c36aaf4caa0eee3d7a6
content-length
337
js
www.googletagmanager.com/gtag/ 		209 KB
75 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-CP4TF595X7&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-32644619-11
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a229ca014188cf0336665b7bbab5e49da5aede93e748fefd0ad5fd66e53cd57c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
76725
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 28 Aug 2023 17:06:12 GMT
analytics.js
www.google-analytics.com/ 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-32644619-11
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 28 Aug 2023 15:49:43 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
4589
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Mon, 28 Aug 2023 17:49:43 GMT
show_ads_impl_with_ama_fy2021.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308240101/ 		387 KB
131 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308240101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-8898076423600352&plah=freedomheadlines.com&bust=31077389
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-8898076423600352
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f2675d651e6b07cb28a520c2d408e9098421238198195ffb981917eb8c5b216e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
134173
x-xss-protection
0
server
cafe
etag
16574368700382700094
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Mon, 28 Aug 2023 17:06:12 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20230823/r20190131/ Frame FB41 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20230823/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-8898076423600352
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0907e75ab7f4aa03bcbc01778262abd0671f8742abaca30e9816cc90a6b28935
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://freedomheadlines.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
39494
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=1209600
content-encoding
br
content-length
4437
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 06:07:58 GMT
etag
9878862242593084568
expires
Mon, 11 Sep 2023 06:07:58 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
cnsnt.platform.js
cdn.vuukle.com/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.vuukle.com/cnsnt.platform.js
Requested by
Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cca27de9b49927f4f88540f690be49d9700ea7d3dbc1b5200d81e440f4f5c000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
br
cf-cache-status
HIT
age
465
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Mon, 28 Aug 2023 10:55:48 GMT
server
cloudflare
etag
W/"64ec7d34-f1d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Range
cache-control
max-age=14400
cf-ray
7fde24bc5fb59bca-FRA
access-control-allow-headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
bq-publish
publish.vuukle.com/ 		32 B
333 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://publish.vuukle.com/bq-publish?callback=&{%22action%22:%22view_page%22,%22hashed_email%22:%22$a58983-0275-400c-9374-a2f1da16074e%22,%22hostname%22:%2292fd8992-dbb2-4d42-9cc3-1b8101c44b9b%22,%22pubdomain%22:%22freedomheadlines.com%22,%22refDomain%22:%22%22,%22sessionId%22:%22ce1f3121-70e4-4a00-9bab-18bae0172018%22,%22version%22:%224.20%22,%22articleImg%22:%22%22,%22articleTitle%22:%22Former%20Mar-a-Lago%20Employee%20FLIPS%20on%20Trump%22,%22article_id%22:%2228071%22,%22hashed_article_url%22:%22freedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%22,%22referrer%22:%22daniel%22,%22tags%22:%22%22,%22browser%22:%22Chrome%22,%22device%22:%22Desktop%22,%22os%22:%22Windows%22}&_=1489139930741
Requested by
Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57107b8d37bf404c447591aa4fa88debcaa705cd9e4eeb91ffb35f4b2d9d5c5a
Security Headers
Name Value
X-Xss-Protection 1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
text/plain; charset=utf-8
access-control-allow-origin
https://freedomheadlines.com
access-control-allow-credentials
true
cf-ray
7fde24bc8dd49268-FRA
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
alt-svc
h3=":443"; ma=86400
x-xss-protection
1
14305628449616998
decide.dev/lad/ Frame 8A5E 		1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://decide.dev/lad/14305628449616998?pubid=ld-1613-6204&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=780&path=%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Requested by
Host: cdn2.decide.dev
URL: https://cdn2.decide.dev/_js/ajs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.139.129 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
129.139.149.34.bc.googleusercontent.com
Software
/
Resource Hash
ba2d293f01789ef093b5b67ca430d9d1a95a5782e7f72e9b961163f4ba56f43b

Request headers

Referer
https://freedomheadlines.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, max-age=0, must-revalidate, no-store
content-length
1376
content-type
text/html; charset=utf-8
date
Mon, 28 Aug 2023 17:06:12 GMT
via
1.1 google
14305626872558694
decide.dev/lad/ Frame BC7D 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://decide.dev/lad/14305626872558694?pubid=ld-9377-335&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=780&path=%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Requested by
Host: cdn2.decide.dev
URL: https://cdn2.decide.dev/_js/ajs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.139.129 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
129.139.149.34.bc.googleusercontent.com
Software
/
Resource Hash
ba2d293f01789ef093b5b67ca430d9d1a95a5782e7f72e9b961163f4ba56f43b

Request headers

Referer
https://freedomheadlines.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, max-age=0, must-revalidate, no-store
content-length
1376
content-type
text/html; charset=utf-8
date
Mon, 28 Aug 2023 17:06:12 GMT
via
1.1 google
prebid3.js
cdn.vuukle.com/static/ 		481 KB
145 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.vuukle.com/static/prebid3.js
Requested by
Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6a541246205ee94507bcc81cdde7e260c17532e24d9a4ca7f414f6e3c2f2a0d1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
br
cf-cache-status
HIT
age
1299894
cf-polished
origSize=641504
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Fri, 11 Aug 2023 20:56:59 GMT
server
cloudflare
etag
W/"64d6a09b-9c9e0"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Range
cache-control
max-age=7200
cf-ray
7fde24bc7fd69bca-FRA
access-control-allow-headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
freedomheadlines.com.json
cdn.vuukle.com/ads/ 		20 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.vuukle.com/ads/freedomheadlines.com.json
Requested by
Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a95e624ec4d1a9c3067a34670fa20a9e3944b0b05a0cb4200ea69cbf6c3465ab

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Mon, 28 Aug 2023 15:10:46 GMT
server
cloudflare
etag
W/"64ecb8f6-4ee7"
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Range
cf-ray
7fde24bc98574d93-FRA
access-control-allow-headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
alt-svc
h3=":443"; ma=86400
collect
region1.google-analytics.com/g/ 		0
248 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-CP4TF595X7&gtm=45je38n0&_p=297901698&cid=723900094.1693242373&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAAI&_s=1&sid=1693242372&sct=1&seg=0&dl=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&dt=Former%20Mar-a-Lago%20Employee%20FLIPS%20on%20Trump%20%E2%80%93%20Freedom%20Headlines%20%7C%20Top%20Political%20News%20USA%20%7C%20USA%20Politics&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CP4TF595X7&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Aug 2023 17:06:12 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://freedomheadlines.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/ 		2 B
210 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=297901698&t=pageview&_s=1&dl=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&ul=en-us&de=UTF-8&dt=Former%20Mar-a-Lago%20Employee%20FLIPS%20on%20Trump%20%E2%80%93%20Freedom%20Headlines%20%7C%20Top%20Political%20News%20USA%20%7C%20USA%20Politics&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=2070112494&gjid=1345090157&cid=723900094.1693242373&tid=UA-32644619-11&_gid=489032261.1693242373&_r=1&gtm=457e38n0&jsscut=1&z=1028721762
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 28 Aug 2023 17:06:12 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://freedomheadlines.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
tweet.b81b6d7af2d75db873cff6099e4f433a.js
platform.twitter.com/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/js/tweet.b81b6d7af2d75db873cff6099e4f433a.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67BE) /
Resource Hash
e3d5684523c3de8ab2ac3bca237d12e4affbb4d4b39a41109d975a489fa12427

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Mon, 28 Aug 2023 17:06:12 GMT
Content-Encoding
gzip
Age
994311
x-amz-server-side-encryption
AES256
X-Cache
HIT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length
2700
Last-Modified
Tue, 24 Jan 2023 21:41:06 GMT
Server
ECS (frb/67BE)
Etag
"09ec5707a836b9e4f4427dcddd1d0c64+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
x-tw-cdn
VZ
Cache-Control
public, max-age=315360000
Tweet.html
platform.twitter.com/embed/ Frame A9E0 		345 B
918 B 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOltdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2ZvbGxvd2VyX2NvdW50X3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9iYWNrZW5kIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19yZWZzcmNfc2Vzc2lvbiI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfZm9zbnJfc29mdF9pbnRlcnZlbnRpb25zX2VuYWJsZWQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X21peGVkX21lZGlhXzE1ODk3Ijp7ImJ1Y2tldCI6InRyZWF0bWVudCIsInZlcnNpb24iOm51bGx9LCJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3Nob3dfYmlyZHdhdGNoX3Bpdm90c19lbmFibGVkIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdXNlX3Byb2ZpbGVfaW1hZ2Vfc2hhcGVfZW5hYmxlZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfbGVnYWN5X3RpbWVsaW5lX3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1694099334516642113&lang=en&origin=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&sessionId=085754ac85675148371d156177accaf7951a9cf7&theme=light&widgetsVersion=aaf4084522e3a%3A1674595607486&width=550px
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/668C) /
Resource Hash
14060cd7611c20206e3e1b5affff0b6cfc943b97ed32a36f0d83405965ffc67b

Request headers

Referer
https://freedomheadlines.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
594
Cache-Control
public, max-age=1800
Content-Length
345
Content-Type
text/html; charset=utf-8
Date
Mon, 28 Aug 2023 17:06:12 GMT
Etag
"f65fcce59510160bf9b3d37ecb903340"
Last-Modified
Thu, 17 Aug 2023 04:43:05 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (frb/668C)
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
X-Cache
HIT
x-amz-server-side-encryption
AES256
x-tw-cdn
VZ
embed.runtime.cdfed6029cf12992305d.js
platform.twitter.com/embed/ Frame A9E0 		9 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.runtime.cdfed6029cf12992305d.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOltdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2ZvbGxvd2VyX2NvdW50X3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9iYWNrZW5kIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19yZWZzcmNfc2Vzc2lvbiI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfZm9zbnJfc29mdF9pbnRlcnZlbnRpb25zX2VuYWJsZWQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X21peGVkX21lZGlhXzE1ODk3Ijp7ImJ1Y2tldCI6InRyZWF0bWVudCIsInZlcnNpb24iOm51bGx9LCJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3Nob3dfYmlyZHdhdGNoX3Bpdm90c19lbmFibGVkIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdXNlX3Byb2ZpbGVfaW1hZ2Vfc2hhcGVfZW5hYmxlZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfbGVnYWN5X3RpbWVsaW5lX3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1694099334516642113&lang=en&origin=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&sessionId=085754ac85675148371d156177accaf7951a9cf7&theme=light&widgetsVersion=aaf4084522e3a%3A1674595607486&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67A8) /
Resource Hash
bb15c813b3fb37a3e49b5d99382a518fec61909004b84a2a667b65b578ebfe3f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOltdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2ZvbGxvd2VyX2NvdW50X3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9iYWNrZW5kIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19yZWZzcmNfc2Vzc2lvbiI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfZm9zbnJfc29mdF9pbnRlcnZlbnRpb25zX2VuYWJsZWQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X21peGVkX21lZGlhXzE1ODk3Ijp7ImJ1Y2tldCI6InRyZWF0bWVudCIsInZlcnNpb24iOm51bGx9LCJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3Nob3dfYmlyZHdhdGNoX3Bpdm90c19lbmFibGVkIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdXNlX3Byb2ZpbGVfaW1hZ2Vfc2hhcGVfZW5hYmxlZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfbGVnYWN5X3RpbWVsaW5lX3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1694099334516642113&lang=en&origin=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&sessionId=085754ac85675148371d156177accaf7951a9cf7&theme=light&widgetsVersion=aaf4084522e3a%3A1674595607486&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Mon, 28 Aug 2023 17:06:12 GMT
Content-Encoding
gzip
Age
994311
x-amz-server-side-encryption
AES256
X-Cache
HIT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length
4230
Last-Modified
Thu, 17 Aug 2023 04:43:04 GMT
Server
ECS (frb/67A8)
Etag
"7181390895a74b2085353d5162ab76de+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
x-tw-cdn
VZ
Cache-Control
public, max-age=315360000
embed.8601.9934bea25cda9d7ebe46.js
platform.twitter.com/embed/ Frame A9E0 		488 KB
160 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.8601.9934bea25cda9d7ebe46.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOltdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2ZvbGxvd2VyX2NvdW50X3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9iYWNrZW5kIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19yZWZzcmNfc2Vzc2lvbiI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfZm9zbnJfc29mdF9pbnRlcnZlbnRpb25zX2VuYWJsZWQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X21peGVkX21lZGlhXzE1ODk3Ijp7ImJ1Y2tldCI6InRyZWF0bWVudCIsInZlcnNpb24iOm51bGx9LCJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3Nob3dfYmlyZHdhdGNoX3Bpdm90c19lbmFibGVkIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdXNlX3Byb2ZpbGVfaW1hZ2Vfc2hhcGVfZW5hYmxlZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfbGVnYWN5X3RpbWVsaW5lX3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1694099334516642113&lang=en&origin=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&sessionId=085754ac85675148371d156177accaf7951a9cf7&theme=light&widgetsVersion=aaf4084522e3a%3A1674595607486&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67C1) /
Resource Hash
f1ae9c2026aa097e604015d4bd47dca4778ac704f883659be7b4b312be583342

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOltdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2ZvbGxvd2VyX2NvdW50X3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9iYWNrZW5kIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19yZWZzcmNfc2Vzc2lvbiI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfZm9zbnJfc29mdF9pbnRlcnZlbnRpb25zX2VuYWJsZWQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X21peGVkX21lZGlhXzE1ODk3Ijp7ImJ1Y2tldCI6InRyZWF0bWVudCIsInZlcnNpb24iOm51bGx9LCJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3Nob3dfYmlyZHdhdGNoX3Bpdm90c19lbmFibGVkIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdXNlX3Byb2ZpbGVfaW1hZ2Vfc2hhcGVfZW5hYmxlZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfbGVnYWN5X3RpbWVsaW5lX3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1694099334516642113&lang=en&origin=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&sessionId=085754ac85675148371d156177accaf7951a9cf7&theme=light&widgetsVersion=aaf4084522e3a%3A1674595607486&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Mon, 28 Aug 2023 17:06:12 GMT
Content-Encoding
gzip
Age
994309
x-amz-server-side-encryption
AES256
X-Cache
HIT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length
162750
Last-Modified
Thu, 17 Aug 2023 04:43:05 GMT
Server
ECS (frb/67C1)
Etag
"55504f1cfd3e8a03140f64af41f78e0b+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
x-tw-cdn
VZ
Cache-Control
public, max-age=315360000
embed.Tweet.c66f70f23355733e0f73.js
platform.twitter.com/embed/ Frame A9E0 		31 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.Tweet.c66f70f23355733e0f73.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOltdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2ZvbGxvd2VyX2NvdW50X3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9iYWNrZW5kIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19yZWZzcmNfc2Vzc2lvbiI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfZm9zbnJfc29mdF9pbnRlcnZlbnRpb25zX2VuYWJsZWQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X21peGVkX21lZGlhXzE1ODk3Ijp7ImJ1Y2tldCI6InRyZWF0bWVudCIsInZlcnNpb24iOm51bGx9LCJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3Nob3dfYmlyZHdhdGNoX3Bpdm90c19lbmFibGVkIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdXNlX3Byb2ZpbGVfaW1hZ2Vfc2hhcGVfZW5hYmxlZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfbGVnYWN5X3RpbWVsaW5lX3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1694099334516642113&lang=en&origin=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&sessionId=085754ac85675148371d156177accaf7951a9cf7&theme=light&widgetsVersion=aaf4084522e3a%3A1674595607486&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6760) /
Resource Hash
8328cf4c0886fffb64baf44a2de3126ed0f2771c3d1965901309a8ec173e7d91

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOltdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2ZvbGxvd2VyX2NvdW50X3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9iYWNrZW5kIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19yZWZzcmNfc2Vzc2lvbiI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfZm9zbnJfc29mdF9pbnRlcnZlbnRpb25zX2VuYWJsZWQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X21peGVkX21lZGlhXzE1ODk3Ijp7ImJ1Y2tldCI6InRyZWF0bWVudCIsInZlcnNpb24iOm51bGx9LCJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3Nob3dfYmlyZHdhdGNoX3Bpdm90c19lbmFibGVkIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdXNlX3Byb2ZpbGVfaW1hZ2Vfc2hhcGVfZW5hYmxlZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfbGVnYWN5X3RpbWVsaW5lX3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1694099334516642113&lang=en&origin=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&sessionId=085754ac85675148371d156177accaf7951a9cf7&theme=light&widgetsVersion=aaf4084522e3a%3A1674595607486&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Mon, 28 Aug 2023 17:06:12 GMT
Content-Encoding
gzip
Age
994311
x-amz-server-side-encryption
AES256
X-Cache
HIT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length
13528
Last-Modified
Thu, 17 Aug 2023 04:43:04 GMT
Server
ECS (frb/6760)
Etag
"b1adbe7e37849e6a824f793fd845f2b7+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
x-tw-cdn
VZ
Cache-Control
public, max-age=315360000
cookie.js
partner.googleadservices.com/gampad/ 		407 B
608 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=freedomheadlines.com&callback=_gfp_s_&client=ca-pub-8898076423600352
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308240101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-8898076423600352&plah=freedomheadlines.com&bust=31077389
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
38077d1e25bc00bf59ec0463134cf3d7a27f61f3760c9f237029bdc4c0b96f9f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
256
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame E504 		432 KB
88 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&adk=1812271804&adf=3025194257&lmt=1693235172&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=188x810_l%7C188x810_r&format=0x0&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&ea=0&pra=5&wgl=1&easpi=0&asro=0&asrtr=1&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372481&bpp=3&bdt=317&idt=208&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3401048158439&frm=20&pv=2&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=231
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308240101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-8898076423600352&plah=freedomheadlines.com&bust=31077389
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
76e4ec5b5a87cf41a057115fb864f6673d03a22592ab23bb18aedb56b4aed8de
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://freedomheadlines.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-encoding
br
content-length
89464
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:13 GMT
expires
Mon, 28 Aug 2023 17:06:13 GMT
observe-browsing-topics
?1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
gen_204
pagead2.googlesyndication.com/pagead/ 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&tn=DIV&cls=main-navigation-wrapper&ign=false&pw=1600&ph=1200&x=0&y=0
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Aug 2023 17:06:12 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 380D 		90 KB
35 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9983601263&adk=3783032378&adf=3194834441&pi=t.ma~as.9983601263&w=800&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=800x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372484&bpp=2&bdt=320&idt=232&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=210&ady=228&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=iq91xKOlnJ&p=https%3A//freedomheadlines.com&dtd=238
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308240101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-8898076423600352&plah=freedomheadlines.com&bust=31077389
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2a4ccc56e38e149df719e40d43481213db6cc4ceeb180f9a7abc4b9ee744a456
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://freedomheadlines.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-encoding
br
content-length
35752
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:13 GMT
expires
Mon, 28 Aug 2023 17:06:13 GMT
observe-browsing-topics
?1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
freedomheadlines.com.json
cdn.vuukle.com/ads/ 		20 KB
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.vuukle.com/ads/freedomheadlines.com.json
Requested by
Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a95e624ec4d1a9c3067a34670fa20a9e3944b0b05a0cb4200ea69cbf6c3465ab

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:12 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Mon, 28 Aug 2023 15:10:46 GMT
server
cloudflare
etag
W/"64ecb8f6-4ee7"
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Range
cf-ray
7fde24bdea0f4d93-FRA
access-control-allow-headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
alt-svc
h3=":443"; ma=86400
ads
googleads.g.doubleclick.net/pagead/ Frame 187D 		90 KB
35 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=8095804527&adk=1256974889&adf=1803170222&pi=t.ma~as.8095804527&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=298&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=768&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=DtpwuWusDU&p=https%3A//freedomheadlines.com&dtd=300
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308240101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-8898076423600352&plah=freedomheadlines.com&bust=31077389
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ad4964b732db493403d01b3663294cb6d0e272c57f2d9224a5c9673ac480ff58
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://freedomheadlines.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-encoding
br
content-length
35739
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:13 GMT
expires
Mon, 28 Aug 2023 17:06:13 GMT
observe-browsing-topics
?1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame F5F2 		118 KB
38 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=1338824485&adk=2385089580&adf=636453947&pi=t.ma~as.1338824485&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=318&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=1450&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=6bTkhJBiCn&p=https%3A//freedomheadlines.com&dtd=321
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308240101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-8898076423600352&plah=freedomheadlines.com&bust=31077389
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9f0e07e90dcceaecca4d180835a155352e46f1aca81e64e976206fefa0670b1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://freedomheadlines.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-encoding
br
content-length
38869
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:13 GMT
expires
Mon, 28 Aug 2023 17:06:13 GMT
observe-browsing-topics
?1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
embed.749.467388cca0b3fe9c3291.js
platform.twitter.com/embed/ Frame A9E0 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.749.467388cca0b3fe9c3291.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.cdfed6029cf12992305d.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67F2) /
Resource Hash
afe2c4d44f6a91b4d2ecbaf61d91e90f61cf159467b4a3fac9e51ed9b1e2920d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOltdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2ZvbGxvd2VyX2NvdW50X3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9iYWNrZW5kIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19yZWZzcmNfc2Vzc2lvbiI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfZm9zbnJfc29mdF9pbnRlcnZlbnRpb25zX2VuYWJsZWQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X21peGVkX21lZGlhXzE1ODk3Ijp7ImJ1Y2tldCI6InRyZWF0bWVudCIsInZlcnNpb24iOm51bGx9LCJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3Nob3dfYmlyZHdhdGNoX3Bpdm90c19lbmFibGVkIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdXNlX3Byb2ZpbGVfaW1hZ2Vfc2hhcGVfZW5hYmxlZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfbGVnYWN5X3RpbWVsaW5lX3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1694099334516642113&lang=en&origin=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&sessionId=085754ac85675148371d156177accaf7951a9cf7&theme=light&widgetsVersion=aaf4084522e3a%3A1674595607486&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Mon, 28 Aug 2023 17:06:12 GMT
Content-Encoding
gzip
Age
994311
x-amz-server-side-encryption
AES256
X-Cache
HIT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length
6789
Last-Modified
Thu, 17 Aug 2023 04:43:05 GMT
Server
ECS (frb/67F2)
Etag
"d3483b9c737e990765e6ba56d01154a3+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
x-tw-cdn
VZ
Cache-Control
public, max-age=315360000
embed.ondemand.i18n.en-js.6f17855ce00c810739c7.js
platform.twitter.com/embed/ Frame A9E0 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.ondemand.i18n.en-js.6f17855ce00c810739c7.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.cdfed6029cf12992305d.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67D4) /
Resource Hash
aaf8348fad3676d3d62c09c1a92f11d075643f798d1a3516b4a34cf9eb127862

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOltdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2ZvbGxvd2VyX2NvdW50X3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9iYWNrZW5kIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19yZWZzcmNfc2Vzc2lvbiI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfZm9zbnJfc29mdF9pbnRlcnZlbnRpb25zX2VuYWJsZWQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X21peGVkX21lZGlhXzE1ODk3Ijp7ImJ1Y2tldCI6InRyZWF0bWVudCIsInZlcnNpb24iOm51bGx9LCJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3Nob3dfYmlyZHdhdGNoX3Bpdm90c19lbmFibGVkIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdXNlX3Byb2ZpbGVfaW1hZ2Vfc2hhcGVfZW5hYmxlZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfbGVnYWN5X3RpbWVsaW5lX3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1694099334516642113&lang=en&origin=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&sessionId=085754ac85675148371d156177accaf7951a9cf7&theme=light&widgetsVersion=aaf4084522e3a%3A1674595607486&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Mon, 28 Aug 2023 17:06:12 GMT
Content-Encoding
gzip
Age
994311
x-amz-server-side-encryption
AES256
X-Cache
HIT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length
1532
Last-Modified
Thu, 17 Aug 2023 04:43:04 GMT
Server
ECS (frb/67D4)
Etag
"5b5cbc6ad9092f6f21500a609c1aa00b+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
x-tw-cdn
VZ
Cache-Control
public, max-age=315360000
embed.ondemand.horizon-web.i18n.en-js.d681a6dcae4601184824.js
platform.twitter.com/embed/ Frame A9E0 		35 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.ondemand.horizon-web.i18n.en-js.d681a6dcae4601184824.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.cdfed6029cf12992305d.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6724) /
Resource Hash
a5cd8ec73857ce3a975bf82836e2e5b43c1e3ab5ee56dfa26e45172914226f60

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOltdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2ZvbGxvd2VyX2NvdW50X3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9iYWNrZW5kIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19yZWZzcmNfc2Vzc2lvbiI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfZm9zbnJfc29mdF9pbnRlcnZlbnRpb25zX2VuYWJsZWQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X21peGVkX21lZGlhXzE1ODk3Ijp7ImJ1Y2tldCI6InRyZWF0bWVudCIsInZlcnNpb24iOm51bGx9LCJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3Nob3dfYmlyZHdhdGNoX3Bpdm90c19lbmFibGVkIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdXNlX3Byb2ZpbGVfaW1hZ2Vfc2hhcGVfZW5hYmxlZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfbGVnYWN5X3RpbWVsaW5lX3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1694099334516642113&lang=en&origin=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&sessionId=085754ac85675148371d156177accaf7951a9cf7&theme=light&widgetsVersion=aaf4084522e3a%3A1674595607486&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Mon, 28 Aug 2023 17:06:12 GMT
Content-Encoding
gzip
Age
994311
x-amz-server-side-encryption
AES256
X-Cache
HIT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length
11289
Last-Modified
Thu, 17 Aug 2023 04:43:05 GMT
Server
ECS (frb/6724)
Etag
"df117930505b95292615fd76b0e9369c+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
x-tw-cdn
VZ
Cache-Control
public, max-age=315360000
ads
googleads.g.doubleclick.net/pagead/ Frame 6818 		118 KB
38 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=2460334462&adk=1888080162&adf=1599616005&pi=t.ma~as.2460334462&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=400&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=2045&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=sIpVMAzNQf&p=https%3A//freedomheadlines.com&dtd=402
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308240101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-8898076423600352&plah=freedomheadlines.com&bust=31077389
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8e49bc053e28064f8a116eaed4b21a5a681982bb736e4d0ee431516d629da1b3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://freedomheadlines.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-encoding
br
content-length
38824
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:13 GMT
expires
Mon, 28 Aug 2023 17:06:13 GMT
observe-browsing-topics
?1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
collect
stats.g.doubleclick.net/j/ 		1 B
210 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-32644619-11&cid=723900094.1693242373&jid=2070112494&gjid=1345090157&_gid=489032261.1693242373&_u=YADAAUAAAAAAACAAI~&z=1285420239
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Mon, 28 Aug 2023 17:06:12 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://freedomheadlines.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 4653 		118 KB
38 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=7329517760&adk=1851110203&adf=1936646016&pi=t.ma~as.7329517760&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=438&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3203&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=a3jmjrX9MK&p=https%3A//freedomheadlines.com&dtd=440
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308240101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-8898076423600352&plah=freedomheadlines.com&bust=31077389
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8a9dc36107b45cb3b1c8d254cff2ef235b382d3341d37a1bdda746b0cee6bbac
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://freedomheadlines.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-encoding
br
content-length
38966
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:13 GMT
expires
Mon, 28 Aug 2023 17:06:13 GMT
observe-browsing-topics
?1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
dc.js
stats.g.doubleclick.net/ Frame 8A5E 		45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/dc.js
Requested by
Host: decide.dev
URL: https://decide.dev/lad/14305628449616998?pubid=ld-1613-6204&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=780&path=%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://decide.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 28 Aug 2023 16:52:24 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
828
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
17093
expires
Mon, 28 Aug 2023 18:52:24 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 411E 		120 KB
39 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9572537723&adk=2027367073&adf=2444534581&pi=t.ma~as.9572537723&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=450&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D0b5b07eb8b8de6eb-22e69c165fde0065%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MZG9A1pc5vb0F5esQL9iZw22nOIKg&gpic=UID%3D00000c69a68e8849%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MY_LfWJZwfbjugP0UdrN1kslLFx7A&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3902&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=8GRgyAgS8H&p=https%3A//freedomheadlines.com&dtd=452
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308240101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-8898076423600352&plah=freedomheadlines.com&bust=31077389
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ec524598ddf4023dd0b31be3f2ac1dc5a35736f876c3c6b59fa9c3d5cf416454
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://freedomheadlines.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-encoding
br
content-length
39415
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:14 GMT
expires
Mon, 28 Aug 2023 17:06:14 GMT
observe-browsing-topics
?1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
dc.js
stats.g.doubleclick.net/ Frame BC7D 		45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/dc.js
Requested by
Host: decide.dev
URL: https://decide.dev/lad/14305626872558694?pubid=ld-9377-335&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=780&path=%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://decide.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 28 Aug 2023 16:52:24 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
828
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
17093
expires
Mon, 28 Aug 2023 18:52:24 GMT
embed.9203.3f277c45e9937b13e8c4.js
platform.twitter.com/embed/ Frame A9E0 		267 KB
82 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.9203.3f277c45e9937b13e8c4.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.cdfed6029cf12992305d.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/674B) /
Resource Hash
c731d1ac06ce0723680061bb7eab4bfe43bad28d6af8d8fa8cf855b16ff60784

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOltdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2ZvbGxvd2VyX2NvdW50X3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9iYWNrZW5kIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19yZWZzcmNfc2Vzc2lvbiI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfZm9zbnJfc29mdF9pbnRlcnZlbnRpb25zX2VuYWJsZWQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X21peGVkX21lZGlhXzE1ODk3Ijp7ImJ1Y2tldCI6InRyZWF0bWVudCIsInZlcnNpb24iOm51bGx9LCJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3Nob3dfYmlyZHdhdGNoX3Bpdm90c19lbmFibGVkIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdXNlX3Byb2ZpbGVfaW1hZ2Vfc2hhcGVfZW5hYmxlZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfbGVnYWN5X3RpbWVsaW5lX3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1694099334516642113&lang=en&origin=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&sessionId=085754ac85675148371d156177accaf7951a9cf7&theme=light&widgetsVersion=aaf4084522e3a%3A1674595607486&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Mon, 28 Aug 2023 17:06:12 GMT
Content-Encoding
gzip
Age
994311
x-amz-server-side-encryption
AES256
X-Cache
HIT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length
83749
Last-Modified
Thu, 17 Aug 2023 04:43:05 GMT
Server
ECS (frb/674B)
Etag
"10f14cb43e1e020e75b5aef9b88c8bcb+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
x-tw-cdn
VZ
Cache-Control
public, max-age=315360000
embed.ondemand.Tweet.079f06e3abe27b4c0607.js
platform.twitter.com/embed/ Frame A9E0 		83 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.ondemand.Tweet.079f06e3abe27b4c0607.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.cdfed6029cf12992305d.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67A8) /
Resource Hash
3d9991f1b8b90658d2762b6bbb0e6a9c5101c7883523d46b3a44750480b8c45d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOltdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2ZvbGxvd2VyX2NvdW50X3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9iYWNrZW5kIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19yZWZzcmNfc2Vzc2lvbiI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfZm9zbnJfc29mdF9pbnRlcnZlbnRpb25zX2VuYWJsZWQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X21peGVkX21lZGlhXzE1ODk3Ijp7ImJ1Y2tldCI6InRyZWF0bWVudCIsInZlcnNpb24iOm51bGx9LCJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3Nob3dfYmlyZHdhdGNoX3Bpdm90c19lbmFibGVkIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdXNlX3Byb2ZpbGVfaW1hZ2Vfc2hhcGVfZW5hYmxlZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfbGVnYWN5X3RpbWVsaW5lX3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1694099334516642113&lang=en&origin=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&sessionId=085754ac85675148371d156177accaf7951a9cf7&theme=light&widgetsVersion=aaf4084522e3a%3A1674595607486&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Mon, 28 Aug 2023 17:06:12 GMT
Content-Encoding
gzip
Age
994311
x-amz-server-side-encryption
AES256
X-Cache
HIT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length
19448
Last-Modified
Thu, 17 Aug 2023 04:43:04 GMT
Server
ECS (frb/67A8)
Etag
"38ef2b330406b768d5bc09ed364f0a10+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
x-tw-cdn
VZ
Cache-Control
public, max-age=315360000
tweet-result
cdn.syndication.twimg.com/ Frame A9E0 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.syndication.twimg.com/tweet-result?features=tfw_timeline_list%3A%3Btfw_follower_count_sunset%3Atrue%3Btfw_tweet_edit_backend%3Aon%3Btfw_refsrc_session%3Aon%3Btfw_fosnr_soft_interventions_enabled%3Aon%3Btfw_mixed_media_15897%3Atreatment%3Btfw_experiments_cookie_expiration%3A1209600%3Btfw_show_birdwatch_pivots_enabled%3Aon%3Btfw_duplicate_scribes_to_settings%3Aon%3Btfw_use_profile_image_shape_enabled%3Aon%3Btfw_video_hls_dynamic_manifests_15082%3Atrue_bitrate%3Btfw_legacy_timeline_sunset%3Atrue%3Btfw_tweet_edit_frontend%3Aon&id=1694099334516642113&lang=en&token=43u64cmn4pm&vwyvg1=1738y30ji9d4d&ndhwzl=oc8i5myx4ex&aehf0i=3t9789byph7i&tqf8ka=a35op1o8m1hq&2p3poz=la8jqztw6ygt&dzhyup=1kmp8vyam36x
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.8601.9934bea25cda9d7ebe46.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
tsa_f / Express
Resource Hash
948e6b4eb7da9790909ee43daf59efda76a5cae311649787be09aca294481d2f
Security Headers
Name Value
Content-Security-Policy connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-security-policy
connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 28 Aug 2023 17:06:13 GMT
strict-transport-security
max-age=631138519
x-powered-by
Express
server-timing
x-cache;desc= ,x-tw-cdn;desc=VZ
x-xss-protection
0
x-response-time
120
server
tsa_f
etag
W/"9dc-DrTc7TjvD/8g62RIKhk3KoqEJUE"
vary
Accept-Encoding, Accept-Language
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
x-transaction-id
8bc62fbefdf82ab2
cache-control
must-revalidate, max-age=60
access-control-allow-credentials
true
perf
7626143928
x-connection-hash
50865049c0f3c33c900398398c6fa5780e932bd55c67d2a91dab579d433aa525
x-frame-options
SAMEORIGIN
x-tw-cdn
VZ, VZ, VZ
access-contol-allow-origin
platform.twitter.com
sjs.js
cdn2.decide.dev/_js/ 		10 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn2.decide.dev/_js/sjs.js
Requested by
Host: cdn1.lockerdomecdn.com
URL: https://cdn1.lockerdomecdn.com/embeds/freedomheadlines_freedomheadlines_sticky.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
/
Resource Hash
61773d9a3aa1ba14b2f4ea9a8118c619c460c5acbc8770405530cc5ce31ed7e4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
content-encoding
gzip
via
1.1 google
last-modified
Fri, 25 Aug 2023 15:10:38 GMT
etag
W/"26be-18a2d3f4e50"
x-hw
1693242373.cds291.fr8.hn,1693242373.cds329.fr8.c
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=86400
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2149
config.js
cdn.confiant-integrations.net/RNw7xiqRu-6_97G1pl1Hr7_2fbE/gpt_and_prebid/ 		131 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.confiant-integrations.net/RNw7xiqRu-6_97G1pl1Hr7_2fbE/gpt_and_prebid/config.js
Requested by
Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2b5a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
561b269e9f6dfc75026cb28c3692c5e4b29982f619e14e1d313b422676d195a6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 28 Aug 2023 16:31:07 GMT
server
cloudflare
x-amz-request-id
QH63HQE30R4DFZ3P
age
517
etag
W/"aa5ea62343b893045168a5c715469ca6"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=900, stale-while-revalidate=3600
cf-ray
7fde24bfa9372c4d-FRA
alt-svc
h3=":443"; ma=86400
x-amz-id-2
TdO5ixHEJLjD01s35+V5RZjZRmbrq6FLMtnoIZgRFltlyVLMAFu7oBWw/lDy6KSdxN7/NOebho8shew3h8OaDQ==
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		99 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b7a2a3c986638afccae4742dead290020eeb0ff1da26e51fdade7bdf19eac7f3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29226
x-xss-protection
0
server
cafe
etag
50 / 19597 / m202308220101 / config-hash: 8635181794651748832
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Mon, 28 Aug 2023 17:06:13 GMT
14729220068684902
decide.dev/lad/ Frame EA66 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://decide.dev/lad/14729220068684902?pubid=ld-14729220068684902&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=1560&path=%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Requested by
Host: cdn2.decide.dev
URL: https://cdn2.decide.dev/_js/ajs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.139.129 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
129.139.149.34.bc.googleusercontent.com
Software
/
Resource Hash
ba2d293f01789ef093b5b67ca430d9d1a95a5782e7f72e9b961163f4ba56f43b

Request headers

Referer
https://freedomheadlines.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, max-age=0, must-revalidate, no-store
content-length
1376
content-type
text/html; charset=utf-8
date
Mon, 28 Aug 2023 17:06:13 GMT
via
1.1 google
wrap.js
cdn.confiant-integrations.net/gptprebidnative/202307190925/ 		251 KB
77 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.confiant-integrations.net/gptprebidnative/202307190925/wrap.js
Requested by
Host: cdn.confiant-integrations.net
URL: https://cdn.confiant-integrations.net/RNw7xiqRu-6_97G1pl1Hr7_2fbE/gpt_and_prebid/config.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2b5a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e922a199c0736d84f1cb215cb5950484e8cf7c04011a35ccf28fd755aa5e7133

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 19 Jul 2023 13:26:13 GMT
server
cloudflare
x-amz-request-id
GWA78YN4HDYVPW2X
age
3455977
etag
W/"6c476793b39193c54a91ff561ef3a8e4"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
cf-ray
7fde24c009bc2c4d-FRA
alt-svc
h3=":443"; ma=86400
x-amz-id-2
y1S3Vs0QYbvbbLtPKg8GNogRH1HQvc9PhARbEBauHAlEzUlBh2vvmGqjFPLYL1XybPK3GmrSlOM=
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/ 		403 KB
127 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/pubads_impl.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8165d8e2771d30c1a2baf2e6ebb58ce49c3b9dc575676b6f1aa7afeb2e5efe86
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 08:56:33 GMT
content-encoding
br
x-content-type-options
nosniff
age
29380
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
129871
x-xss-protection
0
server
cafe
etag
10423821264569162327
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
expires
Tue, 27 Aug 2024 08:56:33 GMT
delivery.js
assets.netizen.co/master/ 		162 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.netizen.co/master/delivery.js
Requested by
Host: cdn.whizzco.com
URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
AmazonS3 /
Resource Hash
fe8b3c376366178fa7b6f712cfa3adbd234eaa467b606dd2ac739a5d2f6e4c82

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
content-encoding
gzip
last-modified
Mon, 07 Aug 2023 16:52:58 GMT
server
AmazonS3
x-amz-request-id
MVGVSMAHJA4BPKYP
etag
"1b3c42c13a9be80d5847f3d41c06367f"
x-amz-server-side-encryption
AES256
x-hw
1693242373.cds133.fr8.hn,1693242373.cds338.fr8.c
content-type
text/javascript
access-control-allow-origin
*
cache-control
public,max-age=60
accept-ranges
bytes
content-length
52486
x-amz-id-2
iK/6eo8Kh7hMfmihSxZvAPoKYtvCRYkfw8Wcw3iIN5SmM5YF/nh1P8fU0p0tPW3O7/zPvD3b5lM=
tshow
api.whizzco.com/dtracking/v1/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.whizzco.com/dtracking/v1/tshow
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e4::ac40:a50b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://freedomheadlines.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET, POST, HEAD, OPTIONS
access-control-allow-origin
https://freedomheadlines.com
access-control-max-age
1800
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7fde24c05cf7bbc2-FRA
content-length
0
date
Mon, 28 Aug 2023 17:06:13 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3O9SURKExgkV54hgpMLOmENeytLp8wHvCbSMZ8D0UBKzU4aEZwBJOcYobOJ99Be0g%2B4BT2NW6DEpb48uZLcOfpbFm5Qmkr%2BStgMMqq6sJsPA9JiUQO%2BeDJPyPo95%2Fqwg598DJkNuW1kS%2Bv286OA%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
tshow
api.whizzco.com/dtracking/v1/ 		15 B
489 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.whizzco.com/dtracking/v1/tshow
Requested by
Host: cdn.whizzco.com
URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:e4::ac40:a50b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d23d39a30bb7323f8ccfd64c52cf286138fba4f83e78f7edcf66703b7c23aaa

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-type
application/json; charset=UTF-8

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yRn4p%2F5XAHjQqEPGOGcKZSSlq6xTJUlXfhdBwlnZCTfgqcjPYrwTivbdATGpkM0O1k04ZUpzvZRH3BaYfpY7aTCJHcKCFXtRlHUfdpN5bUPr0ipoxSCdoGh1dz%2F%2F0pqxTupitKt8%2FAGWGJKCn5E%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
https://freedomheadlines.com
access-control-allow-credentials
true
cf-ray
7fde24c17b409978-FRA
alt-svc
h3=":443"; ma=86400
content-length
15
priority
u=1,i
rtads
api.whizzco.com/demand/v1/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.whizzco.com/demand/v1/rtads
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e4::ac40:a50b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://freedomheadlines.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET, POST, HEAD, OPTIONS
access-control-allow-origin
https://freedomheadlines.com
access-control-max-age
1800
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7fde24c05cfabbc2-FRA
content-length
0
date
Mon, 28 Aug 2023 17:06:13 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SLInOl1WSkzSQcZd7n4cNn1o8nn%2BE2qR5cbYYUDLcOoy8QF5ge%2Bu%2BtIi4q8Xd0G4rkJGddQ%2F6XSS3RVLqRaWcKeUSbPlLlJU97u6ZXzKjRnG0EU5jHsaphr0dN6%2FFXCj6PubTK6H75VKReiDfB4%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
rtads
api.whizzco.com/demand/v1/ 		501 B
733 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.whizzco.com/demand/v1/rtads
Requested by
Host: cdn.whizzco.com
URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:e4::ac40:a50b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c9b66bc6cf23b792979aee24aaa66eced0774974b2a564a44ef7f68b3861cc8e

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-type
application/json; charset=UTF-8

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AZKUtcU%2FW%2Busm7GehmmWezKXJEKXZBzy39WmdDGqrPfiAK%2FDoCyc%2FBMUEr5dD7gYrv7c0TebMDjoDON0XaA97x11NLKEZyUV42WdPKggXe5Ux491hxTxrxrEyyZIYAGp%2Bbe3LIyU5uOR9bvHtY8%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
https://freedomheadlines.com
access-control-allow-credentials
true
cf-ray
7fde24c3fada92b4-FRA
alt-svc
h3=":443"; ma=86400
priority
u=1,i
embeds
syndication.twitter.com/i/jot/ Frame A9E0 		43 B
150 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://syndication.twitter.com/i/jot/embeds?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1693242373232%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22results%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22horizon%22%2C%22client_version%22%3A%22aaf4084522e3a%3A1674595607486%22%2C%22dnt%22%3Atrue%2C%22widget_id%22%3A%22twitter-widget-0%22%2C%22widget_origin%22%3A%22https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22c9014b6146088%3A1692244862616%22%2C%22item_ids%22%3A%5B%221694099334516642113%22%5D%2C%22item_details%22%3A%7B%221694099334516642113%22%3A%7B%22item_type%22%3A0%7D%7D%7D&dnt=1
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.200 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

x-response-time
103
date
Mon, 28 Aug 2023 17:06:13 GMT
strict-transport-security
max-age=631138519
last-modified
Mon, 28 Aug 2023 17:06:13 GMT
server
tsa_o
vary
Origin
content-type
image/gif
x-transaction-id
d0b9983e24c52c4a
cache-control
must-revalidate, max-age=600
perf
7626143928
x-connection-hash
0448e32ac9dbd7e546aceb779f4f3280ec04ea6b1b595c36aaf4caa0eee3d7a6
content-length
43
dc.js
stats.g.doubleclick.net/ Frame EA66 		45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/dc.js
Requested by
Host: decide.dev
URL: https://decide.dev/lad/14729220068684902?pubid=ld-14729220068684902&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=1560&path=%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://decide.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 28 Aug 2023 16:52:24 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
829
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
17093
expires
Mon, 28 Aug 2023 18:52:24 GMT
6285313048639630111
tpc.googlesyndication.com/daca_images/simgad/ Frame 380D 		87 KB
87 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/daca_images/simgad/6285313048639630111
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9983601263&adk=3783032378&adf=3194834441&pi=t.ma~as.9983601263&w=800&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=800x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372484&bpp=2&bdt=320&idt=232&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=210&ady=228&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=iq91xKOlnJ&p=https%3A//freedomheadlines.com&dtd=238
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
efb4176046184158d84ee90507639923053873963beac357285b8653289de00a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 23:25:58 GMT
x-content-type-options
nosniff
age
150015
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
88791
x-xss-protection
0
last-modified
Fri, 21 Oct 2022 00:38:46 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sun, 25 Aug 2024 23:25:58 GMT
abg_lite_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/ Frame 380D 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/abg_lite_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9983601263&adk=3783032378&adf=3194834441&pi=t.ma~as.9983601263&w=800&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=800x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372484&bpp=2&bdt=320&idt=232&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=210&ady=228&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=iq91xKOlnJ&p=https%3A//freedomheadlines.com&dtd=238
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1df629c9e3d7999c38bfa18b45032197fd4da30e8e893bf07f5083e1fa9b4390
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 03:15:28 GMT
content-encoding
br
x-content-type-options
nosniff
age
49845
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9067
x-xss-protection
0
server
cafe
etag
16184311534176170479
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 03:15:28 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 380D 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/window_focus_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9983601263&adk=3783032378&adf=3194834441&pi=t.ma~as.9983601263&w=800&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=800x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372484&bpp=2&bdt=320&idt=232&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=210&ady=228&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=iq91xKOlnJ&p=https%3A//freedomheadlines.com&dtd=238
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 11:35:05 GMT
content-encoding
br
x-content-type-options
nosniff
age
19868
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 11:35:05 GMT
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 380D 		20 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9983601263&adk=3783032378&adf=3194834441&pi=t.ma~as.9983601263&w=800&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=800x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372484&bpp=2&bdt=320&idt=232&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=210&ady=228&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=iq91xKOlnJ&p=https%3A//freedomheadlines.com&dtd=238
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b1fe6456a4e2d8871862a70a1d1ad7dee8887643ee994ad850ee0a30072cfbd2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 03:15:26 GMT
content-encoding
br
x-content-type-options
nosniff
age
49847
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8273
x-xss-protection
0
server
cafe
etag
16365778639179992903
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 03:15:26 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 380D 		181 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9983601263&adk=3783032378&adf=3194834441&pi=t.ma~as.9983601263&w=800&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=800x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372484&bpp=2&bdt=320&idt=232&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=210&ady=228&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=iq91xKOlnJ&p=https%3A//freedomheadlines.com&dtd=238
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5e3e377390273cdcadaaa15956be20643d89765dfe7b62c363e9442a68bd4271
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57780
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1692792373905140"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 28 Aug 2023 17:06:13 GMT
one_click_handler_one_afma_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 380D 		35 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/one_click_handler_one_afma_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9983601263&adk=3783032378&adf=3194834441&pi=t.ma~as.9983601263&w=800&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=800x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372484&bpp=2&bdt=320&idt=232&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=210&ady=228&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=iq91xKOlnJ&p=https%3A//freedomheadlines.com&dtd=238
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
01e8be122ac87eb4686d3bdad82d7e241a721dd3381699cc71423626ee7d7a32
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 15:22:50 GMT
content-encoding
br
x-content-type-options
nosniff
age
6203
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14411
x-xss-protection
0
server
cafe
etag
4500582243027856586
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 15:22:50 GMT
6285313048639630111
tpc.googlesyndication.com/daca_images/simgad/ Frame 187D 		87 KB
87 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/daca_images/simgad/6285313048639630111
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=8095804527&adk=1256974889&adf=1803170222&pi=t.ma~as.8095804527&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=298&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=768&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=DtpwuWusDU&p=https%3A//freedomheadlines.com&dtd=300
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
efb4176046184158d84ee90507639923053873963beac357285b8653289de00a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 23:25:58 GMT
x-content-type-options
nosniff
age
150015
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
88791
x-xss-protection
0
last-modified
Fri, 21 Oct 2022 00:38:46 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sun, 25 Aug 2024 23:25:58 GMT
abg_lite_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/ Frame 187D 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/abg_lite_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=8095804527&adk=1256974889&adf=1803170222&pi=t.ma~as.8095804527&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=298&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=768&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=DtpwuWusDU&p=https%3A//freedomheadlines.com&dtd=300
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1df629c9e3d7999c38bfa18b45032197fd4da30e8e893bf07f5083e1fa9b4390
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 03:15:28 GMT
content-encoding
br
x-content-type-options
nosniff
age
49845
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9067
x-xss-protection
0
server
cafe
etag
16184311534176170479
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 03:15:28 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 187D 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/window_focus_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=8095804527&adk=1256974889&adf=1803170222&pi=t.ma~as.8095804527&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=298&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=768&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=DtpwuWusDU&p=https%3A//freedomheadlines.com&dtd=300
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 11:35:05 GMT
content-encoding
br
x-content-type-options
nosniff
age
19868
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 11:35:05 GMT
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 187D 		20 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=8095804527&adk=1256974889&adf=1803170222&pi=t.ma~as.8095804527&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=298&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=768&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=DtpwuWusDU&p=https%3A//freedomheadlines.com&dtd=300
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b1fe6456a4e2d8871862a70a1d1ad7dee8887643ee994ad850ee0a30072cfbd2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 03:15:26 GMT
content-encoding
br
x-content-type-options
nosniff
age
49847
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8273
x-xss-protection
0
server
cafe
etag
16365778639179992903
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 03:15:26 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 187D 		181 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=8095804527&adk=1256974889&adf=1803170222&pi=t.ma~as.8095804527&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=298&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=768&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=DtpwuWusDU&p=https%3A//freedomheadlines.com&dtd=300
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5e3e377390273cdcadaaa15956be20643d89765dfe7b62c363e9442a68bd4271
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57780
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1692792373905140"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 28 Aug 2023 17:06:13 GMT
one_click_handler_one_afma_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 187D 		35 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/one_click_handler_one_afma_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=8095804527&adk=1256974889&adf=1803170222&pi=t.ma~as.8095804527&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=298&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=768&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=DtpwuWusDU&p=https%3A//freedomheadlines.com&dtd=300
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
01e8be122ac87eb4686d3bdad82d7e241a721dd3381699cc71423626ee7d7a32
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 15:22:50 GMT
content-encoding
br
x-content-type-options
nosniff
age
6203
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14411
x-xss-protection
0
server
cafe
etag
4500582243027856586
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 15:22:50 GMT
user_visited_page
telemetries.jeeng.com/api/events/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://telemetries.jeeng.com/api/events/user_visited_page
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:39ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://freedomheadlines.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

access-control-allow-headers
content-type
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin
*
cf-cache-status
DYNAMIC
cf-ray
7fde24c1895c9048-FRA
date
Mon, 28 Aug 2023 17:06:13 GMT
server
cloudflare
strict-transport-security
max-age=15724800; includeSubDomains
vary
Access-Control-Request-Headers
x-powered-by
Express
user_visited_page
telemetries.jeeng.com/api/events/ 		15 B
124 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://telemetries.jeeng.com/api/events/user_visited_page
Requested by
Host: users.api.jeeng.com
URL: https://users.api.jeeng.com/users/domains/mO6DXK83XA/sdk/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:39ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
3d23d39a30bb7323f8ccfd64c52cf286138fba4f83e78f7edcf66703b7c23aaa
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-type
application/json

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
strict-transport-security
max-age=15724800; includeSubDomains
cf-cache-status
DYNAMIC
server
cloudflare
x-powered-by
Express
etag
W/"f-v/Y1JusChTxrQUzPtNAKycooOTA"
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cf-ray
7fde24c25a3d9048-FRA
content-length
15
vd9g6ULw_normal.jpg
pbs.twimg.com/profile_images/1368389733966024705/ Frame A9E0 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/profile_images/1368389733966024705/vd9g6ULw_normal.jpg
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6725) /
Resource Hash
7e2a73a579902634041ad092f13d3cefeba13f62c71c60a785a461214848807b
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
strict-transport-security
max-age=631138519
x-content-type-options
nosniff
age
120453
x-cache
HIT
server-timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
content-length
2339
x-response-time
134
surrogate-key
profile_images profile_images/bucket/0 profile_images/1368389733966024705
last-modified
Sun, 07 Mar 2021 02:33:10 GMT
server
ECS (frb/6725)
x-tw-cdn
VZ, VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
x-transaction-id
569bbdd7da47b856
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
perf
7626143928
x-connection-hash
847bcd79cc3156441945788d63a14cb63369ae6b3ba22ad650e19adc0d6a37c3
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
s
googleads.g.doubleclick.net/pagead/drt/ Frame 954C 		143 B
166 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9983601263&adk=3783032378&adf=3194834441&pi=t.ma~as.9983601263&w=800&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=800x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372484&bpp=2&bdt=320&idt=232&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=210&ady=228&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=iq91xKOlnJ&p=https%3A//freedomheadlines.com&dtd=238
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9983601263&adk=3783032378&adf=3194834441&pi=t.ma~as.9983601263&w=800&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=800x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372484&bpp=2&bdt=320&idt=232&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=210&ady=228&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=iq91xKOlnJ&p=https%3A//freedomheadlines.com&dtd=238
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
2550
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=3600
content-encoding
gzip
content-length
145
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 16:23:43 GMT
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
213794966
fundingchoicesmessages.google.com/i/ 		150 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/i/213794966?ers=3
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
a791efc179088761bc7a40f2de8211560672ab69a46382cafb38575bab60a77f
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-ZpyZqEyegtauW1P526PJQA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-ZpyZqEyegtauW1P526PJQA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin
*
expires
Mon, 01 Jan 1990 00:00:00 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame 63EA 		143 B
166 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=8095804527&adk=1256974889&adf=1803170222&pi=t.ma~as.8095804527&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=298&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=768&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=DtpwuWusDU&p=https%3A//freedomheadlines.com&dtd=300
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=8095804527&adk=1256974889&adf=1803170222&pi=t.ma~as.8095804527&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=298&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=768&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=DtpwuWusDU&p=https%3A//freedomheadlines.com&dtd=300
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
2550
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=3600
content-encoding
gzip
content-length
145
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 16:23:43 GMT
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
F4KmT6wXUAAdbqY
pbs.twimg.com/media/ Frame A9E0 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/media/F4KmT6wXUAAdbqY?format=png&name=360x360
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67C1) /
Resource Hash
fbc660ddb9e34a1d5cceedd042e27a1f78921d4caab2d8f42eb3a095cd65454c
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
strict-transport-security
max-age=631138519
x-content-type-options
nosniff
age
502559
x-cache
HIT
server-timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
content-length
19206
x-response-time
252
surrogate-key
media media/bucket/7 media/1694099270964563968
last-modified
Tue, 22 Aug 2023 21:26:35 GMT
server
ECS (frb/67C1)
x-tw-cdn
VZ, VZ, VZ
content-type
image/png
access-control-allow-origin
*
x-transaction-id
bab5ffd2dafa9d0e
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
perf
7626143928
x-connection-hash
e8ab91daaf084e5237358b191882bb9c1cbbb01a0ee86bf329568c2670a30733
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
16764504543501639038
tpc.googlesyndication.com/simgad/ Frame F5F2 		41 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/16764504543501639038?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qlcmw7_fO4dptB0AhjMsgib4MnGaA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=1338824485&adk=2385089580&adf=636453947&pi=t.ma~as.1338824485&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=318&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=1450&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=6bTkhJBiCn&p=https%3A//freedomheadlines.com&dtd=321
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
45aa38a592701233d92a89df66a60abecdedf9107be819b86775c1cd62e3abd1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Thu, 24 Aug 2023 03:13:44 GMT
x-content-type-options
nosniff
age
395549
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42039
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 08:08:51 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Fri, 23 Aug 2024 03:13:44 GMT
abg_lite_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/ Frame F5F2 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/abg_lite_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=1338824485&adk=2385089580&adf=636453947&pi=t.ma~as.1338824485&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=318&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=1450&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=6bTkhJBiCn&p=https%3A//freedomheadlines.com&dtd=321
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1df629c9e3d7999c38bfa18b45032197fd4da30e8e893bf07f5083e1fa9b4390
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 03:15:28 GMT
content-encoding
br
x-content-type-options
nosniff
age
49845
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9067
x-xss-protection
0
server
cafe
etag
16184311534176170479
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 03:15:28 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame F5F2 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/window_focus_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=1338824485&adk=2385089580&adf=636453947&pi=t.ma~as.1338824485&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=318&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=1450&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=6bTkhJBiCn&p=https%3A//freedomheadlines.com&dtd=321
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 11:35:05 GMT
content-encoding
br
x-content-type-options
nosniff
age
19868
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 11:35:05 GMT
transparent.png
tpc.googlesyndication.com/pagead/images/ Frame F5F2 		67 B
91 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/transparent.png
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=1338824485&adk=2385089580&adf=636453947&pi=t.ma~as.1338824485&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=318&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=1450&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=6bTkhJBiCn&p=https%3A//freedomheadlines.com&dtd=321
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 02:28:40 GMT
x-content-type-options
nosniff
server
cafe
age
52653
etag
2462972746714251406
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/png
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
67
x-xss-protection
0
expires
Tue, 29 Aug 2023 02:28:40 GMT
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame F5F2 		20 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=1338824485&adk=2385089580&adf=636453947&pi=t.ma~as.1338824485&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=318&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=1450&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=6bTkhJBiCn&p=https%3A//freedomheadlines.com&dtd=321
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b1fe6456a4e2d8871862a70a1d1ad7dee8887643ee994ad850ee0a30072cfbd2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 03:15:26 GMT
content-encoding
br
x-content-type-options
nosniff
age
49847
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8273
x-xss-protection
0
server
cafe
etag
16365778639179992903
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 03:15:26 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame F5F2 		181 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=1338824485&adk=2385089580&adf=636453947&pi=t.ma~as.1338824485&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=318&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=1450&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=6bTkhJBiCn&p=https%3A//freedomheadlines.com&dtd=321
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5e3e377390273cdcadaaa15956be20643d89765dfe7b62c363e9442a68bd4271
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57780
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1692792373905140"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 28 Aug 2023 17:06:13 GMT
one_click_handler_one_afma_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame F5F2 		35 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/one_click_handler_one_afma_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=1338824485&adk=2385089580&adf=636453947&pi=t.ma~as.1338824485&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=318&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=1450&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=6bTkhJBiCn&p=https%3A//freedomheadlines.com&dtd=321
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
01e8be122ac87eb4686d3bdad82d7e241a721dd3381699cc71423626ee7d7a32
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 15:22:50 GMT
content-encoding
br
x-content-type-options
nosniff
age
6203
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14411
x-xss-protection
0
server
cafe
etag
4500582243027856586
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 15:22:50 GMT
F4KmT6wXUAAdbqY
pbs.twimg.com/media/ Frame A9E0 		44 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/media/F4KmT6wXUAAdbqY?format=png&name=small
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67C1) /
Resource Hash
8a169cfec2d4951fde01912d4dce25e011be569327cd7e3af2e8cc97f400a375
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
strict-transport-security
max-age=631138519
x-content-type-options
nosniff
age
502640
x-cache
HIT
server-timing
x-cache;desc= HIT,x-tw-cdn;desc=VZ
content-length
44625
x-response-time
225
surrogate-key
media media/bucket/7 media/1694099270964563968
last-modified
Tue, 22 Aug 2023 21:26:35 GMT
server
ECS (frb/67C1)
x-tw-cdn
VZ, VZ, VZ
content-type
image/png
access-control-allow-origin
*
x-transaction-id
964396261a33e357
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
perf
7626143928
x-connection-hash
cd157bec8ab9702d2720b2790302183aba371e2ae503cee8a900becb79bf66ff
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
pwt.js
ads.pubmatic.com/AdServer/js/pwt/160835/4933/ 		222 KB
67 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/pwt/160835/4933/pwt.js
Requested by
Host: assets.netizen.co
URL: https://assets.netizen.co/master/delivery.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.244.232 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-19-244-232.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
6b30722487e92833baf8f01d6b2d2fed4e459d7cd42dc81ac1a80d8d08b9450e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
content-encoding
gzip
last-modified
Sat, 29 Apr 2023 00:25:40 GMT
server
Apache
vary
Accept-Encoding
content-type
application/javascript
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
max-age=79128
accept-ranges
bytes
content-length
68444
expires
Tue, 29 Aug 2023 15:05:01 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame DF5F 		143 B
166 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=1338824485&adk=2385089580&adf=636453947&pi=t.ma~as.1338824485&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=318&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=1450&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=6bTkhJBiCn&p=https%3A//freedomheadlines.com&dtd=321
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=1338824485&adk=2385089580&adf=636453947&pi=t.ma~as.1338824485&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=318&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=1450&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=6bTkhJBiCn&p=https%3A//freedomheadlines.com&dtd=321
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
2550
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=3600
content-encoding
gzip
content-length
145
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 16:23:43 GMT
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
7757321352091826369
tpc.googlesyndication.com/simgad/ Frame 6818 		42 KB
42 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/7757321352091826369?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkwUYkWpeUsQaqLxTue7RG5l24wmg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=2460334462&adk=1888080162&adf=1599616005&pi=t.ma~as.2460334462&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=400&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=2045&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=sIpVMAzNQf&p=https%3A//freedomheadlines.com&dtd=402
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1a0b835ba5474619c90a646fdb43f7337b2aeddbd561b713f27a12c2c83314cc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Tue, 22 Aug 2023 17:56:07 GMT
x-content-type-options
nosniff
age
515406
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43383
x-xss-protection
0
last-modified
Thu, 01 Jul 2021 08:10:54 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Wed, 21 Aug 2024 17:56:07 GMT
abg_lite_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/ Frame 6818 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/abg_lite_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=2460334462&adk=1888080162&adf=1599616005&pi=t.ma~as.2460334462&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=400&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=2045&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=sIpVMAzNQf&p=https%3A//freedomheadlines.com&dtd=402
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1df629c9e3d7999c38bfa18b45032197fd4da30e8e893bf07f5083e1fa9b4390
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 03:15:28 GMT
content-encoding
br
x-content-type-options
nosniff
age
49845
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9067
x-xss-protection
0
server
cafe
etag
16184311534176170479
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 03:15:28 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 6818 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/window_focus_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=2460334462&adk=1888080162&adf=1599616005&pi=t.ma~as.2460334462&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=400&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=2045&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=sIpVMAzNQf&p=https%3A//freedomheadlines.com&dtd=402
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 11:35:05 GMT
content-encoding
br
x-content-type-options
nosniff
age
19868
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 11:35:05 GMT
transparent.png
tpc.googlesyndication.com/pagead/images/ Frame 6818 		67 B
91 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/transparent.png
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=2460334462&adk=1888080162&adf=1599616005&pi=t.ma~as.2460334462&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=400&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=2045&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=sIpVMAzNQf&p=https%3A//freedomheadlines.com&dtd=402
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 02:28:40 GMT
x-content-type-options
nosniff
server
cafe
age
52653
etag
2462972746714251406
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/png
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
67
x-xss-protection
0
expires
Tue, 29 Aug 2023 02:28:40 GMT
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 6818 		20 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=2460334462&adk=1888080162&adf=1599616005&pi=t.ma~as.2460334462&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=400&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=2045&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=sIpVMAzNQf&p=https%3A//freedomheadlines.com&dtd=402
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b1fe6456a4e2d8871862a70a1d1ad7dee8887643ee994ad850ee0a30072cfbd2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 03:15:26 GMT
content-encoding
br
x-content-type-options
nosniff
age
49847
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8273
x-xss-protection
0
server
cafe
etag
16365778639179992903
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 03:15:26 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 6818 		181 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=2460334462&adk=1888080162&adf=1599616005&pi=t.ma~as.2460334462&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=400&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=2045&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=sIpVMAzNQf&p=https%3A//freedomheadlines.com&dtd=402
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5e3e377390273cdcadaaa15956be20643d89765dfe7b62c363e9442a68bd4271
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57780
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1692792373905140"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 28 Aug 2023 17:06:13 GMT
one_click_handler_one_afma_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 6818 		35 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/one_click_handler_one_afma_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=2460334462&adk=1888080162&adf=1599616005&pi=t.ma~as.2460334462&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=400&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=2045&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=sIpVMAzNQf&p=https%3A//freedomheadlines.com&dtd=402
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
01e8be122ac87eb4686d3bdad82d7e241a721dd3381699cc71423626ee7d7a32
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 15:22:50 GMT
content-encoding
br
x-content-type-options
nosniff
age
6203
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14411
x-xss-protection
0
server
cafe
etag
4500582243027856586
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 15:22:50 GMT
truncated
/ Frame 380D 		210 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4961a1de84f2dd1986f7560dc85392a6a11ca9bcca92f10f65291e9afbc5ff3e

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
image/png
si
googleads.g.doubleclick.net/pagead/drt/ Frame 954C
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
17 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9983601263&adk=3783032378&adf=3194834441&pi=t.ma~as.9983601263&w=800&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=800x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372484&bpp=2&bdt=320&idt=232&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=210&ady=228&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=iq91xKOlnJ&p=https%3A//freedomheadlines.com&dtd=238
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:13 GMT
expires
Mon, 28 Aug 2023 17:06:13 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:13 GMT
location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
s
googleads.g.doubleclick.net/pagead/drt/ Frame 9EAC 		143 B
166 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=2460334462&adk=1888080162&adf=1599616005&pi=t.ma~as.2460334462&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=400&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=2045&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=sIpVMAzNQf&p=https%3A//freedomheadlines.com&dtd=402
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=2460334462&adk=1888080162&adf=1599616005&pi=t.ma~as.2460334462&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=400&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=2045&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=sIpVMAzNQf&p=https%3A//freedomheadlines.com&dtd=402
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
2550
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=3600
content-encoding
gzip
content-length
145
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 16:23:43 GMT
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
redir.html
p4-bxlpgat6ptlbc-24skbq56hefzhukm-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 9AEF 		247 B
869 B 		Document
General
Check archive.org
Download Go to
Full URL
https://p4-bxlpgat6ptlbc-24skbq56hefzhukm-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=2460334462&adk=1888080162&adf=1599616005&pi=t.ma~as.2460334462&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=400&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=2045&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=sIpVMAzNQf&p=https%3A//freedomheadlines.com&dtd=402
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.67 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f3.1e100.net
Software
sffe /
Resource Hash
58de04be3907260f5d69d794679d2b54b6a48c6dd5090b4a55fe0b96127ec155
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-encoding
gzip
content-length
204
content-security-policy-report-only
script-src 'nonce-3SMKKl7mXBv8aflzwVivUw' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:13 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
last-modified
Mon, 02 Dec 2019 20:15:00 GMT
pragma
no-cache
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
truncated
/ Frame 187D 		210 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f84a7505f46f37055864aab5c4c9bae2919006e4a985556e7a620300beb90953

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
image/png
si
googleads.g.doubleclick.net/pagead/drt/ Frame 63EA
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
17 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=8095804527&adk=1256974889&adf=1803170222&pi=t.ma~as.8095804527&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=298&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=768&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=DtpwuWusDU&p=https%3A//freedomheadlines.com&dtd=300
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:13 GMT
expires
Mon, 28 Aug 2023 17:06:13 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:13 GMT
location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
16764504543501639038
tpc.googlesyndication.com/simgad/ Frame 4653 		41 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/16764504543501639038?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qlcmw7_fO4dptB0AhjMsgib4MnGaA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=7329517760&adk=1851110203&adf=1936646016&pi=t.ma~as.7329517760&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=438&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3203&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=a3jmjrX9MK&p=https%3A//freedomheadlines.com&dtd=440
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
45aa38a592701233d92a89df66a60abecdedf9107be819b86775c1cd62e3abd1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Thu, 24 Aug 2023 03:13:44 GMT
x-content-type-options
nosniff
age
395549
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42039
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 08:08:51 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Fri, 23 Aug 2024 03:13:44 GMT
abg_lite_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/ Frame 4653 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/abg_lite_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=7329517760&adk=1851110203&adf=1936646016&pi=t.ma~as.7329517760&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=438&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3203&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=a3jmjrX9MK&p=https%3A//freedomheadlines.com&dtd=440
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1df629c9e3d7999c38bfa18b45032197fd4da30e8e893bf07f5083e1fa9b4390
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 03:15:28 GMT
content-encoding
br
x-content-type-options
nosniff
age
49845
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9067
x-xss-protection
0
server
cafe
etag
16184311534176170479
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 03:15:28 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 4653 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/window_focus_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=7329517760&adk=1851110203&adf=1936646016&pi=t.ma~as.7329517760&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=438&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3203&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=a3jmjrX9MK&p=https%3A//freedomheadlines.com&dtd=440
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 11:35:05 GMT
content-encoding
br
x-content-type-options
nosniff
age
19868
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 11:35:05 GMT
transparent.png
tpc.googlesyndication.com/pagead/images/ Frame 4653 		67 B
91 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/transparent.png
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=7329517760&adk=1851110203&adf=1936646016&pi=t.ma~as.7329517760&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=438&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3203&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=a3jmjrX9MK&p=https%3A//freedomheadlines.com&dtd=440
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 02:28:40 GMT
x-content-type-options
nosniff
server
cafe
age
52653
etag
2462972746714251406
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/png
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
67
x-xss-protection
0
expires
Tue, 29 Aug 2023 02:28:40 GMT
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 4653 		20 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=7329517760&adk=1851110203&adf=1936646016&pi=t.ma~as.7329517760&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=438&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3203&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=a3jmjrX9MK&p=https%3A//freedomheadlines.com&dtd=440
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b1fe6456a4e2d8871862a70a1d1ad7dee8887643ee994ad850ee0a30072cfbd2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 03:15:26 GMT
content-encoding
br
x-content-type-options
nosniff
age
49847
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8273
x-xss-protection
0
server
cafe
etag
16365778639179992903
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 03:15:26 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 4653 		181 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=7329517760&adk=1851110203&adf=1936646016&pi=t.ma~as.7329517760&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=438&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3203&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=a3jmjrX9MK&p=https%3A//freedomheadlines.com&dtd=440
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5e3e377390273cdcadaaa15956be20643d89765dfe7b62c363e9442a68bd4271
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57780
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1692792373905140"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 28 Aug 2023 17:06:13 GMT
one_click_handler_one_afma_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 4653 		35 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/one_click_handler_one_afma_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=7329517760&adk=1851110203&adf=1936646016&pi=t.ma~as.7329517760&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=438&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3203&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=a3jmjrX9MK&p=https%3A//freedomheadlines.com&dtd=440
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
01e8be122ac87eb4686d3bdad82d7e241a721dd3381699cc71423626ee7d7a32
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 15:22:50 GMT
content-encoding
br
x-content-type-options
nosniff
age
6203
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14411
x-xss-protection
0
server
cafe
etag
4500582243027856586
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 15:22:50 GMT
truncated
/ Frame F5F2 		218 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8d5287568eed8697f603015f0b84a078309dad917ceddee717309e88588e75eb

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
image/png
s
googleads.g.doubleclick.net/pagead/drt/ Frame F801 		143 B
166 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=7329517760&adk=1851110203&adf=1936646016&pi=t.ma~as.7329517760&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=438&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3203&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=a3jmjrX9MK&p=https%3A//freedomheadlines.com&dtd=440
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=7329517760&adk=1851110203&adf=1936646016&pi=t.ma~as.7329517760&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=438&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3203&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=a3jmjrX9MK&p=https%3A//freedomheadlines.com&dtd=440
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
2550
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=3600
content-encoding
gzip
content-length
145
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 16:23:43 GMT
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
AGSKWxXNbnhZ8iE5tlGtDILEfVIybJncm2G6sP0FatZ9OcmV1AIiViyuGg7myIDAyN8KpAC0M1mY1MypOXdDqhGfu8IrobWHmX_SKySr9F42Ja9JWOXuUxWbkH_SkOn__b_XeKBkFxeSAg==
fundingchoicesmessages.google.com/f/ 		345 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxXNbnhZ8iE5tlGtDILEfVIybJncm2G6sP0FatZ9OcmV1AIiViyuGg7myIDAyN8KpAC0M1mY1MypOXdDqhGfu8IrobWHmX_SKySr9F42Ja9JWOXuUxWbkH_SkOn__b_XeKBkFxeSAg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjkzMjQyMzczLDc1MjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9mcmVlZG9taGVhZGxpbmVzLmNvbS9mcmVlZG9tLXdpcmUvZm9ybWVyLW1hci1hLWxhZ28tZW1wbG95ZWUtZmxpcHMtb24tdHJ1bXAvIixudWxsLFtbOCwiRXZNdHJ4TFB3N00iXSxbOSwiZGUiXSxbMTksIjEiXV1d
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.de.EvMtrxLPw7M.es5.O/d=1/rs=AJlcJMwht9khWRhaNef-0OxhbzI7ZbGwAg/m=kernel_loader,loader_js_executable
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
9ae6ff7132091a30fff5b1e78776faaaf35cfd508fcc5b0bb2b07226738af975
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-txanNtFr6LEoq4iCkRPDow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
content-security-policy
script-src 'report-sample' 'nonce-txanNtFr6LEoq4iCkRPDow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin
*
expires
Mon, 01 Jan 1990 00:00:00 GMT
/
www.googleadservices.com/pagead/ar-adview/ Frame F5F2
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/adview?ai=Cw4YKBNTsZI6_M4LKtwe96JPYBPnGxZ1xvbHJ6akRv-EeEAEg-833lQFglYKAgKwHoAGVmOnHAsgBAqgDAcgDyQSqBLgCT9C1EEXLM0NjZ-H8Y3bM7U3bDBHHKyfszhI3cOWN8PjUWYg1dBA...
  • https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%225734965869933055012%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%2...
0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%225734965869933055012%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22687492117%22],%224%22:[%2208-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%221888465040357297121%22}&andc=true
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=1338824485&adk=2385089580&adf=636453947&pi=t.ma~as.1338824485&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=318&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=1450&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=6bTkhJBiCn&p=https%3A//freedomheadlines.com&dtd=321
Protocol
H3
Server
216.58.206.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s07-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
x-content-type-options
nosniff
attribution-reporting-register-source
{"debug_key":"5734965869933055012","debug_reporting":true,"destination":"https://draussenfeet.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["687492117"],"4":["08-28"],"6":["true"]},"priority":"500","source_event_id":"1888465040357297121"}
server
cafe
content-type
text/css; charset=UTF-8
access-control-allow-origin
https://googleads.g.doubleclick.net
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
private
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Mon, 28 Aug 2023 17:06:14 GMT

Redirect headers

content-security-policy
script-src 'none'; object-src 'none'
date
Mon, 28 Aug 2023 17:06:13 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
location
https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"5734965869933055012","debug_reporting":true,"destination":"https://draussenfeet.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["687492117"],"4":["08-28"],"6":["true"]},"priority":"500","source_event_id":"1888465040357297121"}&andc=true
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
reactive_library_fy2021.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308240101/ 		154 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308240101/reactive_library_fy2021.js?bust=31077389
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308240101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-8898076423600352&plah=freedomheadlines.com&bust=31077389
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
08ffaa0817535bfde9794ff6ce557ff3fe5934a4583f7e91b159b4e44007d440
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:13 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
53640
x-xss-protection
0
server
cafe
etag
17908775576598122614
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Mon, 28 Aug 2023 17:06:13 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame DF5F
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
17 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=1338824485&adk=2385089580&adf=636453947&pi=t.ma~as.1338824485&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=318&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=1450&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=6bTkhJBiCn&p=https%3A//freedomheadlines.com&dtd=321
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:13 GMT
expires
Mon, 28 Aug 2023 17:06:13 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:13 GMT
location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
/
www.googleadservices.com/pagead/ar-adview/ Frame 380D
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/adview?ai=C6CLRBNTsZKumLsOGtwfOorywCsW_pYtx55-x5KoOv-EeEAEg-833lQFglYKAgKwHoAGVmOnHAsgBAqgDAcgDyQSqBLgCT9CKMKYFDVCdJSpkoS35qs7m_CF4sLuU8vGz1rKZ4ILOsDG-4HY...
  • https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229240836217993212486%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%2...
0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229240836217993212486%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22687492117%22],%224%22:[%2208-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%222142912527629721377%22}&andc=true
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H3
Server
216.58.206.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s07-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
x-content-type-options
nosniff
attribution-reporting-register-source
{"debug_key":"9240836217993212486","debug_reporting":true,"destination":"https://draussenfeet.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["687492117"],"4":["08-28"],"6":["true"]},"priority":"500","source_event_id":"2142912527629721377"}
server
cafe
content-type
text/css; charset=UTF-8
access-control-allow-origin
https://googleads.g.doubleclick.net
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
private
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Mon, 28 Aug 2023 17:06:14 GMT

Redirect headers

content-security-policy
script-src 'none'; object-src 'none'
date
Mon, 28 Aug 2023 17:06:13 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
location
https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"9240836217993212486","debug_reporting":true,"destination":"https://draussenfeet.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["687492117"],"4":["08-28"],"6":["true"]},"priority":"500","source_event_id":"2142912527629721377"}&andc=true
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
truncated
/ Frame 6818 		213 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2a06c91c4dad03d8ab3e1bcbef7785c7afcb9da42d50c336e615e65d2c23525f

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
image/png
iframe.html
p4-bxlpgat6ptlbc-24skbq56hefzhukm-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 9AEF 		5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://p4-bxlpgat6ptlbc-24skbq56hefzhukm-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html
Requested by
Host: p4-bxlpgat6ptlbc-24skbq56hefzhukm-if-v6exp3-v4.metric.gstatic.com
URL: https://p4-bxlpgat6ptlbc-24skbq56hefzhukm-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.67 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f3.1e100.net
Software
sffe /
Resource Hash
7b2c14d3f7df4f5372f0279886f89a76e521be5aea85af7050aa5b2bc2d9c41d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://p4-bxlpgat6ptlbc-24skbq56hefzhukm-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-encoding
gzip
content-length
1985
content-security-policy-report-only
script-src 'nonce-e0o46-8gFBGR26sd3uqqJQ' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:13 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
last-modified
Fri, 03 Feb 2023 22:38:00 GMT
pragma
no-cache
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
/
www.googleadservices.com/pagead/ar-adview/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%225734965869933055012%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22687492117%22],%224%22:[%2208-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%221888465040357297121%22}&andc=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.206.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s07-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
attribution-reporting-eligible
Access-Control-Request-Method
GET
Origin
https://googleads.g.doubleclick.net
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
attribution-reporting-eligible
access-control-allow-methods
POST, GET, OPTIONS
access-control-allow-origin
https://googleads.g.doubleclick.net
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/html; charset=UTF-8
date
Mon, 28 Aug 2023 17:06:14 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
embeds
syndication.twitter.com/i/jot/ Frame A9E0 		43 B
118 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://syndication.twitter.com/i/jot/embeds?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1693242373945%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22FCP%22%2C%22component%22%3A%22performance%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22horizon%22%2C%22client_version%22%3A%22aaf4084522e3a%3A1674595607486%22%2C%22dnt%22%3Atrue%2C%22widget_id%22%3A%22twitter-widget-0%22%2C%22widget_origin%22%3A%22https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22c9014b6146088%3A1692244862616%22%2C%22item_ids%22%3A%5B%221694099334516642113%22%5D%2C%22item_details%22%3A%7B%221694099334516642113%22%3A%7B%22item_type%22%3A0%7D%7D%2C%22duration_ms%22%3A1048.900001525879%7D&dnt=1
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.200 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

x-response-time
106
date
Mon, 28 Aug 2023 17:06:13 GMT
strict-transport-security
max-age=631138519
last-modified
Mon, 28 Aug 2023 17:06:14 GMT
server
tsa_o
vary
Origin
content-type
image/gif
x-transaction-id
910caaeadd4e1610
cache-control
must-revalidate, max-age=600
perf
7626143928
x-connection-hash
0448e32ac9dbd7e546aceb779f4f3280ec04ea6b1b595c36aaf4caa0eee3d7a6
content-length
43
PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
pagead2.googlesyndication.com/bg/ Frame BFB1 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9983601263&adk=3783032378&adf=3194834441&pi=t.ma~as.9983601263&w=800&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=800x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372484&bpp=2&bdt=320&idt=232&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=210&ady=228&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=iq91xKOlnJ&p=https%3A//freedomheadlines.com&dtd=238
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e48869d45889d8c1370161ac5b499cb02dc73c6bebefb8c487173010aabb78b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 11:26:16 GMT
content-encoding
br
x-content-type-options
nosniff
age
20397
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14710
x-xss-protection
0
last-modified
Tue, 22 Aug 2023 10:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 27 Aug 2024 11:26:16 GMT
/
www.googleadservices.com/pagead/ar-adview/ Frame 187D
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/adview?ai=C6vFeBNTsZJijMoPJtwecuor4AcW_pYtx55-x5KoOv-EeEAEg-833lQFglYKAgKwHoAGVmOnHAsgBAqgDAcgDyQSqBLgCT9B8SB5bj2j8gwwmiUnnSi19tpI9C4Rq_d1rOaanDuebEcZtca9...
  • https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%226049087037511669549%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%2...
0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%226049087037511669549%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22687492117%22],%224%22:[%2208-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2213558716057050218513%22}&andc=true
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H3
Server
216.58.206.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s07-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
x-content-type-options
nosniff
attribution-reporting-register-source
{"debug_key":"6049087037511669549","debug_reporting":true,"destination":"https://draussenfeet.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["687492117"],"4":["08-28"],"6":["true"]},"priority":"500","source_event_id":"13558716057050218513"}
server
cafe
content-type
text/css; charset=UTF-8
access-control-allow-origin
https://googleads.g.doubleclick.net
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
private
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Mon, 28 Aug 2023 17:06:14 GMT

Redirect headers

content-security-policy
script-src 'none'; object-src 'none'
date
Mon, 28 Aug 2023 17:06:14 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
location
https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"6049087037511669549","debug_reporting":true,"destination":"https://draussenfeet.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["687492117"],"4":["08-28"],"6":["true"]},"priority":"500","source_event_id":"13558716057050218513"}&andc=true
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
/
www.googleadservices.com/pagead/ar-adview/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229240836217993212486%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22687492117%22],%224%22:[%2208-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%222142912527629721377%22}&andc=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.206.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s07-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
attribution-reporting-eligible
Access-Control-Request-Method
GET
Origin
https://googleads.g.doubleclick.net
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
attribution-reporting-eligible
access-control-allow-methods
POST, GET, OPTIONS
access-control-allow-origin
https://googleads.g.doubleclick.net
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/html; charset=UTF-8
date
Mon, 28 Aug 2023 17:06:14 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
si
googleads.g.doubleclick.net/pagead/drt/ Frame 9EAC
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
17 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=2460334462&adk=1888080162&adf=1599616005&pi=t.ma~as.2460334462&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=400&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=2045&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=sIpVMAzNQf&p=https%3A//freedomheadlines.com&dtd=402
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:14 GMT
expires
Mon, 28 Aug 2023 17:06:14 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:13 GMT
location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
truncated
/ Frame 4653 		216 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a4782a2e1e045dc4cfa2ae2ebef6e381cf3b72bcbad624a37c79054ac33476e4

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
image/png
PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
pagead2.googlesyndication.com/bg/ Frame 410F 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=8095804527&adk=1256974889&adf=1803170222&pi=t.ma~as.8095804527&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=298&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=768&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=DtpwuWusDU&p=https%3A//freedomheadlines.com&dtd=300
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e48869d45889d8c1370161ac5b499cb02dc73c6bebefb8c487173010aabb78b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 11:26:16 GMT
content-encoding
br
x-content-type-options
nosniff
age
20397
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14710
x-xss-protection
0
last-modified
Tue, 22 Aug 2023 10:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 27 Aug 2024 11:26:16 GMT
css
fonts.googleapis.com/ 		69 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Archivo|Arimo|Bitter|EB+Garamond|Lato|Libre+Baskerville|Libre+Franklin|Lora|Google+Sans:regular,medium|Material+Icons|Google+Symbols|Merriweather|Montserrat|Mukta|Muli|Nunito|Open+Sans:400,600,700|Open+Sans+Condensed:300,400,600,700|Oswald|Playfair+Display|Poppins|Raleway|Roboto|Roboto+Condensed|Roboto+Slab|Slabo+27px|Source+Sans+Pro|Ubuntu|Volkhov&display=swap
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.de.EvMtrxLPw7M.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMwht9khWRhaNef-0OxhbzI7ZbGwAg/m=web_iab_tcf_v2_wall_executable
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
fdbe800cb201919c0d1fd1fdf03832e544f7b41678adfcdf9d5750660d0d5fdf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 28 Aug 2023 17:06:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 28 Aug 2023 17:06:14 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 28 Aug 2023 17:06:14 GMT
PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
pagead2.googlesyndication.com/bg/ Frame CA25 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=1338824485&adk=2385089580&adf=636453947&pi=t.ma~as.1338824485&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372486&bpp=1&bdt=322&idt=318&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=1450&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=6bTkhJBiCn&p=https%3A//freedomheadlines.com&dtd=321
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e48869d45889d8c1370161ac5b499cb02dc73c6bebefb8c487173010aabb78b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 11:26:16 GMT
content-encoding
br
x-content-type-options
nosniff
age
20398
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14710
x-xss-protection
0
last-modified
Tue, 22 Aug 2023 10:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 27 Aug 2024 11:26:16 GMT
/
www.googleadservices.com/pagead/ar-adview/ Frame 4653
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/adview?ai=C20iwBNTsZPSpO82ItwfT4rfoB_nGxZ1xvbHJ6akRv-EeEAEg-833lQFglYKAgKwHoAGVmOnHAsgBAqgDAcgDyQSqBLgCT9BCbLbw1XiO57xhmDu00dMjEd2ayAyKa_jXoiWeCOST0hLW_xm...
  • https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229173197325081411856%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%2...
0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229173197325081411856%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22687492117%22],%224%22:[%2208-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2211091382014766269441%22}&andc=true
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=7329517760&adk=1851110203&adf=1936646016&pi=t.ma~as.7329517760&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=438&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3203&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=a3jmjrX9MK&p=https%3A//freedomheadlines.com&dtd=440
Protocol
H3
Server
216.58.206.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s07-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
x-content-type-options
nosniff
attribution-reporting-register-source
{"debug_key":"9173197325081411856","debug_reporting":true,"destination":"https://draussenfeet.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["687492117"],"4":["08-28"],"6":["true"]},"priority":"500","source_event_id":"11091382014766269441"}
server
cafe
content-type
text/css; charset=UTF-8
access-control-allow-origin
https://googleads.g.doubleclick.net
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
private
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Mon, 28 Aug 2023 17:06:14 GMT

Redirect headers

content-security-policy
script-src 'none'; object-src 'none'
date
Mon, 28 Aug 2023 17:06:14 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
location
https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"9173197325081411856","debug_reporting":true,"destination":"https://draussenfeet.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["687492117"],"4":["08-28"],"6":["true"]},"priority":"500","source_event_id":"11091382014766269441"}&andc=true
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
si
googleads.g.doubleclick.net/pagead/drt/ Frame F801
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
17 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=7329517760&adk=1851110203&adf=1936646016&pi=t.ma~as.7329517760&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=438&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3203&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=a3jmjrX9MK&p=https%3A//freedomheadlines.com&dtd=440
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:14 GMT
expires
Mon, 28 Aug 2023 17:06:14 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:14 GMT
location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
tshow
api.whizzco.com/dtracking/v1/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.whizzco.com/dtracking/v1/tshow
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:e4::ac40:a50b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://freedomheadlines.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET, POST, HEAD, OPTIONS
access-control-allow-origin
https://freedomheadlines.com
access-control-max-age
1800
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7fde24c5f9ee9978-FRA
content-length
0
date
Mon, 28 Aug 2023 17:06:14 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=1,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Dq2L1ky%2BEcJ7385ZmznZP2OiPIWEsXXI8YDCaZKMO1uShALaK1JBOPCsBMQB80Tb7ITGmRab8s%2BGh2Hu3m%2FKCb0QTD9uIVT%2FEXtup4exPidh22eYSuO7v1rtbM%2FCTazxLdGZon43yMNzkvzVXag%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
0718ad3a-0b2c-415c-9131-c46be31a6dc2
player.ex.co/player/ 		613 KB
180 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.132 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e25fda010a8abe8a4743d78769ddf7d875b48b306ee4a9409bf03ac5f9aa29e4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 28 Aug 2023 17:06:14 GMT
via
1.1 varnish, 1.1 varnish
age
6435
x-cache
MISS, HIT
content-length
183267
x-served-by
cache-iad-kiad7000110-IAD, cache-fra-eddf8230058-FRA
server
nginx
x-timer
S1693242374.108718,VS0,VE3
etag
W/"992d9-XJl/PuTV1fbeGdkL5FnOeFx6IJs"
access-control-max-age
600
access-control-allow-methods
GET, POST, PUT, DELETE, PATCH
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
vary
Accept-Encoding, x-pb-country, x-pb-connection, x-pb-embedid, x-pb-itemid, x-pb-videoid, x-pb-player, x-pb-bot-name, x-pb-is-bot, x-pb-country, x-pb-connection, x-pb-embedid, x-pb-itemid, x-pb-videoid, x-pb-player, x-pb-bot-name, x-pb-is-bot
accept-ranges
bytes
access-control-allow-headers
Accept, Authorization, Content-Type
x-cache-hits
0, 1
tshow
api.whizzco.com/dtracking/v1/ 		15 B
451 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.whizzco.com/dtracking/v1/tshow
Requested by
Host: cdn.whizzco.com
URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:e4::ac40:a50b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d23d39a30bb7323f8ccfd64c52cf286138fba4f83e78f7edcf66703b7c23aaa

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-type
application/json; charset=UTF-8

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JtwsT0RlaT48aQDCO9hzmM6Gb6VvGXbsgOZXgPHBtLzfg8LIXhlq3IXVicxHlaxwiwaPUd0oItInNGpM524F%2FGzG32n%2FYeIZKNiaE7dmbz7alc5UoA4%2FD6MEkmeeu%2BivGyr8BFPBnBWCDDeKQs0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
https://freedomheadlines.com
access-control-allow-credentials
true
cf-ray
7fde24c72b7e9978-FRA
alt-svc
h3=":443"; ma=86400
content-length
15
priority
u=1,i
/
www.googleadservices.com/pagead/ar-adview/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%226049087037511669549%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22687492117%22],%224%22:[%2208-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2213558716057050218513%22}&andc=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.206.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s07-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
attribution-reporting-eligible
Access-Control-Request-Method
GET
Origin
https://googleads.g.doubleclick.net
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
attribution-reporting-eligible
access-control-allow-methods
POST, GET, OPTIONS
access-control-allow-origin
https://googleads.g.doubleclick.net
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/html; charset=UTF-8
date
Mon, 28 Aug 2023 17:06:14 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
fonts.gstatic.com/s/materialicons/v140/ 		125 KB
126 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/materialicons/v140/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://freedomheadlines.com/
Origin
https://freedomheadlines.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Fri, 25 Aug 2023 07:35:16 GMT
x-content-type-options
nosniff
age
293458
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
128352
x-xss-protection
0
last-modified
Tue, 07 Mar 2023 19:51:56 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 24 Aug 2024 07:35:16 GMT
AGSKWxWFqRn7GnVKtKWQniXVvN5QZP1zH5xJSN8JP8rYKe4F7wU6oEku-kgJKMi4rENpSnfKQoe4SAr05n_POp05cE0uc8FZ-gEqzBZnSZYJRT4PzwsRE8OPbA045et4u6kprb1OrGh6Iw==
fundingchoicesmessages.google.com/el/ 		0
28 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxWFqRn7GnVKtKWQniXVvN5QZP1zH5xJSN8JP8rYKe4F7wU6oEku-kgJKMi4rENpSnfKQoe4SAr05n_POp05cE0uc8FZ-gEqzBZnSZYJRT4PzwsRE8OPbA045et4u6kprb1OrGh6Iw==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.de.EvMtrxLPw7M.es5.O/d=1/rs=AJlcJMwht9khWRhaNef-0OxhbzI7ZbGwAg/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-El6PLQ7c6f_eJ0T5cmsosQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-El6PLQ7c6f_eJ0T5cmsosQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
access-control-allow-origin
https://freedomheadlines.com
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options
SAMEORIGIN
expires
Mon, 01 Jan 1990 00:00:00 GMT
/
trends.netizen.co/api/demand/ 		54 B
318 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://trends.netizen.co/api/demand/?w=170277&gdpr=1&gdpr_consent=undefined&us_privacy=1---&wlw=netizen.co
Requested by
Host: assets.netizen.co
URL: https://assets.netizen.co/master/delivery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.128.120.222 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-108-128-120-222.eu-west-1.compute.amazonaws.com
Software
envoy /
Resource Hash
47b726fd18aa3355c7f0277952419c5e1b33d3347ee2e4eff5e9b9be73040549
Security Headers
Name Value
Strict-Transport-Security max-age=931536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

x-rc-region
eu-west-1c
date
Mon, 28 Aug 2023 17:06:14 GMT
strict-transport-security
max-age=931536000; includeSubDomains
server
envoy
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://freedomheadlines.com
access-control-allow-credentials
true
x-envoy-upstream-service-time
2
content-length
54
sync
trends.netizen.co/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://trends.netizen.co/sync?gdpr=1&gdpr_consent=undefined&us_privacy=1---
Requested by
Host: assets.netizen.co
URL: https://assets.netizen.co/master/delivery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.128.120.222 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-108-128-120-222.eu-west-1.compute.amazonaws.com
Software
envoy /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

x-rc-region
eu-west-1c
access-control-allow-origin
https://freedomheadlines.com
date
Mon, 28 Aug 2023 17:06:14 GMT
access-control-allow-credentials
true
x-envoy-upstream-service-time
4
server
envoy
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
/
www.googleadservices.com/pagead/ar-adview/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229173197325081411856%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22687492117%22],%224%22:[%2208-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2211091382014766269441%22}&andc=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.206.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s07-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
attribution-reporting-eligible
Access-Control-Request-Method
GET
Origin
https://googleads.g.doubleclick.net
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
attribution-reporting-eligible
access-control-allow-methods
POST, GET, OPTIONS
access-control-allow-origin
https://googleads.g.doubleclick.net
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/html; charset=UTF-8
date
Mon, 28 Aug 2023 17:06:14 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
/
www.googleadservices.com/pagead/ar-adview/ Frame 6818
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/adview?ai=CkPBfBNTsZKqFOYiPtwfR1L6gCMW_pYtx55-x5KoOv-EeEAEg-833lQFglYKAgKwHoAGVmOnHAsgBAqgDAcgDyQSqBLgCT9CYJIw8oOUUTOPcCBYSYUfFl9WP1XD6POqvZh3esae3SVLaDFP...
  • https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%228194861747882031559%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%2...
0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%228194861747882031559%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22687492117%22],%224%22:[%2208-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2215115089796095446033%22}&andc=true
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H3
Server
216.58.206.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s07-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
x-content-type-options
nosniff
attribution-reporting-register-source
{"debug_key":"8194861747882031559","debug_reporting":true,"destination":"https://draussenfeet.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["687492117"],"4":["08-28"],"6":["true"]},"priority":"500","source_event_id":"15115089796095446033"}
server
cafe
content-type
text/css; charset=UTF-8
access-control-allow-origin
https://googleads.g.doubleclick.net
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
private
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Mon, 28 Aug 2023 17:06:14 GMT

Redirect headers

content-security-policy
script-src 'none'; object-src 'none'
date
Mon, 28 Aug 2023 17:06:14 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
location
https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"8194861747882031559","debug_reporting":true,"destination":"https://draussenfeet.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["687492117"],"4":["08-28"],"6":["true"]},"priority":"500","source_event_id":"15115089796095446033"}&andc=true
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
pagead2.googlesyndication.com/bg/ Frame C06E 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=2460334462&adk=1888080162&adf=1599616005&pi=t.ma~as.2460334462&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=400&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=2045&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=sIpVMAzNQf&p=https%3A//freedomheadlines.com&dtd=402
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e48869d45889d8c1370161ac5b499cb02dc73c6bebefb8c487173010aabb78b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 11:26:16 GMT
content-encoding
br
x-content-type-options
nosniff
age
20398
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14710
x-xss-protection
0
last-modified
Tue, 22 Aug 2023 10:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 27 Aug 2024 11:26:16 GMT
/
www.googleadservices.com/pagead/ar-adview/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%228194861747882031559%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22687492117%22],%224%22:[%2208-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2215115089796095446033%22}&andc=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.206.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s07-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
attribution-reporting-eligible
Access-Control-Request-Method
GET
Origin
https://googleads.g.doubleclick.net
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
attribution-reporting-eligible
access-control-allow-methods
POST, GET, OPTIONS
access-control-allow-origin
https://googleads.g.doubleclick.net
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/html; charset=UTF-8
date
Mon, 28 Aug 2023 17:06:14 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
16764504543501639038
tpc.googlesyndication.com/simgad/ Frame 411E 		41 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/16764504543501639038?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qlcmw7_fO4dptB0AhjMsgib4MnGaA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9572537723&adk=2027367073&adf=2444534581&pi=t.ma~as.9572537723&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=450&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D0b5b07eb8b8de6eb-22e69c165fde0065%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MZG9A1pc5vb0F5esQL9iZw22nOIKg&gpic=UID%3D00000c69a68e8849%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MY_LfWJZwfbjugP0UdrN1kslLFx7A&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3902&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=8GRgyAgS8H&p=https%3A//freedomheadlines.com&dtd=452
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
45aa38a592701233d92a89df66a60abecdedf9107be819b86775c1cd62e3abd1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Thu, 24 Aug 2023 03:13:44 GMT
x-content-type-options
nosniff
age
395550
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42039
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 08:08:51 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Fri, 23 Aug 2024 03:13:44 GMT
PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
pagead2.googlesyndication.com/bg/ Frame 78D8 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=7329517760&adk=1851110203&adf=1936646016&pi=t.ma~as.7329517760&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=438&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3203&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=a3jmjrX9MK&p=https%3A//freedomheadlines.com&dtd=440
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e48869d45889d8c1370161ac5b499cb02dc73c6bebefb8c487173010aabb78b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 11:26:16 GMT
content-encoding
br
x-content-type-options
nosniff
age
20398
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14710
x-xss-protection
0
last-modified
Tue, 22 Aug 2023 10:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 27 Aug 2024 11:26:16 GMT
versions
player.ex.co/ 		487 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://player.ex.co/versions
Requested by
Host: player.ex.co
URL: https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.132 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
dd24d493e315f56b0f3f3ab2b22d970a4b0aa465208bd6a5953a22e0b3d82eb5
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; includeSubDomains
via
1.1 varnish, 1.1 varnish
x-content-type-options
nosniff
date
Mon, 28 Aug 2023 17:06:14 GMT
age
27587
x-cache
MISS, HIT
content-length
487
x-served-by
cache-iad-kjyo7100158-IAD, cache-fra-eddf8230090-FRA
server
nginx
x-timer
S1693242374.388274,VS0,VE0
etag
W/"1e7-jULfTJssMAtxRUSPVQv9NyFBesg"
access-control-max-age
600
access-control-allow-methods
GET, POST, PUT, DELETE, PATCH
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
vary
x-pb-country, x-pb-connection, x-pb-embedid, x-pb-itemid, x-pb-videoid, x-pb-player, x-pb-bot-name, x-pb-is-bot, x-pb-country, x-pb-connection, x-pb-embedid, x-pb-itemid, x-pb-videoid, x-pb-player, x-pb-bot-name, x-pb-is-bot
accept-ranges
bytes
access-control-allow-headers
Accept, Authorization, Content-Type
x-cache-hits
0, 240
/
trends.netizen.co/api/delivery/ 		20 KB
11 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://trends.netizen.co/api/delivery/?is_blocked=undefined&w=170277&width=1600&gdpr=1&gdpr_consent=undefined&us_privacy=1---&rev_allow_cookies=0&site_url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&icr_url=&va=0&time=1693242374357&up=pc&bn=chrome&bv=116&widget_width=780&style_id=0&an=false
Requested by
Host: assets.netizen.co
URL: https://assets.netizen.co/master/delivery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.128.120.222 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-108-128-120-222.eu-west-1.compute.amazonaws.com
Software
envoy /
Resource Hash
d55d6977d61fa497ea39c025faa61a70af35d49ade52b3a8af137a066e9a5862
Security Headers
Name Value
Strict-Transport-Security max-age=931536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

x-rc-region
eu-west-1c
date
Mon, 28 Aug 2023 17:06:14 GMT
strict-transport-security
max-age=931536000; includeSubDomains
content-encoding
gzip
server
envoy
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://freedomheadlines.com
access-control-allow-credentials
true
x-envoy-upstream-service-time
57
abg_lite_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/ Frame 411E 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/abg_lite_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9572537723&adk=2027367073&adf=2444534581&pi=t.ma~as.9572537723&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=450&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D0b5b07eb8b8de6eb-22e69c165fde0065%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MZG9A1pc5vb0F5esQL9iZw22nOIKg&gpic=UID%3D00000c69a68e8849%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MY_LfWJZwfbjugP0UdrN1kslLFx7A&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3902&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=8GRgyAgS8H&p=https%3A//freedomheadlines.com&dtd=452
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1df629c9e3d7999c38bfa18b45032197fd4da30e8e893bf07f5083e1fa9b4390
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 03:15:28 GMT
content-encoding
br
x-content-type-options
nosniff
age
49846
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9067
x-xss-protection
0
server
cafe
etag
16184311534176170479
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 03:15:28 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame 30A6 		143 B
166 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9572537723&adk=2027367073&adf=2444534581&pi=t.ma~as.9572537723&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=450&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D0b5b07eb8b8de6eb-22e69c165fde0065%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MZG9A1pc5vb0F5esQL9iZw22nOIKg&gpic=UID%3D00000c69a68e8849%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MY_LfWJZwfbjugP0UdrN1kslLFx7A&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3902&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=8GRgyAgS8H&p=https%3A//freedomheadlines.com&dtd=452
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9572537723&adk=2027367073&adf=2444534581&pi=t.ma~as.9572537723&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=450&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D0b5b07eb8b8de6eb-22e69c165fde0065%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MZG9A1pc5vb0F5esQL9iZw22nOIKg&gpic=UID%3D00000c69a68e8849%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MY_LfWJZwfbjugP0UdrN1kslLFx7A&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3902&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=8GRgyAgS8H&p=https%3A//freedomheadlines.com&dtd=452
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
2551
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=3600
content-encoding
gzip
content-length
145
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 16:23:43 GMT
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 411E 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/window_focus_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9572537723&adk=2027367073&adf=2444534581&pi=t.ma~as.9572537723&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=450&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D0b5b07eb8b8de6eb-22e69c165fde0065%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MZG9A1pc5vb0F5esQL9iZw22nOIKg&gpic=UID%3D00000c69a68e8849%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MY_LfWJZwfbjugP0UdrN1kslLFx7A&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3902&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=8GRgyAgS8H&p=https%3A//freedomheadlines.com&dtd=452
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 11:35:05 GMT
content-encoding
br
x-content-type-options
nosniff
age
19869
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 11:35:05 GMT
transparent.png
tpc.googlesyndication.com/pagead/images/ Frame 411E 		67 B
91 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/transparent.png
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9572537723&adk=2027367073&adf=2444534581&pi=t.ma~as.9572537723&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=450&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D0b5b07eb8b8de6eb-22e69c165fde0065%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MZG9A1pc5vb0F5esQL9iZw22nOIKg&gpic=UID%3D00000c69a68e8849%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MY_LfWJZwfbjugP0UdrN1kslLFx7A&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3902&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=8GRgyAgS8H&p=https%3A//freedomheadlines.com&dtd=452
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 02:28:40 GMT
x-content-type-options
nosniff
server
cafe
age
52654
etag
2462972746714251406
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/png
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
67
x-xss-protection
0
expires
Tue, 29 Aug 2023 02:28:40 GMT
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 411E 		20 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9572537723&adk=2027367073&adf=2444534581&pi=t.ma~as.9572537723&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=450&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D0b5b07eb8b8de6eb-22e69c165fde0065%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MZG9A1pc5vb0F5esQL9iZw22nOIKg&gpic=UID%3D00000c69a68e8849%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MY_LfWJZwfbjugP0UdrN1kslLFx7A&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3902&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=8GRgyAgS8H&p=https%3A//freedomheadlines.com&dtd=452
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b1fe6456a4e2d8871862a70a1d1ad7dee8887643ee994ad850ee0a30072cfbd2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 03:15:26 GMT
content-encoding
br
x-content-type-options
nosniff
age
49848
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8273
x-xss-protection
0
server
cafe
etag
16365778639179992903
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 03:15:26 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 411E 		181 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9572537723&adk=2027367073&adf=2444534581&pi=t.ma~as.9572537723&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=450&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D0b5b07eb8b8de6eb-22e69c165fde0065%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MZG9A1pc5vb0F5esQL9iZw22nOIKg&gpic=UID%3D00000c69a68e8849%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MY_LfWJZwfbjugP0UdrN1kslLFx7A&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3902&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=8GRgyAgS8H&p=https%3A//freedomheadlines.com&dtd=452
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5e3e377390273cdcadaaa15956be20643d89765dfe7b62c363e9442a68bd4271
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57780
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1692792373905140"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 28 Aug 2023 17:06:14 GMT
one_click_handler_one_afma_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 411E 		35 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/one_click_handler_one_afma_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9572537723&adk=2027367073&adf=2444534581&pi=t.ma~as.9572537723&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=450&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D0b5b07eb8b8de6eb-22e69c165fde0065%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MZG9A1pc5vb0F5esQL9iZw22nOIKg&gpic=UID%3D00000c69a68e8849%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MY_LfWJZwfbjugP0UdrN1kslLFx7A&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3902&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=8GRgyAgS8H&p=https%3A//freedomheadlines.com&dtd=452
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
01e8be122ac87eb4686d3bdad82d7e241a721dd3381699cc71423626ee7d7a32
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 15:22:50 GMT
content-encoding
br
x-content-type-options
nosniff
age
6204
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14411
x-xss-protection
0
server
cafe
etag
4500582243027856586
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 11 Sep 2023 15:22:50 GMT
events
collector.ex.co/main/ 		17 B
155 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://collector.ex.co/main/events
Requested by
Host: player.ex.co
URL: https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.86.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-197-86-75.compute-1.amazonaws.com
Software
/
Resource Hash
cebe87559cf861d01e9c6b1cefd38ab1db9e13c8fe316b85a296b6cf220f883e

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Mon, 28 Aug 2023 17:06:14 GMT
etag
W/"11-MaL8I3MaqLPWbOrdrabTmSWS9PM"
content-length
17
content-type
application/json; charset=utf-8
css2
fonts.googleapis.com/ 		2 KB
585 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Roboto&display=swap
Requested by
Host: client
URL: about:client
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c87b7f745cfb4a994801488584e6e0e78d6c4f0ad567e985a781fc0b86074724
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 28 Aug 2023 17:06:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 28 Aug 2023 16:10:43 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 28 Aug 2023 17:06:14 GMT
impression
trends.netizen.co/event/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://trends.netizen.co/event/impression
Requested by
Host: assets.netizen.co
URL: https://assets.netizen.co/master/delivery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.128.120.222 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-108-128-120-222.eu-west-1.compute.amazonaws.com
Software
envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=931536000; includeSubDomains

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

x-rc-region
eu-west-1c
date
Mon, 28 Aug 2023 17:06:14 GMT
strict-transport-security
max-age=931536000; includeSubDomains
server
envoy
vary
Origin
access-control-allow-origin
https://freedomheadlines.com
access-control-allow-credentials
true
x-envoy-upstream-service-time
4
defaultWidget~feedWidget.delivery.js
assets.revcontent.com/master/ 		30 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.revcontent.com/master/defaultWidget~feedWidget.delivery.js
Requested by
Host: assets.netizen.co
URL: https://assets.netizen.co/master/delivery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
AmazonS3 /
Resource Hash
b4dada34875920e38c6e47a9094052c62bf803594d646189541f25a1e043c22c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
content-encoding
gzip
last-modified
Mon, 07 Aug 2023 16:52:58 GMT
server
AmazonS3
x-amz-request-id
D95PFWSJCY84A3KA
etag
"88f13f635aeac289e56e09d17ae4789e"
x-amz-server-side-encryption
AES256
x-hw
1693242374.cds229.fr8.hn,1693242374.cds154.fr8.c
content-type
text/javascript
access-control-allow-origin
*
cache-control
public,max-age=60
accept-ranges
bytes
content-length
8351
x-amz-id-2
L9cqJPr9RcaD57iv+UvNFAAdsxFaDR2uL2sTQPr4QPYa/8y0O6NM5O12CVcE16pvDaCkmJAs1zs=
defaultWidget.delivery.js
assets.revcontent.com/master/ 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.revcontent.com/master/defaultWidget.delivery.js
Requested by
Host: assets.netizen.co
URL: https://assets.netizen.co/master/delivery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
AmazonS3 /
Resource Hash
9c1aef310beaa7222f49b37ecc8423ce63d8887cc4b78da6db6665a700bfbfce

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
content-encoding
gzip
last-modified
Mon, 07 Aug 2023 16:52:58 GMT
server
AmazonS3
x-amz-request-id
D95J0XZVYGE63V50
etag
"1c0b96fb514edd484a8075e9bda98afc"
x-amz-server-side-encryption
AES256
x-hw
1693242374.cds229.fr8.hn,1693242374.cds280.fr8.c
content-type
text/javascript
access-control-allow-origin
*
cache-control
public,max-age=60
accept-ranges
bytes
content-length
6451
x-amz-id-2
C4JxBzaBTmIs6aSqL1jvpTvkDZ8TzfHMvDxUneZ5Efonqc5ht5rW5JCyAeNGoMYNeBARJU5msmVm5pZzFuYkGRlkuaN36dOalmfyyqYhNT4=
/
img.revcontent.com/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.revcontent.com/?url=https://cdn.revcontent.com/assets/img/full_color.png&static=true
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
/
Resource Hash
94d3b3f21c82e9004e1a95aba77f256573a3406d0782d451d50ac8e4bb4df7c5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
last-modified
Thu, 15 Sep 2022 11:58:32 GMT
etag
"1663243112"
x-hw
1693242374.cds160.fr8.hn,1693242374.cds203.fr8.c
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
content-length
1351
truncated
/ Frame 411E 		213 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3e5d854d0bb64955b7d26019c608ce975fe7f184f7bf7e4daec2756d56451c1

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
image/png
landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.webp
mcd.ex.co/video/upload/w_800,so_4/v1490095101/ 		14 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mcd.ex.co/video/upload/w_800,so_4/v1490095101/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.webp
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.56 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-56.deploy.static.akamaitechnologies.com
Software
cloudinary /
Resource Hash
06ebe1954427c09d4400e7e77e9c651b2eb3953e798ba97971d536f4bb398c89

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Mon, 28 Aug 2023 17:06:14 GMT
Cache-Tag
502941132783428480281542933415069772301,473281262405526930053610213462331028430,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Status
200 OK
Content-Disposition
inline; filename="landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.webp"
Connection
keep-alive
Content-Length
14352
X-Request-Id
be957367e584485bb9c398097153b4f7
X-Served-By
cache-lga21921-LGA
Last-Modified
Mon, 13 Feb 2023 08:42:01 GMT
Server
cloudinary
X-Timer
S1676277721.500283,VS0,VE446
ETag
"cea3d109186db580c1bb2c32d1905228"
Content-Type
image/webp
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=30109847
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
0
player.js
cdn.ex.co/player/ap/3.44.0-dc98e81/ 		441 KB
116 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ex.co/player/ap/3.44.0-dc98e81/player.js
Requested by
Host: player.ex.co
URL: https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.56 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-56.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
c396dfca1a8c20e7ba5236db5c59e7e7fbc7e56aaa7d2c17262f6d2ee464e65c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
content-encoding
gzip
x-amz-server-side-encryption
AES256
content-length
118800
last-modified
Sun, 27 Aug 2023 08:02:26 GMT
server
AmazonS3
etag
"d069531bb27e9157a82b23ad46fba771"
vary
Accept-Encoding
access-control-max-age
86400
access-control-allow-methods
GET,POST
access-control-allow-origin
*
content-type
application/javascript
cache-control
must-revalidate, proxy-revalidate, max-age=604800, s-maxage=31536000
access-control-allow-credentials
false
accept-ranges
bytes
access-control-allow-headers
*
expires
Mon, 04 Sep 2023 17:06:14 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame 30A6
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
17 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9572537723&adk=2027367073&adf=2444534581&pi=t.ma~as.9572537723&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=450&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D0b5b07eb8b8de6eb-22e69c165fde0065%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MZG9A1pc5vb0F5esQL9iZw22nOIKg&gpic=UID%3D00000c69a68e8849%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MY_LfWJZwfbjugP0UdrN1kslLFx7A&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3902&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=8GRgyAgS8H&p=https%3A//freedomheadlines.com&dtd=452
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:14 GMT
expires
Mon, 28 Aug 2023 17:06:14 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:14 GMT
location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
/
www.googleadservices.com/pagead/ar-adview/ Frame 411E
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/adview?ai=CSiJgBNTsZP_WO8_1twfLspWYA_nGxZ1xvbHJ6akRv-EeEAEg-833lQFglYKAgKwHoAGVmOnHAsgBAqgDAcgDyQSqBL4CT9C48vMjU0o1pOi821oKBEcggrflbKE5slCh4935G4royHaBxRt...
  • https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%22237003494481396863%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22...
0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%22237003494481396863%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22687492117%22],%224%22:[%2208-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%229628732740585557025%22}&andc=true
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9572537723&adk=2027367073&adf=2444534581&pi=t.ma~as.9572537723&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=450&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D0b5b07eb8b8de6eb-22e69c165fde0065%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MZG9A1pc5vb0F5esQL9iZw22nOIKg&gpic=UID%3D00000c69a68e8849%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MY_LfWJZwfbjugP0UdrN1kslLFx7A&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3902&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=8GRgyAgS8H&p=https%3A//freedomheadlines.com&dtd=452
Protocol
H3
Server
216.58.206.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s07-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
x-content-type-options
nosniff
attribution-reporting-register-source
{"debug_key":"237003494481396863","debug_reporting":true,"destination":"https://draussenfeet.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["687492117"],"4":["08-28"],"6":["true"]},"priority":"500","source_event_id":"9628732740585557025"}
server
cafe
content-type
text/css; charset=UTF-8
access-control-allow-origin
https://googleads.g.doubleclick.net
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
private
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Mon, 28 Aug 2023 17:06:14 GMT

Redirect headers

content-security-policy
script-src 'none'; object-src 'none'
date
Mon, 28 Aug 2023 17:06:14 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
location
https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"237003494481396863","debug_reporting":true,"destination":"https://draussenfeet.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["687492117"],"4":["08-28"],"6":["true"]},"priority":"500","source_event_id":"9628732740585557025"}&andc=true
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
/
www.googleadservices.com/pagead/ar-adview/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%22237003494481396863%22,%22debug_reporting%22:true,%22destination%22:%22https://draussenfeet.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22687492117%22],%224%22:[%2208-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%229628732740585557025%22}&andc=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.206.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s07-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
attribution-reporting-eligible
Access-Control-Request-Method
GET
Origin
https://googleads.g.doubleclick.net
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
attribution-reporting-eligible
access-control-allow-methods
POST, GET, OPTIONS
access-control-allow-origin
https://googleads.g.doubleclick.net
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/html; charset=UTF-8
date
Mon, 28 Aug 2023 17:06:14 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
pagead2.googlesyndication.com/bg/ Frame 9883 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8898076423600352&output=html&h=280&slotname=9572537723&adk=2027367073&adf=2444534581&pi=t.ma~as.9572537723&w=780&fwrn=4&fwrnh=100&lmt=1693235172&rafmt=1&format=780x280&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1693242372487&bpp=1&bdt=323&idt=450&shv=r20230823&mjsv=m202308240101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D0b5b07eb8b8de6eb-22e69c165fde0065%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MZG9A1pc5vb0F5esQL9iZw22nOIKg&gpic=UID%3D00000c69a68e8849%3AT%3D1693242372%3ART%3D1693242372%3AS%3DALNI_MY_LfWJZwfbjugP0UdrN1kslLFx7A&prev_fmts=0x0%2C800x280%2C780x280%2C780x280%2C780x280%2C780x280&nras=1&correlator=3401048158439&frm=20&pv=1&ga_vid=723900094.1693242373&ga_sid=1693242373&ga_hid=297901698&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=220&ady=3902&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31076838%2C31076997%2C31077389&oid=2&pvsid=4273839161069477&tmod=311014887&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=8GRgyAgS8H&p=https%3A//freedomheadlines.com&dtd=452
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e48869d45889d8c1370161ac5b499cb02dc73c6bebefb8c487173010aabb78b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 11:26:16 GMT
content-encoding
br
x-content-type-options
nosniff
age
20398
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14710
x-xss-protection
0
last-modified
Tue, 22 Aug 2023 10:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 27 Aug 2024 11:26:16 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 380D 		42 B
174 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstV1DwL92luTZXG5z5FXT4JppsvVb7NjsBdDGAzw_m0uBj6mn-QSocRMZEB-MVwoIbRsyeAIO35R4xrVkJUGLIfi924yfikG3X0g_SwASkM8kOS8Pe-D8jRym-PbUpRBf2FFTBp84Mz37kF&sai=AMfl-YR8b1IBOtVcmrh66iyLUwMzDgDpX-m8WiJ6_KQPmK8rV_MoBDbrILAH_SGN88qn2nTsYr2WciYDxtjZ&sig=Cg0ArKJSzE1i-9GhdyreEAE&cid=CAQSGwBpAlJWbRESGxMBc9BLUHmSrXNXJw3QadCBtBgB&id=lidar2&mcvt=1000&p=0,190,280,610&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230823&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=4&adk=3783032378&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1693242372724&rpt=922&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Aug 2023 17:06:14 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
63c6a3bfd15776-05990272.png
images.netizen.co/image/fetch/f_jpg,q_50,h_315,w_420,c_fill,g_faces:auto/pg_1/https://media.netizen.co/content/images/ 		11 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.netizen.co/image/fetch/f_jpg,q_50,h_315,w_420,c_fill,g_faces:auto/pg_1/https://media.netizen.co/content/images/63c6a3bfd15776-05990272.png
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
cloudflare /
Resource Hash
1712db2ac9948f052b629d35a83530960b4f24075b69c2a8b3f7323697f20235
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
strict-transport-security
max-age=604800
x-content-type-options
nosniff
server-timing
cld-cloudflare;dur=123;start=2023-06-08T15:33:10.459Z;desc=miss,rtt;dur=1;cloudinary;dur=21;start=2023-06-08T15:33:10.515Z
content-length
11699
last-modified
Thu, 08 Jun 2023 15:30:40 GMT
server
cloudflare
etag
"fba682e55e5aa4ce3c38c5e14920b5b2"
x-hw
1693242374.cds328.fr8.hn,1693242374.cds327.fr8.c
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control
public, no-transform, immutable, max-age=604800
accept-ranges
bytes
cf-ray
7d4231145df4383d-FRA
timing-allow-origin
*
be31ef9e6628d10925e2a15592de1560.jpg
images.netizen.co/image/fetch/f_jpg,q_50,h_315,w_420,c_fill,g_faces:auto/pg_1/https://media.netizen.co/content/images/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.netizen.co/image/fetch/f_jpg,q_50,h_315,w_420,c_fill,g_faces:auto/pg_1/https://media.netizen.co/content/images/be31ef9e6628d10925e2a15592de1560.jpg
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
cloudflare /
Resource Hash
443732f9e2f617d668461066fc34290077c7db1f4eefaa857f5442997d3a7720
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
strict-transport-security
max-age=604800
x-content-type-options
nosniff
server-timing
cld-cloudflare;dur=133;start=2023-07-17T12:40:40.531Z;desc=miss,rtt;dur=1;cloudinary;dur=30;start=2023-07-17T12:40:40.595Z
content-length
15010
last-modified
Mon, 17 Jul 2023 12:13:12 GMT
server
cloudflare
etag
"e3c4abe825f1b36304e3d23bfc90a68e"
x-hw
1693242374.cds328.fr8.hn,1693242374.cds286.fr8.c
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control
public, no-transform, immutable, max-age=604800
accept-ranges
bytes
cf-ray
7e828e0548df3656-FRA
timing-allow-origin
*
63bfdaa469ff29e345fed0ca81c1ad9f.jpg
images.netizen.co/image/fetch/f_jpg,q_50,h_315,w_420,c_fill,g_faces:auto/pg_1/https://media.netizen.co/content/images/ 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.netizen.co/image/fetch/f_jpg,q_50,h_315,w_420,c_fill,g_faces:auto/pg_1/https://media.netizen.co/content/images/63bfdaa469ff29e345fed0ca81c1ad9f.jpg
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
Cloudinary /
Resource Hash
aea963092fe9ff354e03b09343804e2129d4dd8087bbe07262ffcf5b5d4bf1bb
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
strict-transport-security
max-age=604800
x-content-type-options
nosniff
last-modified
Thu, 06 Jul 2023 00:13:11 GMT
server
Cloudinary
etag
"5044dd629564e57a47e778ee53680c6e"
x-hw
1693242374.cds328.fr8.hn,1693242374.cds206.fr8.c
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length,ETag,Server-Timing,X-Content-Type-Options
cache-control
public, no-transform, immutable, max-age=604800
server-timing
cld-fastly;mitm=po;dur=455;cpu=0;start=2023-07-06T01:21:27.847Z;desc=miss,rtt;dur=0,cloudinary;dur=56;start=2023-07-06T01:21:28.195Z
accept-ranges
bytes
timing-allow-origin
*
content-length
19070
64e41afb677c06-21756722.png
images.netizen.co/image/fetch/f_jpg,q_50,h_315,w_420,c_fill,g_faces:auto/pg_1/https://media.netizen.co/content/images/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.netizen.co/image/fetch/f_jpg,q_50,h_315,w_420,c_fill,g_faces:auto/pg_1/https://media.netizen.co/content/images/64e41afb677c06-21756722.png
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
Cloudinary /
Resource Hash
57cdde951861531f986d9b083e1f90508e6717ceb8211130fd5e56851de4719e
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
strict-transport-security
max-age=604800
x-content-type-options
nosniff
last-modified
Tue, 22 Aug 2023 04:23:49 GMT
server
Cloudinary
etag
"9bb1b36799e3514f52baf47a55494499"
x-hw
1693242374.cds328.fr8.hn,1693242374.cds322.fr8.c
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length,ETag,Server-Timing,X-Content-Type-Options
cache-control
public, no-transform, immutable, max-age=604800
server-timing
cld-fastly;mitm=po;dur=388;cpu=0;start=2023-08-22T05:29:56.003Z;desc=miss,rtt;dur=0,content-info;desc="width=420,height=315,owidth=900,oheight=672,obytes=113846",cloudinary;dur=32;start=2023-08-22T05:29:56.315Z
accept-ranges
bytes
timing-allow-origin
*
content-length
10875
642fd50a5e1300-28392641.png
images.netizen.co/image/fetch/f_jpg,q_50,h_315,w_420,c_fill,g_faces:auto/pg_1/https://media.netizen.co/content/images/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.netizen.co/image/fetch/f_jpg,q_50,h_315,w_420,c_fill,g_faces:auto/pg_1/https://media.netizen.co/content/images/642fd50a5e1300-28392641.png
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
Cloudinary /
Resource Hash
b7e9da21926bd362d9545fb8e28279f21c2f752cbcf66c6f88c1b4d6ac7f0069
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
strict-transport-security
max-age=604800
x-content-type-options
nosniff
server-timing
cld-fastly;mitm=po;dur=413;cpu=0;start=2023-06-08T16:31:39.984Z;desc=miss,rtt;dur=3,cloudinary;dur=314;start=2023-06-08T16:31:40.031Z,cld-id;desc=af0a319841f9565c2bb5f02101702eb4
content-length
16325
x-request-id
af0a319841f9565c2bb5f02101702eb4
last-modified
Fri, 07 Apr 2023 21:17:23 GMT
server
Cloudinary
etag
"b93f3970c157ff5d08b6f8e6080539b0"
x-hw
1693242374.cds328.fr8.hn,1693242374.cds253.fr8.c
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length,ETag,Server-Timing,X-Content-Type-Options
cache-control
public, no-transform, immutable, max-age=604800
accept-ranges
bytes
timing-allow-origin
*
774d6f62f96e821f1bb86213f9884132.jpg
images.netizen.co/image/fetch/f_jpg,q_50,h_315,w_420,c_fill,g_faces:auto/pg_1/https://media.netizen.co/content/images/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.netizen.co/image/fetch/f_jpg,q_50,h_315,w_420,c_fill,g_faces:auto/pg_1/https://media.netizen.co/content/images/774d6f62f96e821f1bb86213f9884132.jpg
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
Cloudinary /
Resource Hash
6343a6c6155e4549384af0a8b706653047b06eda90e7b2e09892c3d81b19cdaf
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
strict-transport-security
max-age=604800
x-content-type-options
nosniff
last-modified
Sun, 02 Jul 2023 11:45:14 GMT
server
Cloudinary
etag
"e97feb36bfb7dc1a8655b8d13431ddbe"
x-hw
1693242374.cds328.fr8.hn,1693242374.cds158.fr8.c
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length,ETag,Server-Timing,X-Content-Type-Options
cache-control
public, no-transform, immutable, max-age=604800
server-timing
cld-fastly;mitm=po;dur=111;cpu=0;start=2023-07-02T11:45:52.057Z;desc=miss,rtt;dur=0,cloudinary;dur=20;start=2023-07-02T11:45:52.103Z
accept-ranges
bytes
timing-allow-origin
*
content-length
13083
19cfae497c56e1adfb6fb564a12a9931.jpg
images.netizen.co/image/fetch/f_jpg,q_50,h_315,w_420,c_fill,g_faces:auto/pg_1/https://media.netizen.co/content/images/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.netizen.co/image/fetch/f_jpg,q_50,h_315,w_420,c_fill,g_faces:auto/pg_1/https://media.netizen.co/content/images/19cfae497c56e1adfb6fb564a12a9931.jpg
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
Cloudinary /
Resource Hash
5c634dd1fc77cf6b82fb34c3571b108f843ee143edbb450d30b4eac843b12a59
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
strict-transport-security
max-age=604800
x-content-type-options
nosniff
last-modified
Fri, 23 Jun 2023 15:11:40 GMT
server
Cloudinary
etag
"c40bda43abe28c2d13df01ef0482df96"
x-hw
1693242374.cds328.fr8.hn,1693242374.cds215.fr8.c
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length,ETag,Server-Timing,X-Content-Type-Options
cache-control
public, no-transform, immutable, max-age=604800
server-timing
cld-fastly;mitm=po;dur=110;cpu=0;start=2023-06-23T15:13:17.302Z;desc=miss,rtt;dur=0,cloudinary;dur=17;start=2023-06-23T15:13:17.342Z
accept-ranges
bytes
timing-allow-origin
*
content-length
9552
91c889e3363a84ec0e4ac5cb4ef5c518.jpg
images.netizen.co/image/fetch/f_jpg,q_50,h_315,w_420,c_fill,g_faces:auto/pg_1/https://media.netizen.co/content/images/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.netizen.co/image/fetch/f_jpg,q_50,h_315,w_420,c_fill,g_faces:auto/pg_1/https://media.netizen.co/content/images/91c889e3363a84ec0e4ac5cb4ef5c518.jpg
Requested by
Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
cloudflare /
Resource Hash
f724f399b193e3b199cb52a6ce3071b64bb16e6bb85a83a0d1d1e33f49d67ccb
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:14 GMT
strict-transport-security
max-age=604800
x-content-type-options
nosniff
server-timing
cld-cloudflare;dur=598;start=2023-07-11T10:14:12.108Z;desc=miss,rtt;dur=1;cloudinary;dur=484;start=2023-07-11T10:14:12.167Z,cld-id;desc=969f57e592f58b470fc6eb89238d091f
content-length
10724
x-request-id
969f57e592f58b470fc6eb89238d091f
last-modified
Tue, 11 Jul 2023 10:13:26 GMT
server
cloudflare
etag
"ec188dddab5bc15e852b54584f1064e6"
x-hw
1693242374.cds328.fr8.hn,1693242374.cds130.fr8.c
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control
public, no-transform, immutable, max-age=604800
accept-ranges
bytes
cf-ray
7e504735ab9e1e10-FRA
timing-allow-origin
*
activeview
pagead2.googlesyndication.com/pcs/ Frame 187D 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstPG7Oawel1bi_5NMJRCxIlWmQxfoVxwHe5pjb8_u7szGGRts7aUTJwyk0fraIwtL08hmby35smaEl7DmBpNCzM-MQO5RDAXYkRJuy0KI4GgaidGKXuQUT90Wzt0G6fsCw8qmcLKbQxAEeB&sai=AMfl-YRdWF5sabmXsYrIRFadyHsKvztlqu_fpLxmiKVhmHyxaEEy1HophmbkIK7WqIov_PtIUDoWYkPLlzEn&sig=Cg0ArKJSzC5QcEQ6RME3EAE&cid=CAQSGwBpAlJW__cYjTMMkItj_BaRhyCw7DG8R-7SrhgB&id=lidar2&mcvt=1000&p=0,180,280,600&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230823&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=4&adk=1256974889&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1693242372790&rpt=1009&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Aug 2023 17:06:14 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
events
collector.ex.co/main/ 		17 B
154 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://collector.ex.co/main/events
Requested by
Host: player.ex.co
URL: https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.86.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-197-86-75.compute-1.amazonaws.com
Software
/
Resource Hash
cebe87559cf861d01e9c6b1cefd38ab1db9e13c8fe316b85a296b6cf220f883e

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Mon, 28 Aug 2023 17:06:15 GMT
etag
W/"11-MaL8I3MaqLPWbOrdrabTmSWS9PM"
content-length
17
content-type
application/json; charset=utf-8
player.js
p.channelexco.com/player/ 		10 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://p.channelexco.com/player/player.js?pv=117.59&p=779297768&cb=bf70cb1d-e78e-4987-baf4-26b9c0037ef6&d=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&schain=1.0,1!playbuzz.com,0010J00002G2BxCQAV,1,,,freedomheadlines.com&w=780&h=438.8&asr=1&impDetail=1&auction=1&auctionFast=5&publisherType=publisher&gdpr=-GPV_GDPR-&gdpr_consent=-GPV_GDPR_CONSENT-&us_privacy=-GPV_US_PRIVACY-&rv=true&sid=&sid2=default&sid4=3.44.0-dc98e81&utm_source=sparkpost&utm_medium=email&utm_campaign=regular
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/3.44.0-dc98e81/player.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.244.91.229 Brentwood, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
openresty /
Resource Hash
8642f4a4f9e94674f4d2f3a1858df3afa04dabcee6a25a0a755fee4a1f885ad3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-type
application/x-javascript
date
Mon, 28 Aug 2023 17:06:15 GMT
cache-control
no-cache
content-encoding
gzip
server
openresty
vary
Accept-Encoding
expires
Mon, 28 Aug 2023 17:06:14 GMT
d
gpv.ex.co/player/ 		2 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://gpv.ex.co/player/d?v=2&b={%22pageLoadUid%22:%22d018fb9a-e4dc-4f9e-acdb%C4%98e742784%C4%9550%22,%22country%C4%8D%22DE%C4%B2%22browser%C4%BCch%C5%83me%C5%80os%C4%BCwind%C5%84%C5%91%C4%B3networkI%C4%8C%C4%8E%C4%9241615463%C5%80hu%C4%8D%C4%B9ue%C4%B3p%C4%BC77929%C5%B768%C5%80%C5%A2%22https://free%C5%96mhe%C4%88l%C5%94es.%C4%B5m%C6%89%C6%8B%C6%8Dom-%C5%93%C6%8B%C6%89%C5%9E%C5%8Dr-ma%C6%A5%C4%97l%C4%83o%C4%98mploy%C6%8C-f%C6%93%C6%85-on-%C5%B1%C6%AF/%C5%80u%C5%86r%C5%A1%C4%BCx7n2d25pn8a3mqnv%22}
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/3.44.0-dc98e81/player.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.194.83.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-194-83-231.compute-1.amazonaws.com
Software
/
Resource Hash
2760bf445780ccedb7b5eadaf68ee54b477220892c05a5d979b228b38d485d81
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:15 GMT
strict-transport-security
max-age=15552000; includeSubDomains
x-content-type-options
nosniff
etag
W/"697-kalANb6JRD9xplL4sVbIow"
access-control-max-age
600
access-control-allow-methods
GET, POST, PUT, DELETE, PATCH
content-type
text/plain; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Accept, Authorization, Content-Type
content-length
1687
page-view
yeet.revcontent.com/yeet/events/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://yeet.revcontent.com/yeet/events/page-view
Requested by
Host: assets.netizen.co
URL: https://assets.netizen.co/master/delivery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.203.210.121 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-203-210-121.eu-west-1.compute.amazonaws.com
Software
envoy /
Resource Hash

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type
application/json

Response headers

x-rc-region
eu-west-1c
access-control-allow-origin
https://freedomheadlines.com
date
Mon, 28 Aug 2023 17:06:15 GMT
access-control-allow-credentials
true
x-envoy-upstream-service-time
2
server
envoy
vary
Origin
widget-loaded
yeet.revcontent.com/yeet/events/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://yeet.revcontent.com/yeet/events/widget-loaded
Requested by
Host: assets.netizen.co
URL: https://assets.netizen.co/master/delivery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.203.210.121 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-203-210-121.eu-west-1.compute.amazonaws.com
Software
envoy /
Resource Hash

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type
application/json

Response headers

x-rc-region
eu-west-1c
access-control-allow-origin
https://freedomheadlines.com
date
Mon, 28 Aug 2023 17:06:15 GMT
access-control-allow-credentials
true
x-envoy-upstream-service-time
2
server
envoy
vary
Origin
page-view
yeet.revcontent.com/yeet/events/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://yeet.revcontent.com/yeet/events/page-view
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.203.210.121 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-203-210-121.eu-west-1.compute.amazonaws.com
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://freedomheadlines.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type
access-control-allow-methods
POST
access-control-allow-origin
https://freedomheadlines.com
content-length
0
date
Mon, 28 Aug 2023 17:06:15 GMT
server
envoy
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-envoy-upstream-service-time
9
x-rc-region
eu-west-1c
widget-loaded
yeet.revcontent.com/yeet/events/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://yeet.revcontent.com/yeet/events/widget-loaded
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.203.210.121 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-203-210-121.eu-west-1.compute.amazonaws.com
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://freedomheadlines.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type
access-control-allow-methods
POST
access-control-allow-origin
https://freedomheadlines.com
content-length
0
date
Mon, 28 Aug 2023 17:06:15 GMT
server
envoy
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-envoy-upstream-service-time
2
x-rc-region
eu-west-1c
sodar
pagead2.googlesyndication.com/getconfig/ 		15 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230823&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308240101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-8898076423600352&plah=freedomheadlines.com&bust=31077389
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6594b15832f028e2a4f49b695a9718527d2b21b52839c91939e68a3d0ece2a0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:15 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11710
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308240101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-8898076423600352&plah=freedomheadlines.com&bust=31077389
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 28 Aug 2023 17:06:15 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 4986 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://freedomheadlines.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
4913
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 15:44:22 GMT
expires
Tue, 27 Aug 2024 15:44:22 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame DF8E 		829 B
560 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
53774a6527d7c6d1778f1d7416b8571c70ebfd0a976206e16a07bde9d2ec6171
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-wivTLxxHBXu3gHl7URm49A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://freedomheadlines.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-length
538
content-security-policy
script-src 'report-sample' 'nonce-wivTLxxHBXu3gHl7URm49A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Mon, 28 Aug 2023 17:06:15 GMT
expires
Mon, 28 Aug 2023 17:06:15 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
pagead2.googlesyndication.com/bg/ Frame 4986 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/PkiGnUWInYwTcBYaxbSZywLcc8a-vvuMSHFzAQqrt4s.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e48869d45889d8c1370161ac5b499cb02dc73c6bebefb8c487173010aabb78b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 11:26:16 GMT
content-encoding
br
x-content-type-options
nosniff
age
20399
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14710
x-xss-protection
0
last-modified
Tue, 22 Aug 2023 10:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 27 Aug 2024 11:26:16 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame DF8E 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230823&jk=4273839161069477&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers
starti
s-12.channelexco.com/ppx/ 		0
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s-12.channelexco.com/ppx/starti?sid=&domain=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fformer-mar-a-lago-employee-flips-on-trump%2F&se=00d3257f-0697-41bd-a26b-9116b2e36dea&pv=117.59&dd=freedomheadlines.com&gpvck=v022822070__780x438______DEF__nil__431&sa=shd&s=0.0&p=779297768&cb=1693242375581
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.244.91.229 Brentwood, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
openresty /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Aug 2023 17:06:15 GMT
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
server
openresty
generate_204
tpc.googlesyndication.com/ Frame 4986 		0
10 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?ra8GkA
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:15 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
sodar
pagead2.googlesyndication.com/pagead/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230823&jk=4273839161069477&bg=!JySlJGvNAAYkVgHwBFY7ADQBe5WfOAo_1gcUNWFonKwx3mgO9p4UNHXGlDhg-iMrFiNfjIOZ6-IACmzqryFrqx7ZV7tBAgAAAGVSAAAABWgBB5kCu6-n1lHTsrfFmQ69KmZUd1j1xV7ZTDzvgZVYs713FAzUEgo_trCPRbQdosh4yxZiUkWmRQ_JKUykVSc4aT8WM2lUWolmsrpO8UMIJ367ZU5OFDdlKaPTelq5c0VPxQTYtZpcXcACpLhM6WPxmM7hkinOoM3Xba-PouZcQDCwiamoIajOY5g6996beWJ3NITySUkxF8J_kS-rXKBdHMItH533Z4rzdKbh5icsOytxg42FAw5UVY6TZ2Px1iONm5JsX3JtDGpf7bDWh7_7Be2_KxMuiizN-9i4slbEPfxRgZbeJPaMcMTODrkLVF16nj11-PQLwjuqGaswXHHgGoYVF0jhNJ3ODSB-gdufI_br74fds2S-gS5rxUFvSI_dmdMNnZq_SXQUBHoAkE1KtJhd55KFhmN8g1fvsD2LO_ANGCUgU8o44VNhg3aS9lBlDdjC-IbKs5uWIOGZr5N-IltWTCDFqCNXGbu2dhIgwGgFv6lDYT4XIYMvbky-K6dEwtxXPEb9F1-J5d_Oxk1rF06PgmWCBSku4wHKLDlGILaItrrkzp8WGVtuUPj0If5OtQO38jdMgg7bLhPZSiwhBALDDdB3PUuBAVy8RPE5yvHJiEf9DvKfphfN3BHXSjuMFADdYRT1vWbgxLWUQIB6yzr5L6vVc8oFH9tTr0IZqMU1xd_eR_hZCSBFZ4bQVYvq_K_5nWJPtga63YWOfByaTpHdqW9YtP7NRcXFULIPuY_ZeEsGMleJ1DFpHVR3SqgW8PpJxpxPWPOhhnvbqdnu88hPFfIaz2zWKRfxUzx6s-DnB1ciYsNzKi0DLzphtzNIq5CSClNRDWvmojFqwuIyAWDsPNG8TfRKLOnQyZi09rB9-eJWRDgACYkomowgC9Zwr1KsQMUUjjQnJJDg7TY9I389TJU9DDFS5rPfjzL7WQ
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers
hls.min.js
cdn.ex.co/player/hls/1.4.10/ 		366 KB
109 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ex.co/player/hls/1.4.10/hls.min.js
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/3.44.0-dc98e81/player.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.56 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-56.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
cd2f57bd8668c0222e299540b077e8d4f4ada840976122e421bbccd57af420c1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:16 GMT
content-encoding
gzip
x-amz-server-side-encryption
AES256
content-length
110879
last-modified
Fri, 11 Aug 2023 11:21:01 GMT
server
AmazonS3
etag
"5b21ed48bf6304c54c514e774835f187"
vary
Accept-Encoding
access-control-max-age
86400
access-control-allow-methods
GET,POST
access-control-allow-origin
*
content-type
application/javascript
cache-control
max-age=604800
access-control-allow-credentials
false
accept-ranges
bytes
access-control-allow-headers
*
expires
Mon, 04 Sep 2023 17:06:16 GMT
ac
www9.smartadserver.com/
Redirect Chain
  • https://www9.smartadserver.com/ac?siteid=215340&pgid=1352541&fmtid=63953&ab=1&tgt=&oc=1&out=vast4&ps=1&pb=0&visit=S&vcn=s&tmstp=1693242376593&pgdomain=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-w...
  • https://www9.smartadserver.com/ac?siteid=215340&pgid=1352541&fmtid=63953&ab=1&tgt=&oc=1&out=vast4&ps=1&pb=0&visit=S&vcn=s&tmstp=1693242376593&pgdomain=https%3a%2f%2ffreedomheadlines.com%2ffreedom-w...
129 B
532 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www9.smartadserver.com/ac?siteid=215340&pgid=1352541&fmtid=63953&ab=1&tgt=&oc=1&out=vast4&ps=1&pb=0&visit=S&vcn=s&tmstp=1693242376593&pgdomain=https%3a%2f%2ffreedomheadlines.com%2ffreedom-wire%2fformer-mar-a-lago-employee-flips-on-trump%2f&vph=438&vpw=780&gdpr_consent=&us_privacy=&schain=1.0%2c1!playbuzz.com%2c0010J00002G2BxCQAV%2c1%2c%2c%2cfreedomheadlines.com&gdpr=1&cklb=1
Protocol
HTTP/1.1
Server
217.182.178.224 Paris, France, ASN16276 (OVH, FR),
Reverse DNS
ip224.ip-217-182-178.eu
Software
/
Resource Hash
41d511bcd8511da9cb1f673d030c44fbadb09271c96e4fbb40bfa306572dcca3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Aug 2023 17:06:16 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
text/xml; charset=UTF-8
access-control-allow-origin
https://freedomheadlines.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true

Redirect headers

pragma
no-cache
date
Mon, 28 Aug 2023 17:06:15 GMT
vary
Origin
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin
https://freedomheadlines.com
location
https://www9.smartadserver.com/ac?siteid=215340&pgid=1352541&fmtid=63953&ab=1&tgt=&oc=1&out=vast4&ps=1&pb=0&visit=S&vcn=s&tmstp=1693242376593&pgdomain=https%3a%2f%2ffreedomheadlines.com%2ffreedom-wire%2fformer-mar-a-lago-employee-flips-on-trump%2f&vph=438&vpw=780&gdpr_consent=&us_privacy=&schain=1.0%2c1!playbuzz.com%2c0010J00002G2BxCQAV%2c1%2c%2c%2cfreedomheadlines.com&gdpr=1&cklb=1
cache-control
no-cache,no-store
access-control-allow-credentials
true
content-length
0
rtb_vast_proxy
p.channelexco.com/ 		60 B
440 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://p.channelexco.com/rtb_vast_proxy?ap=IH4wWG9VNCA7JyhPeUIrKxWb9UPA2eePhJxPGspyhYQqXfzv66K4nabseNxV-Mi7GF-4sNZVSldqJDx8CNOp9WFMH_3JnlxR3xDkYy2P7F2361Li9vFFncFBRkQ1NFhq0K77J-Igb1aET2Qhk6gnJLQFvC2onawyQZWksnR30VnB9CBo_Dm7Xef2NUGqxxLEy7oFL1sFENk0RnydiTha1o-lsdxbRravNMqayN3d6igbpn1my3swKcZgj8EFK6RNiUNIT4pYcW7A4r1DISSBnmerAY8K8w7hF3TuaHiafdB75TmjqAPxJ38gs-YxzztlBwlrkgop57SMvI6BACzSzoXyqrGbuM4L_JKzzN4hXqI4tpCj1Dqbv_3Ylm7A0TNXVj7yjNvnTOWjh0JCHmRf8xetr0ZhLnjakMtR1lTpKJCu2KOnCBmxruxAG1Twok2guVOO7i76Pxs3gZAv-o7gdVkfGBDWzTKxqg3GXLZbcVj7mtROG-jBDZuXF4iu7xkNjjZYNXcXkAVP5oXOsRvrS0o6w7y9NJv0K4e1BTUzkVY5PoRh474_WR9WbqCTLK-RVqjRWl7tlm7lFJhI6zU4fTonVwNmJeqdhSEJCF1mw0tW9yGJBNv0un5iDcBgSzlYGaoeMLzMI9iVmgNRclfsiucK18qdFbVpMM-fH4WX8lfyxRPl55-a1TgzrQ7iCy1OkTwwOLvZgyQrR_pMYhEHBhWMtKV9t8guH_w_qv_DjfwWY0iD8DXC9sCUU-f283FsVp2qS0jmzdP1H7OOlLJJze41X0I_XhLD7AlRm6EKrucSzp3qnLFp4qXVPAPAmyfayVIHxwp76nZrm7qT15UTn1zFimsMY5jdqNzJ1nJyTZPLIlIak31OWu0ER8n6RXC-HQEILTib2IVoVMvnp9LonJvXAdxwOYuTcQmDQVC-bz4Ud63goFRDaOlv1Ie8yxppdUBwPLSmlccX1549FOQ4Mp6YVxY04qU1nSpUPZ0uPneOV_jb6-F7VyNAm6T8yKy-s0xKbDOTlTtZaow-2A33kZQuo42RoOMnmlnMXQsq_k9q-ddDV7Hqrw8Pya-_B5WF9XDgvOjThZIFA6LoHFT38Xq3yE5w0-3msA6YK3159cVjVkmaaMaxSx74a3A-qWTpWbTNd6mc3RQipISRPfNZiCN1M5FkVPB9VdF4s38QBAh4mf9V2oZjjZn-ZA8LHHM8HEulKzIVVU0zBlokKlMs-xKLmYdbK0u3xnV_OtP9NOFwE7U1LsWz-0n0oBfHIQVP14c0ih6cbWDLddARQbs536m1uzGb_qJu-tQ8h8FlfFOCrwP_DcEpppcBhJMgSM8V7vv2EX_C81Dv8hdBAZoXqPcMRltxTn_djPBxNwEAynXk-RtaDP3O8z3zfU9mjIJbgRZ4p-0gl9EMamKHw2EOe6ySHN8_-LszXfm6F635j_xAY0bIXh1N7xI8nHWsbuWYQ01p1jCql_HOmQfoEJE3QacqZ_qQw5AYtcA1EBLwtNtcTcUhHCiM7f0ZOBvG5t2gcW_5VKFeBDeBrjeIMWEgh_vGuaLiZEqGol2FdbR34pdLiYE4Q4W0qE1kmAEpntyNB-_BmUf2vsgchY-CbuZlsaUhT4k0FQI5HAlzUWMxiNzpBe2KgHZG2WoEmLH7-YrNXaMVIoyfWBqg1kdxSHLUrJ9gCVEATOvpDkchtVyLeF6wd8uPTAG11P9M833JJciy_JS9PlBmnH-TF2vc9215ZQOQkFRJ1b6rBXQ-cOZTvVMfv0PK67JmZpH4PVgNri-tZ4yOxZrxXHrfTZggoVsC1JEOELhOg6ubQx_Yxwc59WIio-9uzy3zXCydRmKt3k_D5rlxF2PAsESPYIxsWY4qjRwnTN7u6DornyB4g-2A-ome9PFmTZZ_eDJv5Bc-rr0lii42Y3CZvKraLXBH6ckhI8n7HWMlu2VOTC46avE4RDb3ZOZ1PwIgCATq07JqJEP0XnP4pAAi1k8_CKSOjaJ3-SfgEiqSzu7DDrxsqwyYAA40TqbRfpIwog3oafX3YLQPMBHH7qkP2xN5ipOtsanAvZ-ITKhKmKa1feqblStvE9hmfnOh7JXnMzxawZBHk08NKMGMmIXvVnCHVaP9Xi775aMRl3bQkzro3iS8SgHEVHkHxDZIDnWkcjGm4OqGUhJrzcdqwrCYhk82EKAOjoeqRj_oXWNeeLRwGyQya_ZCOfb1H9LJNgRz8gXIeg4XFso5f16ZMNkFCxHrEY8r8z9PawugITAhTVhJc_Ai17vpwQFeiR5Qnhcxkc6eXpC_3lN52-VFgyh4ssRjRf3GS3oqAvG_9A1V4tiC86RsEEgtIVfc92QU_VqfhrmernAbTmTaCUhZ_Dg5uPTitKNK7GT7MZG1h--PIfRa-pvCSASP_YZL6GK1Zh1i3G4JZpOELxUG3d10VSofDO9V3lB_kI-QCwEU02qytq5X-68VC4LtwdtPiXFwHcha3cnaT48rGPnvs8T4o-hHaTXw6FtnU-PZGw_LiUciVxeWDF6Hd-0qkw7JdcjbQWZfImNnIO01SLgrB95m1d2zms-fEMVukuGF-8Ys721VgN1fVnJNLlOkq33TkxakwfT2myqJU--If_PV7g9Arl5CgH8I15GfvMZw1LwaIAwLPHbKvc58q4XulK77KXcIDJ2bdrJHy4TCpnp_RoEvCmW1A7eXwovwvdRhYffw_wzl6GlBR2CSu-gHQE-3hlJ6g0aU1FBhg5HW1i7KvRpY38aIi5hxqpRnP0G0kCsThtwMBVRYyG7D29n5J3ZLT48SVEJPevHeT8lQ7ojz0xfnsycfUJ_kxens2c8ThOG4ioAgUX14vX8sg1xd7wuq_mz2h0vYNBlGpdG7a15-k68Maa5NTBVDxoTTuoC8jea3n_gvn1SRXcjSoa1TefJyuFECHTvvQC6Mub_4JI2bAs0fo8g7keudG9Ab3aAGZE_1UndpWsnh92TweIIaMg8qBcAyRtYzbERwaEip91WbE8H7Chtsr6kwyjQ8KZ4cTw%7E%7E&ap_size=3032&nfcpm=0.8&placement=3&plcmt=2&skip=1&skipafter=5
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/3.44.0-dc98e81/player.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.244.91.229 Brentwood, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
openresty /
Resource Hash
696ee2ff10f4d06272e23a40622ce122854f2f6bf39a7166179b79b78cdf9285

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Aug 2023 17:06:16 GMT
content-encoding
gzip
server
openresty
vary
Accept-Encoding
access-control-allow-methods
GET, POST
content-type
text/xml;charset=UTF-8
access-control-allow-origin
https://freedomheadlines.com
cache-control
no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
0
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Archivo|Arimo|Bitter|EB+Garamond|Lato|Libre+Baskerville|Libre+Franklin|Lora|Google+Sans:regular,medium|Material+Icons|Google+Symbols|Merriweather|Montserrat|Mukta|Muli|Nunito|Open+Sans:400,600,700|Open+Sans+Condensed:300,400,600,700|Oswald|Playfair+Display|Poppins|Raleway|Roboto|Roboto+Condensed|Roboto+Slab|Slabo+27px|Source+Sans+Pro|Ubuntu|Volkhov&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://freedomheadlines.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Wed, 23 Aug 2023 22:08:16 GMT
x-content-type-options
nosniff
age
413880
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 22 Aug 2024 22:08:16 GMT
landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.webp
mcd.ex.co/video/upload/w_800,so_4/v1490095101/ 		14 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mcd.ex.co/video/upload/w_800,so_4/v1490095101/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.webp
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.56 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-56.deploy.static.akamaitechnologies.com
Software
cloudinary /
Resource Hash
06ebe1954427c09d4400e7e77e9c651b2eb3953e798ba97971d536f4bb398c89

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Mon, 28 Aug 2023 17:06:16 GMT
Cache-Tag
502941132783428480281542933415069772301,473281262405526930053610213462331028430,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Status
200 OK
Content-Disposition
inline; filename="landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.webp"
Connection
keep-alive
Content-Length
14352
X-Request-Id
be957367e584485bb9c398097153b4f7
X-Served-By
cache-lga21921-LGA
Last-Modified
Mon, 13 Feb 2023 08:42:01 GMT
Server
cloudinary
X-Timer
S1676277721.500283,VS0,VE446
ETag
"cea3d109186db580c1bb2c32d1905228"
Content-Type
image/webp
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=30109845
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
0
expb.js
cdn.ex.co/prebid/production/release/1.6.1/latest/ Frame 40EA 		556 KB
182 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ex.co/prebid/production/release/1.6.1/latest/expb.js
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/3.44.0-dc98e81/player.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.56 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-56.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2046beec32566b904b4f546fb3ce9e594af6a83e54bcaf1d8796a262815d28bf

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Mon, 28 Aug 2023 17:06:16 GMT
content-encoding
gzip
x-amz-server-side-encryption
AES256
content-length
186076
last-modified
Sun, 13 Aug 2023 08:45:50 GMT
server
AmazonS3
etag
"be8d34dd7ac3b657405a45f59f1a5aa3"
vary
Accept-Encoding
access-control-max-age
86400
access-control-allow-methods
GET,POST
access-control-allow-origin
*
content-type
application/javascript
cache-control
must-revalidate, proxy-revalidate, max-age=604800, s-maxage=31536000
access-control-allow-credentials
false
accept-ranges
bytes
access-control-allow-headers
*
expires
Mon, 04 Sep 2023 17:06:16 GMT
landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.m3u8
mcd.ex.co/video/upload/sp_hd/v1490095101/ 		1 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://mcd.ex.co/video/upload/sp_hd/v1490095101/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.m3u8
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10/hls.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.56 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-56.deploy.static.akamaitechnologies.com
Software
cloudinary /
Resource Hash
a56f5f7194ef81e280190cdf70a6d1289942afaf52231e7900474b312f5c48cf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Mon, 28 Aug 2023 17:06:16 GMT
Cache-Tag
502941132783428480281542933415069772301,394554537382471183304184472313687845759,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Connection
keep-alive
Content-Length
1127
X-Served-By
cache-iad-kiad7000146-IAD
Last-Modified
Wed, 09 Jun 2021 12:31:44 GMT
Server
cloudinary
X-Timer
S1680926715.325871,VS0,VE148
ETag
"43c49c5a38361beb99c8bf3dd60047f4"
Content-Type
application/x-mpegURL
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=23536897
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
0
landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.m3u8
mcd.ex.co/video/upload/c_limit,w_320,h_240,vc_h264:baseline:3.0,br_192k/v1600072622/ 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://mcd.ex.co/video/upload/c_limit,w_320,h_240,vc_h264:baseline:3.0,br_192k/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.m3u8
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10/hls.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.56 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-56.deploy.static.akamaitechnologies.com
Software
cloudinary /
Resource Hash
363a2228f397c87b3aeb0e7fc9926e5438c3de511242c5849d0da3d2c76037fd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Mon, 28 Aug 2023 17:06:16 GMT
Cache-Tag
502941132783428480281542933415069772301,484104238383510269782950376486441993307,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Connection
keep-alive
Content-Length
1890
X-Served-By
cache-wdc5572-WDC
Last-Modified
Wed, 09 Jun 2021 12:31:21 GMT
Server
cloudinary
X-Timer
S1638944223.248087,VS0,VE0
ETag
"e3a4d3e4cf55264cd80d76705e1125b3"
Content-Type
application/x-mpegURL
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=29818811
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
4
landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
mcd.ex.co/video/upload/c_limit,w_320,h_240,vc_h264:baseline:3.0,br_192k/v1600072622/ 		88 KB
89 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://mcd.ex.co/video/upload/c_limit,w_320,h_240,vc_h264:baseline:3.0,br_192k/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10/hls.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.56 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-56.deploy.static.akamaitechnologies.com
Software
cloudinary /
Resource Hash
f164b39a16618e24f0fd121a274768bc24760f8778d4a3b5457a5e03ddd0c53f

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Range
bytes=0-90239

Response headers

Date
Mon, 28 Aug 2023 17:06:16 GMT
Cache-Tag
502941132783428480281542933415069772301,201691703795562271966273117828695354966,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Range
bytes 0-90239/1475048
Connection
keep-alive
Content-Length
90240
X-Served-By
cache-wdc5563-WDC
Last-Modified
Wed, 09 Jun 2021 07:23:15 GMT
Server
cloudinary
X-Timer
S1638942919.634203,VS0,VE117
ETag
"bc1d05ae5b7f824a9cd6a30d8f4abbc9"
Content-Type
video/mp2t
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=27894814
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
0
landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.m3u8
mcd.ex.co/video/upload/c_limit,w_640,h_360,vc_h264:baseline:3.0,br_2m/v1600072622/ 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://mcd.ex.co/video/upload/c_limit,w_640,h_360,vc_h264:baseline:3.0,br_2m/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.m3u8
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10/hls.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.56 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-56.deploy.static.akamaitechnologies.com
Software
cloudinary /
Resource Hash
e72d0734bc15008c6d89a4087da5ebcc55a739654f70ef857645a4f000304ff7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Unused62
8096267
Date
Mon, 28 Aug 2023 17:06:16 GMT
Cache-Tag
502941132783428480281542933415069772301,242129432464203716531710096271398543033,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Connection
keep-alive
Content-Length
1907
X-Served-By
cache-wdc5573-WDC
Last-Modified
Thu, 03 Jun 2021 22:37:57 GMT
Server
cloudinary
X-Timer
S1638943690.220423,VS0,VE1
ETag
"ff6f024870a329205eb2e3121dfccff3"
Content-Type
application/x-mpegURL
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=28510850
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
1
landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
mcd.ex.co/video/upload/c_limit,w_640,h_360,vc_h264:baseline:3.0,br_2m/v1600072622/ 		134 KB
134 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://mcd.ex.co/video/upload/c_limit,w_640,h_360,vc_h264:baseline:3.0,br_2m/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10/hls.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.56 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-56.deploy.static.akamaitechnologies.com
Software
cloudinary /
Resource Hash
da62720b7c3e8d6eef182fb69b2002926da8512532e6de9a1de0396a71a02413

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Range
bytes=0-136863

Response headers

Date
Mon, 28 Aug 2023 17:06:16 GMT
Cache-Tag
502941132783428480281542933415069772301,233322687990412021556170905870126409175,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Range
bytes 0-136863/2254684
Connection
keep-alive
Content-Length
136864
X-Served-By
cache-wdc5572-WDC
Last-Modified
Sun, 23 May 2021 20:33:04 GMT
Server
cloudinary
X-Timer
S1638943178.979532,VS0,VE1
ETag
"d0acd8965bbf5aae1010871c52bdd929"
Content-Type
video/mp2t
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=27978423
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
1
shim.gif
creatives.sascdn.com/ 		43 B
388 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://creatives.sascdn.com/shim.gif
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:ca78 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://freedomheadlines.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Mon, 28 Aug 2023 17:06:17 GMT
Last-Modified
Fri, 17 Aug 2018 12:23:00 GMT
Server
AkamaiNetStorage
ETag
"221d8352905f2c38b3cb2bd191d630b0:1534508580"
Content-Type
image/gif
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 27 Aug 2024 17:06:17 GMT
94724bdc-5659-436f-86c8-8bc32291bd8e
https://freedomheadlines.com/ 		366 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://freedomheadlines.com/94724bdc-5659-436f-86c8-8bc32291bd8e
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5ddf593f4a8eddcd3d638a211dd91a517bd07b43f8ea933695dfc161b8e2679f

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Length
374903
Content-Type
text/javascript
landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
mcd.ex.co/video/upload/c_limit,w_640,h_360,vc_h264:baseline:3.0,br_2m/v1600072622/ 		180 KB
181 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://mcd.ex.co/video/upload/c_limit,w_640,h_360,vc_h264:baseline:3.0,br_2m/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10/hls.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.56 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-56.deploy.static.akamaitechnologies.com
Software
cloudinary /
Resource Hash
555ae5a3cfb7774498b8139e9df89a67012a2be3a4fc006f6b5344c40cb1ea48

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Range
bytes=136864-321291

Response headers

Date
Mon, 28 Aug 2023 17:06:17 GMT
Cache-Tag
502941132783428480281542933415069772301,233322687990412021556170905870126409175,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Range
bytes 136864-321291/2254684
Connection
keep-alive
Content-Length
184428
X-Served-By
cache-wdc5572-WDC
Last-Modified
Sun, 23 May 2021 20:33:04 GMT
Server
cloudinary
X-Timer
S1638943178.979532,VS0,VE1
ETag
"d0acd8965bbf5aae1010871c52bdd929"
Content-Type
video/mp2t
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=27978422
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
1
events
e.channelexco.com/ 		0
247 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://e.channelexco.com/events
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/3.44.0-dc98e81/player.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.82.15.161 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
openresty /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Mon, 28 Aug 2023 17:06:17 GMT
access-control-request-method
GET, POST
server
openresty
access-control-allow-methods
GET, POST
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
access-control-allow-credentials
true
access-control-allow-headers
*
landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
mcd.ex.co/video/upload/c_limit,w_640,h_360,vc_h264:baseline:3.0,br_2m/v1600072622/ 		178 KB
179 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://mcd.ex.co/video/upload/c_limit,w_640,h_360,vc_h264:baseline:3.0,br_2m/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10/hls.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.56 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-56.deploy.static.akamaitechnologies.com
Software
cloudinary /
Resource Hash
339b41625108f486487a4fa13a28ae08ae3c4b5fd19b14cdc66bcfd7f64b649e

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Range
bytes=321292-503463

Response headers

Date
Mon, 28 Aug 2023 17:06:17 GMT
Cache-Tag
502941132783428480281542933415069772301,233322687990412021556170905870126409175,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Range
bytes 321292-503463/2254684
Connection
keep-alive
Content-Length
182172
X-Served-By
cache-wdc5572-WDC
Last-Modified
Sun, 23 May 2021 20:33:04 GMT
Server
cloudinary
X-Timer
S1638943178.979532,VS0,VE1
ETag
"d0acd8965bbf5aae1010871c52bdd929"
Content-Type
video/mp2t
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=27978422
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
1
landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
mcd.ex.co/video/upload/c_limit,w_640,h_360,vc_h264:baseline:3.0,br_2m/v1600072622/ 		126 KB
126 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://mcd.ex.co/video/upload/c_limit,w_640,h_360,vc_h264:baseline:3.0,br_2m/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10/hls.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.56 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-56.deploy.static.akamaitechnologies.com
Software
cloudinary /
Resource Hash
57fb05bfeedfe63b705167cf837b458e0ab58c2c29c4a973903f293b39d90df4

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Range
bytes=503464-632055

Response headers

Date
Mon, 28 Aug 2023 17:06:17 GMT
Cache-Tag
502941132783428480281542933415069772301,233322687990412021556170905870126409175,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Range
bytes 503464-632055/2254684
Connection
keep-alive
Content-Length
128592
X-Served-By
cache-wdc5572-WDC
Last-Modified
Sun, 23 May 2021 20:33:04 GMT
Server
cloudinary
X-Timer
S1638943178.979532,VS0,VE1
ETag
"d0acd8965bbf5aae1010871c52bdd929"
Content-Type
video/mp2t
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=27978422
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
1
landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
mcd.ex.co/video/upload/c_limit,w_640,h_360,vc_h264:baseline:3.0,br_2m/v1600072622/ 		139 KB
140 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://mcd.ex.co/video/upload/c_limit,w_640,h_360,vc_h264:baseline:3.0,br_2m/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10/hls.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.56 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-56.deploy.static.akamaitechnologies.com
Software
cloudinary /
Resource Hash
14b57337b1e5726f57241ce5552c41ae99db90e7037e0d8e9afab69681cd9f2e

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Range
bytes=632056-774371

Response headers

Date
Mon, 28 Aug 2023 17:06:17 GMT
Cache-Tag
502941132783428480281542933415069772301,233322687990412021556170905870126409175,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Range
bytes 632056-774371/2254684
Connection
keep-alive
Content-Length
142316
X-Served-By
cache-wdc5572-WDC
Last-Modified
Sun, 23 May 2021 20:33:04 GMT
Server
cloudinary
X-Timer
S1638943178.979532,VS0,VE1
ETag
"d0acd8965bbf5aae1010871c52bdd929"
Content-Type
video/mp2t
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=27978422
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
1
landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
mcd.ex.co/video/upload/c_limit,w_640,h_360,vc_h264:baseline:3.0,br_2m/v1600072622/ 		117 KB
117 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://mcd.ex.co/video/upload/c_limit,w_640,h_360,vc_h264:baseline:3.0,br_2m/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10/hls.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.16.100.56 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-100-56.deploy.static.akamaitechnologies.com
Software
cloudinary /
Resource Hash
c254f18a6b35e9d5707cb7e64ae9ecc7da944a5e0b7cbc954dd455f11489c168

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Range
bytes=774372-893939

Response headers

Date
Mon, 28 Aug 2023 17:06:17 GMT
Cache-Tag
502941132783428480281542933415069772301,233322687990412021556170905870126409175,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Range
bytes 774372-893939/2254684
Connection
keep-alive
Content-Length
119568
X-Served-By
cache-wdc5572-WDC
Last-Modified
Sun, 23 May 2021 20:33:04 GMT
Server
cloudinary
X-Timer
S1638943178.979532,VS0,VE1
ETag
"d0acd8965bbf5aae1010871c52bdd929"
Content-Type
video/mp2t
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=27978422
Accept-Ranges
bytes
Timing-Allow-Origin
*
Access-Control-Allow-Headers
X-Requested-With
X-Cache-Hits
1
prebid
id5-sync.com/api/config/ Frame 40EA 		136 B
550 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/api/config/prebid
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/prebid/production/release/1.6.1/latest/expb.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
141.95.98.64 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
22cd820b748bdabf96448ca563642ddc782ba91756d5428113a23392839752ef
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://freedomheadlines.com
date
Mon, 28 Aug 2023 17:06:19 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-credentials
true
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding
chunked
content-type
application/json;charset=UTF-8
envelope
api.rlcdn.com/api/identity/ Frame 40EA 		0
256 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.rlcdn.com/api/identity/envelope?pid=13963
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/prebid/production/release/1.6.1/latest/expb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.133.55 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 28 Aug 2023 17:06:19 GMT
via
1.1 google
access-control-allow-methods
GET, OPTIONS
access-control-allow-origin
https://freedomheadlines.com
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
access-control-allow-headers
Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
content-length
0
id
id.crwdcntrl.net/ Frame 40EA 		43 B
320 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id.crwdcntrl.net/id?gdpr_applies=false&us_privacy=1---
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/prebid/production/release/1.6.1/latest/expb.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.171.14.223 -, , ASN (),
Reverse DNS
Software
Jetty(9.4.38.v20210224) /
Resource Hash
a96e1e97d62ab9747678b947bdf0a0ea5f81790b1e3a1df2d4607a86bf802596

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 28 Aug 2023 17:06:19 GMT
server
Jetty(9.4.38.v20210224)
content-type
application/json;charset=utf-8
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
https://freedomheadlines.com
cache-control
no-cache
x-server
10.45.17.26
access-control-allow-credentials
true
content-length
43
expires
0
rid
match.adsrvr.org/track/ Frame 40EA 		63 B
393 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=343asog&fmt=json
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/prebid/production/release/1.6.1/latest/expb.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
586474e69dd1a256c4d7d44d977385cbdf94e32ed6f55af9cf5b495dbec6c7dc

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 28 Aug 2023 17:06:19 GMT
x-aspnet-version
4.0.30319
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://freedomheadlines.com
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
63
expires
Wed, 27 Sep 2023 17:06:19 GMT
pbjs
htlb.casalemedia.com/openrtb/ Frame 40EA 		36 B
546 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/openrtb/pbjs?s=624104
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/prebid/production/release/1.6.1/latest/expb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.39.155 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
a12af714465e1b60e2538b8f5faa54c4b2b9490dcd3b80d66c60f24326b83c02

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 28 Aug 2023 17:06:19 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0AIInAP9OPW7O3BGZygbqbe1tBZFPgw6gBgV6c2BnimEM8mcHDIaOeTxmn3QBqtr4p%2F3WvSA7NlWiDQEsQM0k2d851qq88olZbQo2BIq3H8QZuoYRJ%2BKqq9ThnfZyxLmdp1yov36"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
https://freedomheadlines.com
cache-control
no-cache
access-control-allow-credentials
true
cf-ray
7fde24e8efaf904e-FRA
alt-svc
h3=":443"; ma=86400
content-length
36
expires
0
v1
prg.smartadserver.com/prebid/ Frame 40EA 		0
0
v1
lb.eu-1-id5-sync.com/lb/ Frame 40EA 		33 B
407 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://lb.eu-1-id5-sync.com/lb/v1
Requested by
Host: cdn.ex.co
URL: https://cdn.ex.co/prebid/production/release/1.6.1/latest/expb.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
141.95.98.65 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
54ad0305e8d521e1ac443082838e8f0426572f97aa232d6082ded025b0c8f33e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://freedomheadlines.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://freedomheadlines.com
date
Mon, 28 Aug 2023 17:06:19 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding
chunked
content-type
application/json;charset=UTF-8
1235.json
id5-sync.com/g/v2/ Frame 40EA 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
prg.smartadserver.com
URL
https://prg.smartadserver.com/prebid/v1
Domain
id5-sync.com
URL
https://id5-sync.com/g/v2/1235.json

Verdicts & Comments Add Verdict or Comment

178 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| 16 object| 17 object| 18 object| 19 object| 20 object| 21 object| 22 object| 23 object| 24 object| 25 object| 26 object| documentPictureInPicture object| _wpemojiSettings undefined| $ function| jQuery function| gtag object| dataLayer object| adsbygoogle object| ldAdInit object| VUUKLE_CONFIG function| Swiper function| PhotoSwipe function| PhotoSwipeUI_Default string| fotoramaVersion object| ajax_var function| sticky_sidebar object| mejsL10n object| mejs function| MediaElement object| HtmlMediaElement function| onYouTubePlayerAPIReady function| DefaultPlayer function| MediaElementPlayer object| _wpmejsSettings object| wp object| addComment object| twemoji function| w_event function| createElementFromHTML function| stripScripts function| generateID function| shouldExclude function| checkScriptHead function| observe_mutation function| getCpcPrediction string| metaName object| __twttrll object| twttr object| __twttr object| google_tag_manager object| google_tag_data function| $lvpl function| vuukleLogin function| newVuukleWidgets object| webpackChunk function| changeVuukleWidgetsTheme number| VUUKLE_PLATFORM function| removeVuukleWidgets function| generateVuukleAds function| vuukleAuthUser string| GoogleAnalyticsObject function| ga object| google_js_reporting_queue number| google_srt object| google_logging_queue number| tmod object| google_ad_modifications object| ggeac object| google_persistent_state_async boolean| google_measure_js_timing object| google_reactive_ads_global_state object| google_sa_queue function| google_process_slots object| google_ama_state function| google_spfd number| google_unique_id object| google_sv_map number| google_rum_task_id_counter object| _vuukleGeo string| google_user_agent_client_hint object| _ldAdIdMap object| vuukleAdConfiguration object| gaGlobal object| gaplugins object| gaData function| getLoadVuukleSettings string| _vuukleIabtopic function| google_sa_impl boolean| _gfp_p_ object| google_image_requests number| google_global_correlator object| google_prev_clients object| ampInaboxIframes object| ampInaboxPendingMessages function| vuukleLoader object| vuuklehbChunk object| vuuklehb object| _pbjsGlobals object| vuukleConsole object| vuukleSlots object| googletag boolean| _VuukleDebug object| vuuklePlayerComponent number| vuukleLoaded object| _vuukleConfig object| _ldStickyConfig object| confiant function| __vuukleCba1cbbfa1 boolean| _ldStickyRendered string| contentURL string| no_script_tag object| data object| jeengConfig object| core object| __core-js_shared__ object| jeeng number| _nonPersonalizedAds object| wpJsonRciWidget object| ua_result object| revcontent function| renderRCWidget object| default_ContributorServingResponseClientJs object| __googlefc string| __fcInvoked string| __fcexpdef string| MzI0YWQ4Nzc3YWIyYWE3NmxvYWRlcl9qcw== string| MzI0YWQ4Nzc3YWIyYWE3NmNhY2hlZF9qcw== object| googlefc object| __fcInternalApiManager boolean| __fcInternalApiPostMessageReady object| __tcfapiEventListeners function| __tcfapi object| __tcfapiManager boolean| __tcfapiPostMessageReady function| __uspapi object| __uspapiManager object| __gppEventListeners function| __gpp object| __gppManager boolean| __gppPostMessageReady object| google_llp object| owpbjsChunk object| owpbjs object| PWT function| dspCriteoRTUSCallback function| dspCMCallback object| STREAM_CONFIGS string| STREAM_ID object| __EXCO string| __EXCO_INTEGRATION_TYPE object| wpJsonpExCoStreamSdk object| regeneratorRuntime function| setImmediate function| clearImmediate string| pbPageIdentifier object| wpJsonpExCoAdPlayer object| ID5 object| CEDATO_API object| CEDATO_TAG object| GoogleGcLKhOms object| __id5_instances function| Hls

12 Cookies

Domain/Path Name / Value
freedomheadlines.com/freedom-wire/former-mar-a-lago-employee-flips-on-trump Name: exco-uid
Value: x7n2d25pn8a3mqnv
.freedomheadlines.com/ Name: _ga_CP4TF595X7
Value: GS1.1.1693242372.1.0.1693242372.0.0.0
.freedomheadlines.com/ Name: _ga
Value: GA1.2.723900094.1693242373
.freedomheadlines.com/ Name: _gid
Value: GA1.2.489032261.1693242373
.freedomheadlines.com/ Name: _gat_gtag_UA_32644619_11
Value: 1
.freedomheadlines.com/ Name: __gads
Value: ID=0b5b07eb8b8de6eb-22e69c165fde0065:T=1693242372:RT=1693242372:S=ALNI_MZG9A1pc5vb0F5esQL9iZw22nOIKg
.freedomheadlines.com/ Name: __gpi
Value: UID=00000c69a68e8849:T=1693242372:RT=1693242372:S=ALNI_MY_LfWJZwfbjugP0UdrN1kslLFx7A
.doubleclick.net/ Name: DSID
Value: NO_DATA
freedomheadlines.com/ Name: _pbjs_userid_consent_data
Value: 3524755945110770
.doubleclick.net/ Name: IDE
Value: AHWqTUmlQDDecsD79ciZGiWHX3YG1jxjXkLc_HalyQ5g5iC4-a6A8XiakIFNeiykrKI
.googleadservices.com/ Name: ar_debug
Value: 1
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission

2 Console Messages

Source Level URL
Text
other warning URL: https://cdn.vuukle.com/platform.js(Line 1)
Message:
Unrecognized feature: 'web-share'.
network error URL: https://api.rlcdn.com/api/identity/envelope?pid=13963
Message:
Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.pubmatic.com
api.rlcdn.com
api.vuukle.com
api.whizzco.com
assets.netizen.co
assets.revcontent.com
cdn.confiant-integrations.net
cdn.ex.co
cdn.syndication.twimg.com
cdn.vuukle.com
cdn.whizzco.com
cdn1.lockerdomecdn.com
cdn2.decide.dev
collector.ex.co
creatives.sascdn.com
decide.dev
e.channelexco.com
fonts.googleapis.com
fonts.gstatic.com
freedomheadlines.com
fundingchoicesmessages.google.com
googleads.g.doubleclick.net
gpv.ex.co
htlb.casalemedia.com
id.crwdcntrl.net
id5-sync.com
images.netizen.co
img.revcontent.com
lb.eu-1-id5-sync.com
mailz.leafybranch.com
match.adsrvr.org
mcd.ex.co
p.channelexco.com
p4-bxlpgat6ptlbc-24skbq56hefzhukm-if-v6exp3-v4.metric.gstatic.com
pagead2.googlesyndication.com
partner.googleadservices.com
pbs.twimg.com
platform.twitter.com
player.ex.co
prg.smartadserver.com
publish.vuukle.com
region1.google-analytics.com
s-12.channelexco.com
securepubads.g.doubleclick.net
stats.g.doubleclick.net
syndication.twitter.com
telemetries.jeeng.com
tpc.googlesyndication.com
trends.netizen.co
users.api.jeeng.com
vuukle.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www9.smartadserver.com
yeet.revcontent.com
id5-sync.com
prg.smartadserver.com
104.18.39.155
104.244.42.200
108.128.120.222
141.95.98.64
141.95.98.65
142.250.185.67
15.197.193.217
151.101.2.132
151.139.128.10
18.203.210.121
2.16.100.56
2.19.244.232
2001:4860:4802:32::36
207.244.91.229
216.58.206.34
217.182.178.224
23.82.15.161
2600:3c00::f03c:93ff:fe39:3408
2606:2800:134:fa2:1627:1fe:edb:1665
2606:2800:234:59:254c:406:2366:268c
2606:4700:10::6816:39ae
2606:4700:10::6816:3da8
2606:4700:10::ac43:264e
2606:4700:4400::6812:2b5a
2606:4700:e4::ac40:a50b
2a00:1450:4001:800::2002
2a00:1450:4001:806::2002
2a00:1450:4001:810::200a
2a00:1450:4001:812::2004
2a00:1450:4001:813::2008
2a00:1450:4001:827::2002
2a00:1450:4001:827::200e
2a00:1450:4001:828::2001
2a00:1450:4001:828::2002
2a00:1450:4001:828::2003
2a00:1450:4001:82a::2002
2a00:1450:4001:82a::200e
2a00:1450:400c:c07::9c
2a02:26f0:780::210:ca78
2a06:98c1:3121::3
34.120.133.55
34.149.139.129
34.194.83.231
34.197.86.75
54.171.14.223
01e8be122ac87eb4686d3bdad82d7e241a721dd3381699cc71423626ee7d7a32
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
06ebe1954427c09d4400e7e77e9c651b2eb3953e798ba97971d536f4bb398c89
08ffaa0817535bfde9794ff6ce557ff3fe5934a4583f7e91b159b4e44007d440
0907e75ab7f4aa03bcbc01778262abd0671f8742abaca30e9816cc90a6b28935
0feb4c88f50e33d36eca5a644f9e33d80b55e5ef08a8c5c553e68c946bd4ff70
14060cd7611c20206e3e1b5affff0b6cfc943b97ed32a36f0d83405965ffc67b
14b57337b1e5726f57241ce5552c41ae99db90e7037e0d8e9afab69681cd9f2e
1712db2ac9948f052b629d35a83530960b4f24075b69c2a8b3f7323697f20235
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1a0b835ba5474619c90a646fdb43f7337b2aeddbd561b713f27a12c2c83314cc
1df629c9e3d7999c38bfa18b45032197fd4da30e8e893bf07f5083e1fa9b4390
2046beec32566b904b4f546fb3ce9e594af6a83e54bcaf1d8796a262815d28bf
22cd820b748bdabf96448ca563642ddc782ba91756d5428113a23392839752ef
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2760bf445780ccedb7b5eadaf68ee54b477220892c05a5d979b228b38d485d81
2a06c91c4dad03d8ab3e1bcbef7785c7afcb9da42d50c336e615e65d2c23525f
2a4ccc56e38e149df719e40d43481213db6cc4ceeb180f9a7abc4b9ee744a456
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2bcf7c31dad5a7352c5b9750d4e991939473441aef5d9ea22c036a47df0e1dca
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
302da628a6afc3e93f1b86bf7c65e4d6536d8283d78266964822a76d1c645aa4
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
339b41625108f486487a4fa13a28ae08ae3c4b5fd19b14cdc66bcfd7f64b649e
363a2228f397c87b3aeb0e7fc9926e5438c3de511242c5849d0da3d2c76037fd
38077d1e25bc00bf59ec0463134cf3d7a27f61f3760c9f237029bdc4c0b96f9f
392c9fa9cd1273a2a89d1a83a69cd1f63f21d1d55e7be21e1d8f51f25145668b
3d23d39a30bb7323f8ccfd64c52cf286138fba4f83e78f7edcf66703b7c23aaa
3d2540ed92f01b9f61c6a2c43f15284a9f9f3aff2decbee06ba69a4d4208d935
3d9991f1b8b90658d2762b6bbb0e6a9c5101c7883523d46b3a44750480b8c45d
3dffa84e13fbc367c907ff31e293923484de18c4c06cac97109e4b9a1b19752c
3e48869d45889d8c1370161ac5b499cb02dc73c6bebefb8c487173010aabb78b
3e6131330963c472b950b8aaf544ba3829735b8ccb103d614ba7793e3a786550
4002d65e95f94dc87ae8ad170eb8dbc3644921032ac76dcb376537d9304a6fbf
41d511bcd8511da9cb1f673d030c44fbadb09271c96e4fbb40bfa306572dcca3
443732f9e2f617d668461066fc34290077c7db1f4eefaa857f5442997d3a7720
443ba0af7a7ed827223c7fb3c008c02b9ff1d651b6492e9c270378b07d9f6008
45aa38a592701233d92a89df66a60abecdedf9107be819b86775c1cd62e3abd1
47b726fd18aa3355c7f0277952419c5e1b33d3347ee2e4eff5e9b9be73040549
4961a1de84f2dd1986f7560dc85392a6a11ca9bcca92f10f65291e9afbc5ff3e
4d8562efd8364015edd8080e72d8bd98f0a92019058f15df14e03f9951e01876
53774a6527d7c6d1778f1d7416b8571c70ebfd0a976206e16a07bde9d2ec6171
53f98bb0b288d162a288ce2caf8406c00c1fd474f0c73a58b5893098271621a9
54ad0305e8d521e1ac443082838e8f0426572f97aa232d6082ded025b0c8f33e
555ae5a3cfb7774498b8139e9df89a67012a2be3a4fc006f6b5344c40cb1ea48
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
561b269e9f6dfc75026cb28c3692c5e4b29982f619e14e1d313b422676d195a6
57107b8d37bf404c447591aa4fa88debcaa705cd9e4eeb91ffb35f4b2d9d5c5a
57cdde951861531f986d9b083e1f90508e6717ceb8211130fd5e56851de4719e
57fb05bfeedfe63b705167cf837b458e0ab58c2c29c4a973903f293b39d90df4
586474e69dd1a256c4d7d44d977385cbdf94e32ed6f55af9cf5b495dbec6c7dc
58de04be3907260f5d69d794679d2b54b6a48c6dd5090b4a55fe0b96127ec155
593153dbbbef6388337f89d44620bd526272d6fe1f63ec1176f8eee8bd04386d
5c634dd1fc77cf6b82fb34c3571b108f843ee143edbb450d30b4eac843b12a59
5ddf593f4a8eddcd3d638a211dd91a517bd07b43f8ea933695dfc161b8e2679f
5e3e377390273cdcadaaa15956be20643d89765dfe7b62c363e9442a68bd4271
61773d9a3aa1ba14b2f4ea9a8118c619c460c5acbc8770405530cc5ce31ed7e4
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6343a6c6155e4549384af0a8b706653047b06eda90e7b2e09892c3d81b19cdaf
6594b15832f028e2a4f49b695a9718527d2b21b52839c91939e68a3d0ece2a0c
696ee2ff10f4d06272e23a40622ce122854f2f6bf39a7166179b79b78cdf9285
6a541246205ee94507bcc81cdde7e260c17532e24d9a4ca7f414f6e3c2f2a0d1
6b30722487e92833baf8f01d6b2d2fed4e459d7cd42dc81ac1a80d8d08b9450e
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7415bd123062cb453f55c7a40f933f45e9392008038e167b5526cf816db961dd
74a9ed0d0eeb65ed7f945bbbe969f49dbbb73adad845e50bed4e8e92bac7bdc2
76bbe117102ce802cd20b57f9722133d7924bb3395bfe201f8f0b515a81c46dc
76e4ec5b5a87cf41a057115fb864f6673d03a22592ab23bb18aedb56b4aed8de
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7b2c14d3f7df4f5372f0279886f89a76e521be5aea85af7050aa5b2bc2d9c41d
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
7e2a73a579902634041ad092f13d3cefeba13f62c71c60a785a461214848807b
7f34b768792b90cf0b04fced2470e43d8fab7644f6565d5178fbfb49c4859cee
7fabbc3f5264e158a35ffb9da2a25feeb2afa430edd64e1842cb32d3c35edfb1
8165d8e2771d30c1a2baf2e6ebb58ce49c3b9dc575676b6f1aa7afeb2e5efe86
8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1
8328cf4c0886fffb64baf44a2de3126ed0f2771c3d1965901309a8ec173e7d91
8642f4a4f9e94674f4d2f3a1858df3afa04dabcee6a25a0a755fee4a1f885ad3
8829d6c0a640ecd61f313eb34c3f4a6b4f273f4c9511d6a7c17e9408286d21eb
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a169cfec2d4951fde01912d4dce25e011be569327cd7e3af2e8cc97f400a375
8a9dc36107b45cb3b1c8d254cff2ef235b382d3341d37a1bdda746b0cee6bbac
8d5287568eed8697f603015f0b84a078309dad917ceddee717309e88588e75eb
8e49bc053e28064f8a116eaed4b21a5a681982bb736e4d0ee431516d629da1b3
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
948e6b4eb7da9790909ee43daf59efda76a5cae311649787be09aca294481d2f
94d3b3f21c82e9004e1a95aba77f256573a3406d0782d451d50ac8e4bb4df7c5
9ae6ff7132091a30fff5b1e78776faaaf35cfd508fcc5b0bb2b07226738af975
9c1aef310beaa7222f49b37ecc8423ce63d8887cc4b78da6db6665a700bfbfce
9f0e07e90dcceaecca4d180835a155352e46f1aca81e64e976206fefa0670b1e
a10b9570a1c7858442b42f1cd48b69a191638269f37e4046607bf5fe188e38bf
a12af714465e1b60e2538b8f5faa54c4b2b9490dcd3b80d66c60f24326b83c02
a229ca014188cf0336665b7bbab5e49da5aede93e748fefd0ad5fd66e53cd57c
a2e99d9f642cf26e56bad3ff3705fd8ab8ea028ffa302405d1642bb7456d796a
a4782a2e1e045dc4cfa2ae2ebef6e381cf3b72bcbad624a37c79054ac33476e4
a510f33342f4f7df0d7e1baa52a55fe5496103e25b8eb894513ebc632a209f24
a56f5f7194ef81e280190cdf70a6d1289942afaf52231e7900474b312f5c48cf
a5cd8ec73857ce3a975bf82836e2e5b43c1e3ab5ee56dfa26e45172914226f60
a791efc179088761bc7a40f2de8211560672ab69a46382cafb38575bab60a77f
a95e624ec4d1a9c3067a34670fa20a9e3944b0b05a0cb4200ea69cbf6c3465ab
a96e1e97d62ab9747678b947bdf0a0ea5f81790b1e3a1df2d4607a86bf802596
aaf8348fad3676d3d62c09c1a92f11d075643f798d1a3516b4a34cf9eb127862
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad4964b732db493403d01b3663294cb6d0e272c57f2d9224a5c9673ac480ff58
aea963092fe9ff354e03b09343804e2129d4dd8087bbe07262ffcf5b5d4bf1bb
afe2c4d44f6a91b4d2ecbaf61d91e90f61cf159467b4a3fac9e51ed9b1e2920d
b1fe6456a4e2d8871862a70a1d1ad7dee8887643ee994ad850ee0a30072cfbd2
b4dada34875920e38c6e47a9094052c62bf803594d646189541f25a1e043c22c
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
b7a2a3c986638afccae4742dead290020eeb0ff1da26e51fdade7bdf19eac7f3
b7e9da21926bd362d9545fb8e28279f21c2f752cbcf66c6f88c1b4d6ac7f0069
ba2d293f01789ef093b5b67ca430d9d1a95a5782e7f72e9b961163f4ba56f43b
bb15c813b3fb37a3e49b5d99382a518fec61909004b84a2a667b65b578ebfe3f
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
bdf47e9be1ad651fcad55288d534fbeeba846ce487322a2b8f1f7e0f6dfaab12
bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66
c254f18a6b35e9d5707cb7e64ae9ecc7da944a5e0b7cbc954dd455f11489c168
c396dfca1a8c20e7ba5236db5c59e7e7fbc7e56aaa7d2c17262f6d2ee464e65c
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
c731d1ac06ce0723680061bb7eab4bfe43bad28d6af8d8fa8cf855b16ff60784
c87b7f745cfb4a994801488584e6e0e78d6c4f0ad567e985a781fc0b86074724
c9b66bc6cf23b792979aee24aaa66eced0774974b2a564a44ef7f68b3861cc8e
ca64614f2f9ffdf928c305e883f9db5af2fa43980050b9e784d60879470d5c51
cb90795dbe3c8c356226de6cde47f6715914c2b4e098c634a5348ab0086b885c
cca27de9b49927f4f88540f690be49d9700ea7d3dbc1b5200d81e440f4f5c000
cd2f57bd8668c0222e299540b077e8d4f4ada840976122e421bbccd57af420c1
cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a
cebe87559cf861d01e9c6b1cefd38ab1db9e13c8fe316b85a296b6cf220f883e
d55d6977d61fa497ea39c025faa61a70af35d49ade52b3a8af137a066e9a5862
da62720b7c3e8d6eef182fb69b2002926da8512532e6de9a1de0396a71a02413
dd24d493e315f56b0f3f3ab2b22d970a4b0aa465208bd6a5953a22e0b3d82eb5
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
e06bff99505017fa9b63d5a432f579a856661ce141325b33e78770dff671877e
e1bcf2aae786aa72292ec28f330390b1e324f4c273f9ca993150b5163620d862
e25fda010a8abe8a4743d78769ddf7d875b48b306ee4a9409bf03ac5f9aa29e4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d5684523c3de8ab2ac3bca237d12e4affbb4d4b39a41109d975a489fa12427
e3e5d854d0bb64955b7d26019c608ce975fe7f184f7bf7e4daec2756d56451c1
e5d56fe59d66dbc305c2cf34cbdc44d372993747d08689f3f5d618d6d0fede13
e5f4f96e32a749a3c07b566aceb9b84a8445c71ca9713a4bfce9b7d28731fc33
e72d0734bc15008c6d89a4087da5ebcc55a739654f70ef857645a4f000304ff7
e922a199c0736d84f1cb215cb5950484e8cf7c04011a35ccf28fd755aa5e7133
ec524598ddf4023dd0b31be3f2ac1dc5a35736f876c3c6b59fa9c3d5cf416454
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efb4176046184158d84ee90507639923053873963beac357285b8653289de00a
f164b39a16618e24f0fd121a274768bc24760f8778d4a3b5457a5e03ddd0c53f
f1ae9c2026aa097e604015d4bd47dca4778ac704f883659be7b4b312be583342
f2675d651e6b07cb28a520c2d408e9098421238198195ffb981917eb8c5b216e
f64677954eef2eeffed47aabe1fa8b3ba4221dab739945ce652d74b249720a00
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f673a8adc98789a6eca1dd65c67fb782787f2571ba2730bb8c5f69bea7b5bc0f
f6f14681142e16db6027f013840dc46f68cce2f3c5ccf8814d2361d06b5127d8
f724f399b193e3b199cb52a6ce3071b64bb16e6bb85a83a0d1d1e33f49d67ccb
f84a7505f46f37055864aab5c4c9bae2919006e4a985556e7a620300beb90953
fbc660ddb9e34a1d5cceedd042e27a1f78921d4caab2d8f42eb3a095cd65454c
fdbe800cb201919c0d1fd1fdf03832e544f7b41678adfcdf9d5750660d0d5fdf
fe8b3c376366178fa7b6f712cfa3adbd234eaa467b606dd2ac739a5d2f6e4c82