urlscan.io logo urlscan.io
SecurityTrails logo

www.mercurynews.com Open in urlscan Pro
192.0.66.2  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tell...
Effective URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tell...
Submission: On June 20 via api from US — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 174 IPs in 13 countries across 175 domains to perform 1030 HTTP transactions. The main IP is 192.0.66.2, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is www.mercurynews.com. The Cisco Umbrella rank of the primary domain is 65849.
TLS certificate: Issued by R3 on May 21st 2023. Valid for: 3 months.
This is the only time www.mercurynews.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 28 192.0.66.2 2635 (AUTOMATTIC)
2 13.33.60.66 16509 (AMAZON-02)
3 2a04:4e42::485 54113 (FASTLY)
4 2607:f8b0:400... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
4 2607:f8b0:400... 15169 (GOOGLE)
1 2600:9000:251... 16509 (AMAZON-02)
3 2607:f8b0:400... 15169 (GOOGLE)
1 143.204.146.34 16509 (AMAZON-02)
16 18.164.96.113 16509 (AMAZON-02)
3 2600:9000:251... 16509 (AMAZON-02)
1 20.60.62.4 8075 (MICROSOFT...)
2 13.225.214.18 16509 (AMAZON-02)
1 18.164.101.60 16509 (AMAZON-02)
1 2600:9000:21d... 16509 (AMAZON-02)
18 2607:f8b0:400... 15169 (GOOGLE)
2 192.0.76.3 2635 (AUTOMATTIC)
2 2606:2800:11f... 15133 (EDGECAST)
1 2a04:4e42::282 54113 (FASTLY)
4 54.218.39.135 16509 (AMAZON-02)
3 52.200.130.143 14618 (AMAZON-AES)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
40 151.101.129.44 54113 (FASTLY)
5 2607:f8b0:400... 15169 (GOOGLE)
7 2607:f8b0:400... 15169 (GOOGLE)
1 52.205.167.202 14618 (AMAZON-AES)
4 35.190.38.143 15169 (GOOGLE)
3 108.138.107.138 16509 (AMAZON-02)
3 5 2620:116:800b... 14618 (AMAZON-AES)
2 4 207.198.113.205 13768 (COGECO-PEER1)
2 2606:4700:440... 13335 (CLOUDFLAR...)
1 13.35.93.111 16509 (AMAZON-02)
2 6 108.139.47.33 16509 (AMAZON-02)
8 2606:2800:11f... 15133 (EDGECAST)
1 2600:1f18:44f... 14618 (AMAZON-AES)
3 192.0.77.48 2635 (AUTOMATTIC)
2 137.184.240.117 14061 (DIGITALOC...)
1 2600:9000:21d... 16509 (AMAZON-02)
9 20 2620:100:a001::c 19750 (AS-CRITEO)
12 2607:f8b0:400... 15169 (GOOGLE)
1 2 107.178.250.234 396982 (GOOGLE-CL...)
1 23.7.4.170 16625 (AKAMAI-AS)
3 4 54.149.73.110 16509 (AMAZON-02)
4 8 34.111.113.62 396982 (GOOGLE-CL...)
2 2 34.229.3.43 14618 (AMAZON-AES)
1 2a02:6ea0:c40... 60068 (CDN77 ^_^)
1 23.49.101.144 16625 (AKAMAI-AS)
1 4 52.72.123.193 14618 (AMAZON-AES)
1 34.199.123.15 14618 (AMAZON-AES)
1 2600:9000:220... 16509 (AMAZON-02)
9 2620:100:a001... 19750 (AS-CRITEO)
1 6 54.164.127.24 14618 (AMAZON-AES)
9 104.36.115.111 62713 (AS-PUBMATIC)
1 3.226.65.198 14618 (AMAZON-AES)
11 2602:803:c002... 26667 (RUBICONPR...)
6 29 68.67.160.186 29990 (ASN-APPNEX)
1 104.18.25.185 13335 (CLOUDFLAR...)
1 18.164.107.227 16509 (AMAZON-02)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
1 2600:9000:251... 16509 (AMAZON-02)
16 2620:100:a001::4 19750 (AS-CRITEO)
2 18.164.116.84 16509 (AMAZON-02)
1 23.77.173.155 16625 (AKAMAI-AS)
2 2600:9000:23c... 16509 (AMAZON-02)
35 2607:f8b0:400... 15169 (GOOGLE)
1 18.164.116.107 16509 (AMAZON-02)
5 2607:f8b0:400... 15169 (GOOGLE)
31 2607:f8b0:400... 15169 (GOOGLE)
1 54.231.171.65 16509 (AMAZON-02)
1 172.67.75.166 13335 (CLOUDFLAR...)
1 3.5.10.155 14618 (AMAZON-AES)
1 3.12.100.41 16509 (AMAZON-02)
5 54.162.81.74 14618 (AMAZON-AES)
9 10 162.19.138.119 16276 (OVH)
2 22 52.46.151.131 16509 (AMAZON-02)
4 3.228.62.117 14618 (AMAZON-AES)
4 2a03:2880:f01... 32934 (FACEBOOK)
2 17 141.226.224.48 200478 (TABOOLA-AS)
6 10 68.67.181.211 29990 (ASN-APPNEX)
20 2607:f8b0:400... 15169 (GOOGLE)
1 23.44.133.37 20940 (AKAMAI-ASN1)
9 52.45.73.233 14618 (AMAZON-AES)
1 1 2600:1f18:730... 14618 (AMAZON-AES)
1 3.233.112.95 14618 (AMAZON-AES)
7 2607:f8b0:400... 15169 (GOOGLE)
4 2607:f8b0:400... 15169 (GOOGLE)
2 52.85.61.61 16509 (AMAZON-02)
4 2620:1ec:c11:... 8068 (MICROSOFT...)
1 1 23.198.216.24 16625 (AKAMAI-AS)
2 2 2600:9000:220... 16509 (AMAZON-02)
1 2 52.1.59.237 14618 (AMAZON-AES)
3 12 192.40.39.223 27381 (CASALE-MEDIA)
3 4 216.22.16.5 30633 (LEASEWEB-...)
6 6 2606:ae80:147... 25751 (VALUECLICK)
15 21 3.217.98.147 14618 (AMAZON-AES)
10 23.77.173.8 16625 (AKAMAI-AS)
1 23.47.144.133 20940 (AKAMAI-ASN1)
1 54.208.104.226 14618 (AMAZON-AES)
20 184.28.206.17 16625 (AKAMAI-AS)
4 8 198.148.27.140 19189 (PULSEPOINT)
2 44.209.177.129 14618 (AMAZON-AES)
9 9 63.251.86.50 10913 (INTERNAP-BLK)
1 6 23.92.190.74 32475 (SINGLEHOP...)
13 3.227.148.228 14618 (AMAZON-AES)
3 6 52.223.22.214 16509 (AMAZON-02)
1 20 54.87.127.173 14618 (AMAZON-AES)
25 25 35.211.178.172 19527 (GOOGLE-2)
7 7 185.167.164.37 198622 (ADFORM)
4 4 54.205.93.130 14618 (AMAZON-AES)
6 6 64.202.112.223 22075 (AS-OUTBRAIN)
4 5 23.197.21.62 16625 (AKAMAI-AS)
3 4 70.42.32.159 13789 (INTERNAP-...)
3 3 34.235.229.58 14618 (AMAZON-AES)
6 8 35.244.159.8 15169 (GOOGLE)
3 4 2600:1f18:4e9... 14618 (AMAZON-AES)
2 2 52.0.201.47 14618 (AMAZON-AES)
2 2 2603:c020:400... 31898 (ORACLE-BM...)
1 2 38.91.45.7 398989 (DEEPINTENT)
25 25 15.197.193.217 16509 (AMAZON-02)
21 26 142.250.80.34 15169 (GOOGLE)
10 10 44.193.243.239 14618 (AMAZON-AES)
1 1 34.96.71.22 396982 (GOOGLE-CL...)
1 2600:1f18:61c... 14618 (AMAZON-AES)
9 74.119.119.139 19750 (AS-CRITEO)
1 1 67.202.105.21 32748 (STEADFAST)
5 6 8.28.7.82 62713 (AS-PUBMATIC)
2 11 162.248.18.37 62713 (AS-PUBMATIC)
1 23.49.100.28 16625 (AKAMAI-AS)
3 3 35.214.170.123 15169 (GOOGLE)
8 8 63.251.28.234 26558 (FREEWHEEL)
2 2 69.166.1.10 27630 (AS-XFERNET)
2 2 3.225.218.10 14618 (AMAZON-AES)
1 174.137.133.32 27257 (WEBAIR-IN...)
1 8.2.111.13 46636 (NATCOWEB)
6 7 74.121.140.211 30419 (MEDIAMATH...)
5 6 151.101.194.49 54113 (FASTLY)
2 2 124.146.215.50 2514 (INFOSPHER...)
2 2 80.77.87.166 46636 (NATCOWEB)
26 31 199.127.204.142 26120 (RHYTHMONE)
4 4 2620:112:f002... 6336 (TURN-US-ASN)
9 52.85.61.58 16509 (AMAZON-02)
15 23.77.172.245 16625 (AKAMAI-AS)
7 151.101.65.108 54113 (FASTLY)
26 68.67.179.155 29990 (ASN-APPNEX)
2 2 104.127.84.215 16625 (AKAMAI-AS)
1 51.222.39.185 16276 (OVH)
11 11 185.184.8.90 204995 (RTB-HOUSE...)
1 34.96.105.8 396982 (GOOGLE-CL...)
3 3 207.198.113.87 13768 (COGECO-PEER1)
2 2 18.195.69.47 16509 (AMAZON-02)
8 11 8.43.72.97 26667 (RUBICONPR...)
1 1 35.208.249.213 15169 (GOOGLE)
2 23 8.28.7.83 62713 (AS-PUBMATIC)
9 36 23.105.12.173 30633 (LEASEWEB-...)
4 4 74.119.119.150 19750 (AS-CRITEO)
3 7 104.36.115.113 62713 (AS-PUBMATIC)
2 2 50.57.31.206 19994 (RACKSPACE)
1 1 204.62.13.72 46636 (NATCOWEB)
2 2 35.207.24.140 15169 (GOOGLE)
1 82.145.213.8 39832 (NO-OPERA)
1 2607:f8b0:400... 15169 (GOOGLE)
4 8 3.223.184.50 14618 (AMAZON-AES)
1 1 192.132.33.46 18568 (BIDTELLECT)
3 3 8.43.72.98 26667 (RUBICONPR...)
1 1 2620:112:f002... 6336 (TURN-US-ASN)
2 2600:1f18:ed:... 14618 (AMAZON-AES)
2 2 108.138.106.60 16509 (AMAZON-02)
2 2 199.38.167.130 54312 (ROCKETFUEL)
3 6 35.190.60.146 15169 (GOOGLE)
1 2620:1ec:21::14 8068 (MICROSOFT...)
3 52.94.223.167 16509 (AMAZON-02)
1 2a04:4e42:600... 54113 (FASTLY)
1 2 52.6.79.203 14618 (AMAZON-AES)
2 2 34.170.123.2 396982 (GOOGLE-CL...)
1 141.226.224.32 200478 (TABOOLA-AS)
8 2606:4700:20:... 13335 (CLOUDFLAR...)
8 216.22.16.0 30633 (LEASEWEB-...)
87 104.22.68.131 13335 (CLOUDFLAR...)
7 15 37.157.5.84 198622 (ADFORM)
2 52.6.180.113 14618 (AMAZON-AES)
4 8 107.178.244.119 15169 (GOOGLE)
4 143.204.146.97 16509 (AMAZON-02)
2 52.116.53.150 36351 (SOFTLAYER)
6 142.250.64.70 15169 (GOOGLE)
2 34.95.69.49 396982 (GOOGLE-CL...)
12 142.251.40.98 15169 (GOOGLE)
6 2607:f8b0:400... 15169 (GOOGLE)
24 108.139.29.93 16509 (AMAZON-02)
8 2600:1400:900... 20940 (AKAMAI-ASN1)
5 162.248.18.34 62713 (AS-PUBMATIC)
8 34.117.228.201 396982 (GOOGLE-CL...)
1 54.204.174.60 14618 (AMAZON-AES)
1 54.229.88.75 16509 (AMAZON-02)
1 1 3.224.103.82 14618 (AMAZON-AES)
4 13.85.16.224 8075 (MICROSOFT...)
1 15.235.42.104 16276 (OVH)
11 15 3.221.8.21 14618 (AMAZON-AES)
1 1 195.244.31.10 63140 (IGUANA-WO...)
1 1 85.114.159.118 24961 (MYLOC-AS ...)
1 2600:1f18:1c9... 14618 (AMAZON-AES)
1 1 18.224.253.134 16509 (AMAZON-02)
2 2 173.231.178.82 32475 (SINGLEHOP...)
2 2 54.205.17.152 14618 (AMAZON-AES)
1 2 34.197.223.55 14618 (AMAZON-AES)
1 1 69.90.254.78 13768 (COGECO-PEER1)
1 1 34.102.163.6 396982 (GOOGLE-CL...)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
1 1 172.105.235.90 63949 (AKAMAI-LI...)
1 35.186.193.173 15169 (GOOGLE)
1 1 20.85.134.6 8075 (MICROSOFT...)
1 157.90.40.26 24940 (HETZNER-AS)
1 195.5.165.20 44968 (IPROM-AS)
2 2 2.22.1.179 16625 (AKAMAI-AS)
2 2 107.178.254.65 15169 (GOOGLE)
1 1 34.98.67.3 396982 (GOOGLE-CL...)
1 34.204.156.95 14618 (AMAZON-AES)
1 54.165.35.122 14618 (AMAZON-AES)
1 2 38.98.69.175 174 (COGENT-174)
1 1 34.102.253.54 396982 (GOOGLE-CL...)
1 1 134.122.57.34 14061 (DIGITALOC...)
18 23 162.55.233.29 24940 (HETZNER-AS)
14 14 96.46.183.20 7979 (SERVERS-COM)
2 2 44.208.128.231 14618 (AMAZON-AES)
14 14 8.2.108.194 46636 (NATCOWEB)
1 1 35.190.90.30 15169 (GOOGLE)
8 9 192.35.249.137 11742 (SPOTX-IAD)
1 1 54.205.191.114 14618 (AMAZON-AES)
1 1 23.235.251.211 19437 (SS-ASH)
1 2 54.205.176.242 14618 (AMAZON-AES)
1 52.85.61.83 16509 (AMAZON-02)
3 3 3.222.255.203 14618 (AMAZON-AES)
3 34.238.35.16 14618 (AMAZON-AES)
2 104.45.136.42 8075 (MICROSOFT...)
7 2a03:2880:f11... 32934 (FACEBOOK)
1030 174
28    192.0.66.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
www.mercurynews.com
2    13.33.60.66 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-60-66.ewr52.r.cloudfront.net
htlbid.com
3    2a04:4e42::485 (United States)

ASN54113 (FASTLY, US)
cdn.jsdelivr.net
4    2607:f8b0:4006:81c::200a (Flushing, United States)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2607:f8b0:4006:80f::200a (Flushing, United States)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
4    2607:f8b0:4006:80a::200a (Flushing, United States)

ASN15169 (GOOGLE, US)
maps.googleapis.com
1    2600:9000:2511:a00:10:474e:104a:2961 (United States)

ASN16509 (AMAZON-02, US)
cdn.auth0.com
3    2607:f8b0:4006:81d::200d (Flushing, United States)

ASN15169 (GOOGLE, US)
accounts.google.com
1    143.204.146.34 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-146-34.ewr52.r.cloudfront.net
cdn.p-n.io
16    18.164.96.113 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-96-113.jfk50.r.cloudfront.net
a869.mercurynews.com
3    2600:9000:2510:f400:3:b7e:8940:93a1 (United States)

ASN16509 (AMAZON-02, US)
cmp.osano.com
1    20.60.62.4 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
prodmg2.blob.core.windows.net
2    13.225.214.18 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-214-18.ewr50.r.cloudfront.net
tags.remixd.com
1    18.164.101.60 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-101-60.jfk50.r.cloudfront.net
cdn.parsely.com
1    2600:9000:21dd:4800:8:2ae1:d740:93a1 (United States)

ASN16509 (AMAZON-02, US)
cdn.viafoura.net
18    2607:f8b0:4006:824::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)
securepubads.g.doubleclick.net
2    192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
stats.wp.com
pixel.wp.com
2    2606:2800:11f:17a5:191a:18d5:537:22f9 (United States)

ASN15133 (EDGECAST, US)
az416426.vo.msecnd.net
1    2a04:4e42::282 (United States)

ASN54113 (FASTLY, US)
polyfill.io
4    54.218.39.135 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-218-39-135.us-west-2.compute.amazonaws.com
session.mercurynews.com
3    52.200.130.143 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-200-130-143.compute-1.amazonaws.com
digitalfirstmedia.blueconic.net
2    2606:4700::6810:7aaf (United States)

ASN13335 (CLOUDFLARENET, US)
unpkg.com
40    151.101.129.44 (United States)

ASN54113 (FASTLY, US)
cdn.taboola.com
pm-widget.taboola.com
trc.taboola.com
vidstat.taboola.com
images.taboola.com
imprnjmp.taboola.com
match.taboola.com
5    2607:f8b0:4006:820::2008 (Flushing, United States)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
7    2607:f8b0:4006:820::2003 (Flushing, United States)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    52.205.167.202 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-205-167-202.compute-1.amazonaws.com
p1.parsely.com
4    35.190.38.143 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 143.38.190.35.bc.googleusercontent.com
pubcast-files.remixd.com
player-files.remixd.com
3    108.138.107.138 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-107-138.jfk50.r.cloudfront.net
c.amazon-adsystem.com
5    2620:116:800b:21:a021:b886:81cc:55cf (United States)

ASN14618 (AMAZON-AES, US)
secure.quantserve.com
pixel.quantserve.com
cms.quantserve.com
4    207.198.113.205 (Herndon, United States)

ASN13768 (COGECO-PEER1, CA)
pixel.sitescout.com
2    2606:4700:4400::6812:220a (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.confiant-integrations.net
1    13.35.93.111 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-93-111.jfk50.r.cloudfront.net
launchpad-wrapper.privacymanager.io
6    108.139.47.33 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-139-47-33.jfk50.r.cloudfront.net
sb.scorecardresearch.com
8    2606:2800:11f:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)
loader-cdn.azureedge.net
fp-cdn.azureedge.net
g2insights-cdn.azureedge.net
cdn.czx5eyk0exbhwp43ya.biz
cdn.pranmcpkx.com
1    2600:1f18:44f0:4851:acd5:7304:ba6b:1c44 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
api.viafoura.co
3    192.0.77.48 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: s.w.org
s.w.org
2    137.184.240.117 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
www.foo.software
1    2600:9000:21dd:e400:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
rules.quantcount.com
20    2620:100:a001::c (United States)

ASN19750 (AS-CRITEO, US)
gum.criteo.com
12    2607:f8b0:4006:817::200e (Flushing, United States)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    107.178.250.234 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 234.250.178.107.bc.googleusercontent.com
js.matheranalytics.com
1    23.7.4.170 (Bogotá, Colombia)

ASN16625 (AKAMAI-AS, US)
PTR: a23-7-4-170.deploy.static.akamaitechnologies.com
s.btstatic.com
4    54.149.73.110 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-149-73-110.us-west-2.compute.amazonaws.com
dpm.demdex.net
8    34.111.113.62 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com
pixel.tapad.com
2    34.229.3.43 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-229-3-43.compute-1.amazonaws.com
loadm.exelator.com
1    2a02:6ea0:c400::12 (New York, United States)

ASN60068 (CDN77 ^_^, GB)
load77.exelator.com
1    23.49.101.144 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-49-101-144.deploy.static.akamaitechnologies.com
sync.teads.tv
4    52.72.123.193 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-72-123-193.compute-1.amazonaws.com
sync.crwdcntrl.net
bcp.crwdcntrl.net
1    34.199.123.15 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-199-123-15.compute-1.amazonaws.com
i.viafoura.co
1    2600:9000:2209:cc00:1:a3fa:7cc0:93a1 (United States)

ASN16509 (AMAZON-02, US)
cdn.jwplayer.com
9    2620:100:a001::18 (United States)

ASN19750 (AS-CRITEO, US)
bidder.criteo.com
6    54.164.127.24 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-164-127-24.compute-1.amazonaws.com
ads.yieldmo.com
9    104.36.115.111 (United States)

ASN62713 (AS-PUBMATIC, US)
hbopenbid.pubmatic.com
1    3.226.65.198 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-226-65-198.compute-1.amazonaws.com
tlx.3lift.com
11    2602:803:c002:300::99 (United States)

ASN26667 (RUBICONPROJECT, US)
fastlane.rubiconproject.com
29    68.67.160.186 (New York, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
ib.adnxs.com
1    104.18.25.185 (None, )

ASN13335 (CLOUDFLARENET, US)
htlb.casalemedia.com
1    18.164.107.227 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-107-227.jfk50.r.cloudfront.net
aax.amazon-adsystem.com
1    2606:4700:10::ac43:266a (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.id5-sync.com
1    2600:9000:2511:8000:a:e047:753:be1 (United States)

ASN16509 (AMAZON-02, US)
cdn.prod.uidapi.com
16    2620:100:a001::4 (United States)

ASN19750 (AS-CRITEO, US)
static.criteo.net
2    18.164.116.84 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-116-84.jfk50.r.cloudfront.net
consent.api.osano.com
1    23.77.173.155 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-77-173-155.deploy.static.akamaitechnologies.com
s.ntv.io
2    2600:9000:23cb:4200:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)
b-code.liadm.com
35    2607:f8b0:4006:80d::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
pagead2.googlesyndication.com
1    18.164.116.107 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-116-107.jfk50.r.cloudfront.net
launchpad.privacymanager.io
5    2607:f8b0:4006:80b::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)
adservice.google.com
31    2607:f8b0:4006:817::2001 (Flushing, United States)

ASN15169 (GOOGLE, US)
7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com
cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com
tpc.googlesyndication.com
1    54.231.171.65 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com
ams-pageview-public.s3.amazonaws.com
1    172.67.75.166 (United States)

ASN13335 (CLOUDFLARENET, US)
api-mg2.db-ip.com
1    3.5.10.155 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: s3-1-w.amazonaws.com
paywall-ad-bucket.s3.amazonaws.com
1    3.12.100.41 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-12-100-41.us-east-2.compute.amazonaws.com
s.thebrighttag.com
5    54.162.81.74 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-162-81-74.compute-1.amazonaws.com
www.i.matheranalytics.com
10    162.19.138.119 (France)

ASN16276 (OVH, FR)
PTR: ns31533570.ip-162-19-138.eu
id5-sync.com
22    52.46.151.131 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
s.amazon-adsystem.com
4    3.228.62.117 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-228-62-117.compute-1.amazonaws.com
jadserve.postrelease.com
4    2a03:2880:f012:10c:face:b00c:0:3 (Secaucus, United States)

ASN32934 (FACEBOOK, US)
connect.facebook.net
17    141.226.224.48 (United States)

ASN200478 (TABOOLA-AS, IL)
us-trc-events.taboola.com
us-match.taboola.com
us-vid-events.taboola.com
sync.taboola.com
sync-t1.taboola.com
10    68.67.181.211 (North Bergen, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
secure.adnxs.com
20    2607:f8b0:4006:80f::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)
www.googletagservices.com
1    23.44.133.37 (Piscataway, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-44-133-37.deploy.static.akamaitechnologies.com
js.moatads.com
9    52.45.73.233 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-45-73-233.compute-1.amazonaws.com
protected-by.clarium.io
1    2600:1f18:730:b150:2f0a:ae34:6b51:61cf (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
rp.liadm.com
1    3.233.112.95 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-233-112-95.compute-1.amazonaws.com
rp4.liadm.com
7    2607:f8b0:4006:81c::2004 (Flushing, United States)

ASN15169 (GOOGLE, US)
www.google.com
4    2607:f8b0:4006:822::2003 (Flushing, United States)

ASN15169 (GOOGLE, US)
www.google.ca
2    52.85.61.61 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-61.ewr53.r.cloudfront.net
geo.privacymanager.io
4    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
1    23.198.216.24 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-198-216-24.deploy.static.akamaitechnologies.com
cs.media.net
2    2600:9000:2209:e800:1b:5138:8a40:93a1 (United States)

ASN16509 (AMAZON-02, US)
s.ad.smaato.net
2    52.1.59.237 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-1-59-237.compute-1.amazonaws.com
rtb.gumgum.com
12    192.40.39.223 (Canada)

ASN27381 (CASALE-MEDIA, CA)
ssum-sec.casalemedia.com
dsum-sec.casalemedia.com
dsum.casalemedia.com
4    216.22.16.5 (Manassas, United States)

ASN30633 (LEASEWEB-USA-WDC, US)
ssbsync-us.smartadserver.com
ssbsync.smartadserver.com
6    2606:ae80:1471:16::760 (United States)

ASN25751 (VALUECLICK, US)
amazon-tam-match.dotomi.com
pulsepoint-match.dotomi.com
pubmatic-match.dotomi.com
21    3.217.98.147 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-217-98-147.compute-1.amazonaws.com
match.sharethrough.com
10    23.77.173.8 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-77-173-8.deploy.static.akamaitechnologies.com
ads.pubmatic.com
1    23.47.144.133 (Hillsboro, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-47-144-133.deploy.static.akamaitechnologies.com
sli.mercurynews.com
1    54.208.104.226 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-208-104-226.compute-1.amazonaws.com
sync-amz.ads.yieldmo.com
20    184.28.206.17 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-28-206-17.deploy.static.akamaitechnologies.com
eus.rubiconproject.com
8    198.148.27.140 (New York, United States)

ASN19189 (PULSEPOINT, US)
bh.contextweb.com
2    44.209.177.129 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-209-177-129.compute-1.amazonaws.com
crb.kargo.com
9    63.251.86.50 (United States)

ASN10913 (INTERNAP-BLK, US)
ap.lijit.com
6    23.92.190.74 (Houston, United States)

ASN32475 (SINGLEHOP-LLC, US)
ce.lijit.com
13    3.227.148.228 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-227-148-228.compute-1.amazonaws.com
cs-server-s2s.yellowblue.io
cs.yellowblue.io
6    52.223.22.214 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com
eb2.3lift.com
20    54.87.127.173 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-87-127-173.compute-1.amazonaws.com
usersync.gumgum.com
25    35.211.178.172 (North Charleston, United States)

ASN19527 (GOOGLE-2, US)
PTR: 172.178.211.35.bc.googleusercontent.com
x.bidswitch.net
7    185.167.164.37 (Denmark)

ASN198622 (ADFORM, DK)
c1.adform.net
dmp.adform.net
4    54.205.93.130 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-205-93-130.compute-1.amazonaws.com
sync.srv.stackadapt.com
6    64.202.112.223 (Chicago, United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com
b1sync.zemanta.com
5    23.197.21.62 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-197-21-62.deploy.static.akamaitechnologies.com
stags.bluekai.com
x.dlx.addthis.com
4    70.42.32.159 (United States)

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com
sync.outbrain.com
3    34.235.229.58 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-235-229-58.compute-1.amazonaws.com
ice.360yield.com
ad.360yield.com
8    35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com
us-u.openx.net
u.openx.net
eu-u.openx.net
4    2600:1f18:4e9:5a05:3fdd:1e3f:2ebe:5c68 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
pr-bh.ybp.yahoo.com
2    52.0.201.47 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-0-201-47.compute-1.amazonaws.com
sync.ipredictive.com
2    2603:c020:400d:3000:67b7:1059:7283:c690 (Ashburn, United States)

ASN31898 (ORACLE-BMC-31898, US)
sync.technoratimedia.com
2    38.91.45.7 (United States)

ASN398989 (DEEPINTENT, US)
match.deepintent.com
25    15.197.193.217 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com
match.adsrvr.org
insight.adsrvr.org
26    142.250.80.34 (Staten Island, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s34-in-f2.1e100.net
cm.g.doubleclick.net
10    44.193.243.239 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-193-243-239.compute-1.amazonaws.com
match.prod.bidr.io
1    34.96.71.22 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.71.96.34.bc.googleusercontent.com
s.company-target.com
1    2600:1f18:61c0:2204:b513:b8fc:2d8f:8df9 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
d.adroll.com
9    74.119.119.139 (United States)

ASN19750 (AS-CRITEO, US)
mug.criteo.com
1    67.202.105.21 (Palos Park, United States)

ASN32748 (STEADFAST, US)
PTR: ip21.67-202-105.static.steadfastdns.net
ssc-cms.33across.com
6    8.28.7.82 (United States)

ASN62713 (AS-PUBMATIC, US)
image8.pubmatic.com
11    162.248.18.37 (United States)

ASN62713 (AS-PUBMATIC, US)
image2.pubmatic.com
1    23.49.100.28 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-49-100-28.deploy.static.akamaitechnologies.com
contextual.media.net
3    35.214.170.123 (Groningen, Netherlands)

ASN15169 (GOOGLE, US)
PTR: 123.170.214.35.bc.googleusercontent.com
csync.loopme.me
8    63.251.28.234 (United States)

ASN26558 (FREEWHEEL, US)
ads.stickyadstv.com
2    69.166.1.10 (United States)

ASN27630 (AS-XFERNET, US)
sync.go.sonobi.com
2    3.225.218.10 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-218-10.compute-1.amazonaws.com
ups.analytics.yahoo.com
1    174.137.133.32 (United States)

ASN27257 (WEBAIR-INTERNET, US)
sync.adkernel.com
1    8.2.111.13 (United States)

ASN46636 (NATCOWEB, US)
cs.iqzone.com
7    74.121.140.211 (Reston, United States)

ASN30419 (MEDIAMATH-INC, US)
sync.mathtag.com
6    151.101.194.49 (United States)

ASN54113 (FASTLY, US)
sync-tm.everesttech.net
2    124.146.215.50 (Japan)

ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP)
tg.socdm.com
2    80.77.87.166 (Clifton, United States)

ASN46636 (NATCOWEB, US)
cs.admanmedia.com
31    199.127.204.142 (United States)

ASN26120 (RHYTHMONE, US)
sync.1rx.io
sync.targeting.unrulymedia.com
4    2620:112:f002:bbbb::21 (United States)

ASN6336 (TURN-US-ASN, US)
ad.turn.com
9    52.85.61.58 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-58.ewr53.r.cloudfront.net
sopalk.com
15    23.77.172.245 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-77-172-245.deploy.static.akamaitechnologies.com
acdn.adnxs.com
acdn.adnxs-simple.com
7    151.101.65.108 (United States)

ASN54113 (FASTLY, US)
cdn.adnxs.com
26    68.67.179.155 (North Bergen, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
nym1-ib.adnxs.com
2    104.127.84.215 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-127-84-215.deploy.static.akamaitechnologies.com
secure-assets.rubiconproject.com
1    51.222.39.185 (Canada)

ASN16276 (OVH, FR)
PTR: ip185.ip-51-222-39.net
onetag-sys.com
11    185.184.8.90 (Amsterdam, Netherlands)

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-90.rtbhouse.net
creativecdn.com
1    34.96.105.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.105.96.34.bc.googleusercontent.com
tr.blismedia.com
3    207.198.113.87 (Herndon, United States)

ASN13768 (COGECO-PEER1, CA)
pixel-sync.sitescout.com
2    18.195.69.47 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-69-47.eu-central-1.compute.amazonaws.com
ih.adscale.de
11    8.43.72.97 (United States)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
token.rubiconproject.com
1    35.208.249.213 (Council Bluffs, United States)

ASN15169 (GOOGLE, US)
PTR: 213.249.208.35.bc.googleusercontent.com
trace.mediago.io
23    8.28.7.83 (United States)

ASN62713 (AS-PUBMATIC, US)
simage2.pubmatic.com
36    23.105.12.173 (Manassas, United States)

ASN30633 (LEASEWEB-USA-WDC, US)
rtb-csync.smartadserver.com
4    74.119.119.150 (United States)

ASN19750 (AS-CRITEO, US)
dis.criteo.com
7    104.36.115.113 (United States)

ASN62713 (AS-PUBMATIC, US)
image6.pubmatic.com
2    50.57.31.206 (United States)

ASN19994 (RACKSPACE, US)
uipglob.semasio.net
1    204.62.13.72 (Clifton, United States)

ASN46636 (NATCOWEB, US)
inv-nets.admixer.net
2    35.207.24.140 (North Charleston, United States)

ASN15169 (GOOGLE, US)
PTR: 140.24.207.35.bc.googleusercontent.com
rtb.mfadsrvr.com
1    82.145.213.8 (Norway)

ASN39832 (NO-OPERA, NO)
PTR: n-sysadmin-jumpbox-03.feednews.opera.technology
t.adx.opera.com
1    2607:f8b0:4004:c08::9b (Ashburn, United States)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
8    3.223.184.50 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-223-184-50.compute-1.amazonaws.com
i.liadm.com
1    192.132.33.46 (United States)

ASN18568 (BIDTELLECT, US)
PTR: 46.bidtellect.com
bttrack.com
3    8.43.72.98 (United States)

ASN26667 (RUBICONPROJECT, US)
pixel-us-east.rubiconproject.com
1    2620:112:f002:bbbb::23 (United States)

ASN6336 (TURN-US-ASN, US)
d.turn.com
2    2600:1f18:ed:550e:4578:8034:184b:4f8b (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
i6.liadm.com
2    108.138.106.60 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-106-60.jfk50.r.cloudfront.net
live.rezync.com
2    199.38.167.130 (United States)

ASN54312 (ROCKETFUEL, US)
p.rfihub.com
6    35.190.60.146 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com
idsync.rlcdn.com
id.rlcdn.com
1    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
3    52.94.223.167 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
aax-eu.amazon-adsystem.com
1    2a04:4e42:600::300 (United States)

ASN54113 (FASTLY, US)
pips.taboola.com
2    52.6.79.203 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-6-79-203.compute-1.amazonaws.com
thrtle.com
2    34.170.123.2 (Council Bluffs, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 2.123.170.34.bc.googleusercontent.com
um.simpli.fi
1    141.226.224.32 (United States)

ASN200478 (TABOOLA-AS, IL)
cds.taboola.com
8    2606:4700:20::ac43:49e4 (United States)

ASN13335 (CLOUDFLARENET, US)
hb.adpone.com
8    216.22.16.0 (Manassas, United States)

ASN30633 (LEASEWEB-USA-WDC, US)
prg.smartadserver.com
87    104.22.68.131 (None, )

ASN13335 (CLOUDFLARENET, US)
prebid.smilewanted.com
csync.smilewanted.com
static.smilewanted.com
15    37.157.5.84 (Denmark)

ASN198622 (ADFORM, DK)
adx.adform.net
cm.adform.net
2    52.6.180.113 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-6-180-113.compute-1.amazonaws.com
k.p-n.io
8    107.178.244.119 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 119.244.178.107.bc.googleusercontent.com
beacon.sojern.com
pixel.sojern.com
4    143.204.146.97 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-146-97.ewr52.r.cloudfront.net
choices.truste.com
2    52.116.53.150 (United States)

ASN36351 (SOFTLAYER, US)
PTR: 96.35.7434.ip4.static.sl-reverse.com
8proof.com
6    142.250.64.70 (Staten Island, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s30-in-f6.1e100.net
ad.doubleclick.net
2    34.95.69.49 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 49.69.95.34.bc.googleusercontent.com
i.clean.gg
12    142.251.40.98 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s79-in-f2.1e100.net
googleads4.g.doubleclick.net
6    2607:f8b0:4006:824::2006 (Flushing, United States)

ASN15169 (GOOGLE, US)
s0.2mdn.net
24    108.139.29.93 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-139-29-93.jfk50.r.cloudfront.net
choices.trustarc.com
8    2600:1400:9000::6875:b612 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)
cdn.doubleverify.com
5    162.248.18.34 (United States)

ASN62713 (AS-PUBMATIC, US)
simage4.pubmatic.com
image4.pubmatic.com
8    34.117.228.201 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 201.228.117.34.bc.googleusercontent.com
tps.doubleverify.com
tpsc-ue1.doubleverify.com
1    54.204.174.60 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-204-174-60.compute-1.amazonaws.com
sync.bfmio.com
1    54.229.88.75 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-229-88-75.eu-west-1.compute.amazonaws.com
synchroscript.deliveryengine.adswizz.com
1    3.224.103.82 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-224-103-82.compute-1.amazonaws.com
sonata-notifications.taptapnetworks.com
4    13.85.16.224 (San Antonio, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
prod-dfm-proxy-connext.azurewebsites.net
1    15.235.42.104 (Victoria, Canada)

ASN16276 (OVH, FR)
PTR: haproxy-ca-003.roqad.pl
wt.rqtrk.eu
15    3.221.8.21 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-221-8-21.compute-1.amazonaws.com
a.audrte.com
1    195.244.31.10 (Newark, United States)

ASN63140 (IGUANA-WORLDWIDE, US)
visitor.omnitagjs.com
1    85.114.159.118 (Bad Durrheim, Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: dsp.adfarm1.adition.com
dsp.adfarm1.adition.com
1    2600:1f18:1c96:4102:4bd7:5264:40b8:b37 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
sync.tidaltv.com
1    18.224.253.134 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-224-253-134.us-east-2.compute.amazonaws.com
sync.adotmob.com
2    173.231.178.82 (Secaucus, United States)

ASN32475 (SINGLEHOP-LLC, US)
cm.adgrx.com
2    54.205.17.152 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-205-17-152.compute-1.amazonaws.com
pm.w55c.net
2    34.197.223.55 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-197-223-55.compute-1.amazonaws.com
beacon.lynx.cognitivlabs.com
1    69.90.254.78 (Herndon, United States)

ASN13768 (COGECO-PEER1, CA)
ums.acuityplatform.com
1    34.102.163.6 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 6.163.102.34.bc.googleusercontent.com
ad.mrtnsvr.com
2    2606:4700::6812:19ad (United States)

ASN13335 (CLOUDFLARENET, US)
a.tribalfusion.com
s.tribalfusion.com
1    172.105.235.90 (Tokyo, Japan)

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: li1889-90.members.linode.com
gocm.c.appier.net
1    35.186.193.173 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com
ipac.ctnsnet.com
1    20.85.134.6 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
mweb.ck.inmobi.com
1    157.90.40.26 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.26.40.90.157.clients.your-server.de
matching.truffle.bid
1    195.5.165.20 (Slovenia)

ASN44968 (IPROM-AS, SI)
core.iprom.net
2    2.22.1.179 (Stockholm, Sweden)

ASN16625 (AKAMAI-AS, US)
PTR: a2-22-1-179.deploy.static.akamaitechnologies.com
px.owneriq.net
2    107.178.254.65 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 65.254.178.107.bc.googleusercontent.com
pippio.com
1    34.98.67.3 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 3.67.98.34.bc.googleusercontent.com
tags.rd.linksynergy.com
1    34.204.156.95 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-204-156-95.compute-1.amazonaws.com
bpi.rtactivate.com
1    54.165.35.122 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-165-35-122.compute-1.amazonaws.com
rtb.adentifi.com
2    38.98.69.175 (New York, United States)

ASN174 (COGENT-174, US)
pmp.mxptint.net
1    34.102.253.54 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 54.253.102.34.bc.googleusercontent.com
ads.playground.xyz
1    134.122.57.34 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)
match.adsby.bidtheatre.com
23    162.55.233.29 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.29.233.55.162.clients.your-server.de
sync.richaudience.com
14    96.46.183.20 (United States)

ASN7979 (SERVERS-COM, US)
ads.betweendigital.com
2    44.208.128.231 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-208-128-231.compute-1.amazonaws.com
ads.creative-serving.com
14    8.2.108.194 (United States)

ASN46636 (NATCOWEB, US)
us.ck-ie.com
1    35.190.90.30 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 30.90.190.35.bc.googleusercontent.com
odr.mookie1.com
9    192.35.249.137 (Ashburn, United States)

ASN11742 (SPOTX-IAD, US)
sync.search.spotxchange.com
1    54.205.191.114 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-205-191-114.compute-1.amazonaws.com
sync.springserve.com
1    23.235.251.211 (Ashburn, United States)

ASN19437 (SS-ASH, US)
server.cpmstar.com
2    54.205.176.242 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-205-176-242.compute-1.amazonaws.com
io.narrative.io
1    52.85.61.83 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-83.ewr53.r.cloudfront.net
cdn.callrail.com
3    3.222.255.203 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-222-255-203.compute-1.amazonaws.com
usermatch.krxd.net
3    34.238.35.16 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-238-35-16.compute-1.amazonaws.com
beacon.krxd.net
2    104.45.136.42 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
dc.services.visualstudio.com
7    2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)
www.facebook.com
Apex Domain
Subdomains		 Transfer
87 smilewanted.com
prebid.smilewanted.com — Cisco Umbrella Rank: 6641
csync.smilewanted.com — Cisco Umbrella Rank: 3226
static.smilewanted.com — Cisco Umbrella Rank: 12179
117 KB
86 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 249
secure.adnxs.com — Cisco Umbrella Rank: 476
acdn.adnxs.com — Cisco Umbrella Rank: 611
cdn.adnxs.com — Cisco Umbrella Rank: 1701
nym1-ib.adnxs.com — Cisco Umbrella Rank: 1056
546 KB
71 pubmatic.com
hbopenbid.pubmatic.com — Cisco Umbrella Rank: 564
ads.pubmatic.com — Cisco Umbrella Rank: 547
image8.pubmatic.com — Cisco Umbrella Rank: 737
image2.pubmatic.com — Cisco Umbrella Rank: 1020
simage2.pubmatic.com — Cisco Umbrella Rank: 761
image6.pubmatic.com — Cisco Umbrella Rank: 822
simage4.pubmatic.com — Cisco Umbrella Rank: 1351
image4.pubmatic.com — Cisco Umbrella Rank: 1216
91 KB
66 doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 219
googleads.g.doubleclick.net — Cisco Umbrella Rank: 57
cm.g.doubleclick.net — Cisco Umbrella Rank: 244
stats.g.doubleclick.net — Cisco Umbrella Rank: 124
ad.doubleclick.net — Cisco Umbrella Rank: 184
googleads4.g.doubleclick.net — Cisco Umbrella Rank: 359
625 KB
63 googlesyndication.com
7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 133
cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com
tpc.googlesyndication.com — Cisco Umbrella Rank: 155
367 KB
59 taboola.com
cdn.taboola.com — Cisco Umbrella Rank: 949
pm-widget.taboola.com — Cisco Umbrella Rank: 4879
trc.taboola.com — Cisco Umbrella Rank: 650
vidstat.taboola.com — Cisco Umbrella Rank: 2894
us-trc-events.taboola.com — Cisco Umbrella Rank: 6282
images.taboola.com — Cisco Umbrella Rank: 2011
imprnjmp.taboola.com — Cisco Umbrella Rank: 7873
us-match.taboola.com — Cisco Umbrella Rank: 7985
us-vid-events.taboola.com — Cisco Umbrella Rank: 7434
sync.taboola.com — Cisco Umbrella Rank: 1088
sync-t1.taboola.com — Cisco Umbrella Rank: 1302
match.taboola.com — Cisco Umbrella Rank: 5554
pips.taboola.com — Cisco Umbrella Rank: 1621
cds.taboola.com — Cisco Umbrella Rank: 1928
3 MB
49 mercurynews.com
www.mercurynews.com — Cisco Umbrella Rank: 65849
a869.mercurynews.com — Cisco Umbrella Rank: 191725
session.mercurynews.com — Cisco Umbrella Rank: 236852
sli.mercurynews.com — Cisco Umbrella Rank: 281843
790 KB
48 smartadserver.com
ssbsync-us.smartadserver.com — Cisco Umbrella Rank: 8210
ssbsync.smartadserver.com — Cisco Umbrella Rank: 867
rtb-csync.smartadserver.com — Cisco Umbrella Rank: 615
prg.smartadserver.com — Cisco Umbrella Rank: 1488
31 KB
47 rubiconproject.com
fastlane.rubiconproject.com — Cisco Umbrella Rank: 543
eus.rubiconproject.com — Cisco Umbrella Rank: 639
secure-assets.rubiconproject.com — Cisco Umbrella Rank: 1134
pixel.rubiconproject.com — Cisco Umbrella Rank: 381
pixel-us-east.rubiconproject.com — Cisco Umbrella Rank: 1178
token.rubiconproject.com — Cisco Umbrella Rank: 656
124 KB
42 criteo.com
gum.criteo.com — Cisco Umbrella Rank: 407
bidder.criteo.com — Cisco Umbrella Rank: 742
mug.criteo.com — Cisco Umbrella Rank: 2114
dis.criteo.com — Cisco Umbrella Rank: 601
68 KB
29 amazon-adsystem.com
c.amazon-adsystem.com — Cisco Umbrella Rank: 357
aax.amazon-adsystem.com — Cisco Umbrella Rank: 444
s.amazon-adsystem.com — Cisco Umbrella Rank: 337
aax-eu.amazon-adsystem.com — Cisco Umbrella Rank: 1032
81 KB
25 adsrvr.org
match.adsrvr.org — Cisco Umbrella Rank: 375
insight.adsrvr.org — Cisco Umbrella Rank: 592
14 KB
25 bidswitch.net
x.bidswitch.net — Cisco Umbrella Rank: 361
12 KB
24 trustarc.com
choices.trustarc.com — Cisco Umbrella Rank: 918
93 KB
23 richaudience.com
sync.richaudience.com — Cisco Umbrella Rank: 2090
6 KB
22 adform.net
c1.adform.net — Cisco Umbrella Rank: 635
adx.adform.net — Cisco Umbrella Rank: 4222
dmp.adform.net — Cisco Umbrella Rank: 3522
cm.adform.net — Cisco Umbrella Rank: 1254
10 KB
22 gumgum.com
rtb.gumgum.com — Cisco Umbrella Rank: 1673
usersync.gumgum.com — Cisco Umbrella Rank: 2018
7 KB
21 1rx.io
sync.1rx.io — Cisco Umbrella Rank: 618
13 KB
21 sharethrough.com
match.sharethrough.com — Cisco Umbrella Rank: 572
12 KB
20 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 207
605 KB
16 doubleverify.com
cdn.doubleverify.com — Cisco Umbrella Rank: 490
tps.doubleverify.com — Cisco Umbrella Rank: 516
tpsc-ue1.doubleverify.com — Cisco Umbrella Rank: 1435
426 KB
16 criteo.net
static.criteo.net — Cisco Umbrella Rank: 583
451 KB
15 audrte.com
a.audrte.com — Cisco Umbrella Rank: 2906
8 KB
15 lijit.com
ap.lijit.com — Cisco Umbrella Rank: 772
ce.lijit.com — Cisco Umbrella Rank: 1036
11 KB
15 google.com
accounts.google.com — Cisco Umbrella Rank: 59
adservice.google.com — Cisco Umbrella Rank: 107
www.google.com — Cisco Umbrella Rank: 3
79 KB
14 ck-ie.com
us.ck-ie.com — Cisco Umbrella Rank: 3354
7 KB
14 betweendigital.com
ads.betweendigital.com — Cisco Umbrella Rank: 1846
9 KB
14 liadm.com
b-code.liadm.com — Cisco Umbrella Rank: 2948
rp.liadm.com — Cisco Umbrella Rank: 2277
rp4.liadm.com — Cisco Umbrella Rank: 8165
i.liadm.com — Cisco Umbrella Rank: 671
i6.liadm.com — Cisco Umbrella Rank: 2341
26 KB
13 yellowblue.io
cs-server-s2s.yellowblue.io — Cisco Umbrella Rank: 3980
cs.yellowblue.io — Cisco Umbrella Rank: 3215
6 KB
13 casalemedia.com
htlb.casalemedia.com — Cisco Umbrella Rank: 626
ssum-sec.casalemedia.com — Cisco Umbrella Rank: 486
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 621
dsum.casalemedia.com — Cisco Umbrella Rank: 1634
10 KB
12 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 60
42 KB
11 creativecdn.com
creativecdn.com — Cisco Umbrella Rank: 498
3 KB
11 id5-sync.com
cdn.id5-sync.com — Cisco Umbrella Rank: 839
id5-sync.com — Cisco Umbrella Rank: 434
36 KB
10 unrulymedia.com
sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1281
5 KB
10 bidr.io
match.prod.bidr.io — Cisco Umbrella Rank: 602
5 KB
9 spotxchange.com
sync.search.spotxchange.com — Cisco Umbrella Rank: 785
6 KB
9 sopalk.com
sopalk.com — Cisco Umbrella Rank: 63099
38 KB
9 clarium.io
protected-by.clarium.io — Cisco Umbrella Rank: 1555
2 KB
9 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 80
ajax.googleapis.com — Cisco Umbrella Rank: 422
maps.googleapis.com — Cisco Umbrella Rank: 388
209 KB
8 sojern.com
beacon.sojern.com — Cisco Umbrella Rank: 4829
pixel.sojern.com — Cisco Umbrella Rank: 7038
842 B
8 adpone.com
hb.adpone.com — Cisco Umbrella Rank: 22776
977 KB
8 stickyadstv.com
ads.stickyadstv.com — Cisco Umbrella Rank: 617
4 KB
8 openx.net
us-u.openx.net — Cisco Umbrella Rank: 492
u.openx.net — Cisco Umbrella Rank: 740
eu-u.openx.net — Cisco Umbrella Rank: 2623
1 KB
8 contextweb.com
bh.contextweb.com — Cisco Umbrella Rank: 648
7 KB
8 tapad.com
pixel.tapad.com — Cisco Umbrella Rank: 513
2 KB
7 facebook.com
www.facebook.com — Cisco Umbrella Rank: 101
326 B
7 mathtag.com
sync.mathtag.com — Cisco Umbrella Rank: 566
4 KB
7 3lift.com
tlx.3lift.com — Cisco Umbrella Rank: 638
eb2.3lift.com — Cisco Umbrella Rank: 421
3 KB
7 yieldmo.com
ads.yieldmo.com — Cisco Umbrella Rank: 689
sync-amz.ads.yieldmo.com — Cisco Umbrella Rank: 6466
4 KB
7 matheranalytics.com
js.matheranalytics.com — Cisco Umbrella Rank: 11816
www.i.matheranalytics.com — Cisco Umbrella Rank: 11436
45 KB
7 sitescout.com
pixel.sitescout.com — Cisco Umbrella Rank: 3944
pixel-sync.sitescout.com — Cisco Umbrella Rank: 756
5 KB
7 gstatic.com
fonts.gstatic.com
179 KB
6 krxd.net
usermatch.krxd.net — Cisco Umbrella Rank: 1650
beacon.krxd.net — Cisco Umbrella Rank: 637
2 KB
6 2mdn.net
s0.2mdn.net — Cisco Umbrella Rank: 338
281 KB
6 rlcdn.com
idsync.rlcdn.com — Cisco Umbrella Rank: 426
id.rlcdn.com — Cisco Umbrella Rank: 751
1 KB
6 everesttech.net
sync-tm.everesttech.net — Cisco Umbrella Rank: 778
1 KB
6 yahoo.com
pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 468
ups.analytics.yahoo.com — Cisco Umbrella Rank: 340
3 KB
6 zemanta.com
b1sync.zemanta.com — Cisco Umbrella Rank: 560
4 KB
6 dotomi.com
amazon-tam-match.dotomi.com — Cisco Umbrella Rank: 5746
pulsepoint-match.dotomi.com — Cisco Umbrella Rank: 8602
pubmatic-match.dotomi.com — Cisco Umbrella Rank: 4315
2 KB
6 scorecardresearch.com
sb.scorecardresearch.com — Cisco Umbrella Rank: 160
4 KB
6 remixd.com
tags.remixd.com — Cisco Umbrella Rank: 23147
pubcast-files.remixd.com — Cisco Umbrella Rank: 24886
player-files.remixd.com — Cisco Umbrella Rank: 23769
49 KB
5 turn.com
ad.turn.com — Cisco Umbrella Rank: 1039
d.turn.com — Cisco Umbrella Rank: 1463
2 KB
5 quantserve.com
secure.quantserve.com — Cisco Umbrella Rank: 1215
pixel.quantserve.com — Cisco Umbrella Rank: 977
cms.quantserve.com — Cisco Umbrella Rank: 846
11 KB
5 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 82
396 KB
5 osano.com
cmp.osano.com — Cisco Umbrella Rank: 6025
consent.api.osano.com — Cisco Umbrella Rank: 11374
80 KB
4 azurewebsites.net
prod-dfm-proxy-connext.azurewebsites.net — Cisco Umbrella Rank: 75189
2 KB
4 truste.com
choices.truste.com — Cisco Umbrella Rank: 932
22 KB
4 outbrain.com
sync.outbrain.com — Cisco Umbrella Rank: 763
1 KB
4 stackadapt.com
sync.srv.stackadapt.com — Cisco Umbrella Rank: 792
2 KB
4 bing.com
bat.bing.com — Cisco Umbrella Rank: 389
25 KB
4 google.ca
www.google.ca — Cisco Umbrella Rank: 7757
690 B
4 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 176
329 KB
4 postrelease.com
jadserve.postrelease.com — Cisco Umbrella Rank: 1322
4 KB
4 crwdcntrl.net
sync.crwdcntrl.net — Cisco Umbrella Rank: 948
bcp.crwdcntrl.net — Cisco Umbrella Rank: 952
1 KB
4 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 218
3 KB
4 privacymanager.io
launchpad-wrapper.privacymanager.io — Cisco Umbrella Rank: 4219
launchpad.privacymanager.io — Cisco Umbrella Rank: 3796
geo.privacymanager.io — Cisco Umbrella Rank: 2038
11 KB
3 loopme.me
csync.loopme.me — Cisco Umbrella Rank: 1024
742 B
3 360yield.com
ice.360yield.com — Cisco Umbrella Rank: 2409
ad.360yield.com — Cisco Umbrella Rank: 662
970 B
3 bluekai.com
stags.bluekai.com — Cisco Umbrella Rank: 589
2 KB
3 czx5eyk0exbhwp43ya.biz
cdn.czx5eyk0exbhwp43ya.biz — Cisco Umbrella Rank: 40869
781 KB
3 exelator.com
loadm.exelator.com — Cisco Umbrella Rank: 1685
load77.exelator.com — Cisco Umbrella Rank: 4389
2 KB
3 w.org
s.w.org — Cisco Umbrella Rank: 2154
3 KB
3 azureedge.net
loader-cdn.azureedge.net — Cisco Umbrella Rank: 28989
fp-cdn.azureedge.net — Cisco Umbrella Rank: 54391
g2insights-cdn.azureedge.net — Cisco Umbrella Rank: 52545
73 KB
3 blueconic.net
digitalfirstmedia.blueconic.net — Cisco Umbrella Rank: 107748
2 KB
3 p-n.io
cdn.p-n.io — Cisco Umbrella Rank: 4894
k.p-n.io — Cisco Umbrella Rank: 3105
58 KB
3 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 379
98 KB
2 visualstudio.com
dc.services.visualstudio.com — Cisco Umbrella Rank: 687
283 B
2 narrative.io
io.narrative.io — Cisco Umbrella Rank: 5330
643 B
2 creative-serving.com
ads.creative-serving.com — Cisco Umbrella Rank: 4938
1 KB
2 mxptint.net
pmp.mxptint.net — Cisco Umbrella Rank: 6777
967 B
2 pippio.com
pippio.com — Cisco Umbrella Rank: 852
879 B
2 owneriq.net
px.owneriq.net — Cisco Umbrella Rank: 1856
1 KB
2 tribalfusion.com
a.tribalfusion.com — Cisco Umbrella Rank: 920
s.tribalfusion.com — Cisco Umbrella Rank: 2022
1019 B
2 cognitivlabs.com
beacon.lynx.cognitivlabs.com — Cisco Umbrella Rank: 1669
841 B
2 w55c.net
pm.w55c.net — Cisco Umbrella Rank: 1012
1 KB
2 adgrx.com
cm.adgrx.com — Cisco Umbrella Rank: 1615
1008 B
2 clean.gg
i.clean.gg — Cisco Umbrella Rank: 1363
104 B
2 8proof.com
8proof.com — Cisco Umbrella Rank: 38306
cdn.8proof.com Failed
3 KB
2 simpli.fi
um.simpli.fi — Cisco Umbrella Rank: 976
1 KB
2 thrtle.com
thrtle.com — Cisco Umbrella Rank: 1466
684 B
2 addthis.com
x.dlx.addthis.com — Cisco Umbrella Rank: 1561
1 KB
2 rfihub.com
p.rfihub.com — Cisco Umbrella Rank: 933
2 KB
2 rezync.com
live.rezync.com — Cisco Umbrella Rank: 1583
1 KB
2 mfadsrvr.com
rtb.mfadsrvr.com — Cisco Umbrella Rank: 1160
813 B
2 semasio.net
uipglob.semasio.net — Cisco Umbrella Rank: 1332
1 KB
2 adscale.de
ih.adscale.de — Cisco Umbrella Rank: 2994
632 B
2 admanmedia.com
cs.admanmedia.com — Cisco Umbrella Rank: 1103
1 KB
2 socdm.com
tg.socdm.com — Cisco Umbrella Rank: 1091
2 KB
2 sonobi.com
sync.go.sonobi.com — Cisco Umbrella Rank: 1089
1 KB
2 deepintent.com
match.deepintent.com — Cisco Umbrella Rank: 1163
595 B
2 technoratimedia.com
sync.technoratimedia.com — Cisco Umbrella Rank: 1587
4 KB
2 ipredictive.com
sync.ipredictive.com — Cisco Umbrella Rank: 1069
1019 B
2 kargo.com
crb.kargo.com — Cisco Umbrella Rank: 1801
939 B
2 smaato.net
s.ad.smaato.net — Cisco Umbrella Rank: 805
1 KB
2 media.net
cs.media.net — Cisco Umbrella Rank: 1628
contextual.media.net — Cisco Umbrella Rank: 645
1 KB
2 pranmcpkx.com
cdn.pranmcpkx.com — Cisco Umbrella Rank: 29707
5 KB
2 amazonaws.com
ams-pageview-public.s3.amazonaws.com — Cisco Umbrella Rank: 13587
paywall-ad-bucket.s3.amazonaws.com — Cisco Umbrella Rank: 40997
1 KB
2 foo.software
www.foo.software — Cisco Umbrella Rank: 68920
191 B
2 viafoura.co
api.viafoura.co — Cisco Umbrella Rank: 11496
i.viafoura.co — Cisco Umbrella Rank: 11514
3 KB
2 confiant-integrations.net
cdn.confiant-integrations.net — Cisco Umbrella Rank: 1546
101 KB
2 unpkg.com
unpkg.com — Cisco Umbrella Rank: 1035
3 KB
2 msecnd.net
az416426.vo.msecnd.net — Cisco Umbrella Rank: 2417
44 KB
2 wp.com
stats.wp.com — Cisco Umbrella Rank: 3092
pixel.wp.com — Cisco Umbrella Rank: 2850
5 KB
2 parsely.com
cdn.parsely.com — Cisco Umbrella Rank: 3107
p1.parsely.com — Cisco Umbrella Rank: 2311
21 KB
2 htlbid.com
htlbid.com — Cisco Umbrella Rank: 11396
110 KB
1 callrail.com
cdn.callrail.com — Cisco Umbrella Rank: 8395
37 KB
1 cpmstar.com
server.cpmstar.com — Cisco Umbrella Rank: 3975
611 B
1 springserve.com
sync.springserve.com — Cisco Umbrella Rank: 3481
210 B
1 mookie1.com
odr.mookie1.com — Cisco Umbrella Rank: 1233
642 B
1 bidtheatre.com
match.adsby.bidtheatre.com — Cisco Umbrella Rank: 2846
555 B
1 playground.xyz
ads.playground.xyz — Cisco Umbrella Rank: 4922
463 B
1 adentifi.com
rtb.adentifi.com — Cisco Umbrella Rank: 1337
35 B
1 rtactivate.com
bpi.rtactivate.com — Cisco Umbrella Rank: 1881
109 B
1 linksynergy.com
tags.rd.linksynergy.com — Cisco Umbrella Rank: 4739
392 B
1 iprom.net
core.iprom.net — Cisco Umbrella Rank: 7132
279 B
1 truffle.bid
matching.truffle.bid — Cisco Umbrella Rank: 8501
1 inmobi.com
mweb.ck.inmobi.com — Cisco Umbrella Rank: 4691
348 B
1 ctnsnet.com
ipac.ctnsnet.com — Cisco Umbrella Rank: 6665
369 B
1 appier.net
gocm.c.appier.net — Cisco Umbrella Rank: 2634
435 B
1 mrtnsvr.com
ad.mrtnsvr.com — Cisco Umbrella Rank: 3053
308 B
1 acuityplatform.com
ums.acuityplatform.com — Cisco Umbrella Rank: 1501
674 B
1 adotmob.com
sync.adotmob.com — Cisco Umbrella Rank: 1662
713 B
1 tidaltv.com
sync.tidaltv.com — Cisco Umbrella Rank: 1839
67 B
1 adition.com
dsp.adfarm1.adition.com — Cisco Umbrella Rank: 1651
487 B
1 omnitagjs.com
visitor.omnitagjs.com — Cisco Umbrella Rank: 962
388 B
1 rqtrk.eu
wt.rqtrk.eu — Cisco Umbrella Rank: 1647
351 B
1 taptapnetworks.com
sonata-notifications.taptapnetworks.com — Cisco Umbrella Rank: 7183
346 B
1 adswizz.com
synchroscript.deliveryengine.adswizz.com — Cisco Umbrella Rank: 3020
397 B
1 bfmio.com
sync.bfmio.com — Cisco Umbrella Rank: 1630
425 B
1 adnxs-simple.com
acdn.adnxs-simple.com — Cisco Umbrella Rank: 2129
43 KB
1 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 408
516 B
1 bttrack.com
bttrack.com — Cisco Umbrella Rank: 963
352 B
1 opera.com
t.adx.opera.com — Cisco Umbrella Rank: 3272
468 B
1 admixer.net
inv-nets.admixer.net — Cisco Umbrella Rank: 2637
583 B
1 mediago.io
trace.mediago.io — Cisco Umbrella Rank: 1105
189 B
1 blismedia.com
tr.blismedia.com — Cisco Umbrella Rank: 2376
172 B
1 onetag-sys.com
onetag-sys.com — Cisco Umbrella Rank: 874
815 B
1 iqzone.com
cs.iqzone.com — Cisco Umbrella Rank: 1868
175 B
1 adkernel.com
sync.adkernel.com — Cisco Umbrella Rank: 1375
192 B
1 33across.com
ssc-cms.33across.com — Cisco Umbrella Rank: 1154
503 B
1 adroll.com
d.adroll.com — Cisco Umbrella Rank: 1432
181 B
1 company-target.com
s.company-target.com — Cisco Umbrella Rank: 2002
423 B
1 moatads.com
js.moatads.com — Cisco Umbrella Rank: 34305
442 B
1 thebrighttag.com
s.thebrighttag.com — Cisco Umbrella Rank: 2009
14 KB
1 db-ip.com
api-mg2.db-ip.com — Cisco Umbrella Rank: 25049
794 B
1 ntv.io
s.ntv.io — Cisco Umbrella Rank: 3801
157 KB
1 uidapi.com
cdn.prod.uidapi.com — Cisco Umbrella Rank: 1509
2 KB
1 jwplayer.com
cdn.jwplayer.com — Cisco Umbrella Rank: 2864
41 KB
1 teads.tv
sync.teads.tv — Cisco Umbrella Rank: 1404
279 B
1 btstatic.com
s.btstatic.com — Cisco Umbrella Rank: 9849
13 KB
1 quantcount.com
rules.quantcount.com — Cisco Umbrella Rank: 1141
448 B
1 polyfill.io
polyfill.io — Cisco Umbrella Rank: 1711
673 B
1 viafoura.net
cdn.viafoura.net — Cisco Umbrella Rank: 10590
13 KB
1 windows.net
prodmg2.blob.core.windows.net — Cisco Umbrella Rank: 64719
144 KB
1 auth0.com
cdn.auth0.com — Cisco Umbrella Rank: 7635
38 KB
1030 175
Domain Requested by
72 csync.smilewanted.com www.mercurynews.com
hb.adpone.com
csync.smilewanted.com
36 rtb-csync.smartadserver.com 9 redirects www.mercurynews.com
32 pagead2.googlesyndication.com securepubads.g.doubleclick.net
www.mercurynews.com
tpc.googlesyndication.com
ad.doubleclick.net
acdn.adnxs-simple.com
www.googletagservices.com
az416426.vo.msecnd.net
29 ib.adnxs.com 6 redirects htlbid.com
acdn.adnxs.com
hb.adpone.com
28 www.mercurynews.com 1 redirects www.mercurynews.com
cmp.osano.com
26 nym1-ib.adnxs.com www.mercurynews.com
cdn.adnxs.com
hb.adpone.com
sopalk.com
acdn.adnxs-simple.com
26 cm.g.doubleclick.net 21 redirects rtb.gumgum.com
ce.lijit.com
www.mercurynews.com
eus.rubiconproject.com
25 x.bidswitch.net 25 redirects
24 choices.trustarc.com choices.truste.com
choices.trustarc.com
www.mercurynews.com
23 sync.richaudience.com 18 redirects csync.smilewanted.com
23 simage2.pubmatic.com 2 redirects www.mercurynews.com
s.amazon-adsystem.com
ads.pubmatic.com
rtb.gumgum.com
22 match.adsrvr.org 22 redirects
22 s.amazon-adsystem.com 2 redirects cmp.osano.com
s.amazon-adsystem.com
rtb.gumgum.com
match.sharethrough.com
ssum-sec.casalemedia.com
cs-server-s2s.yellowblue.io
bh.contextweb.com
sync-amz.ads.yieldmo.com
ce.lijit.com
eus.rubiconproject.com
ads.pubmatic.com
21 sync.1rx.io 21 redirects
21 match.sharethrough.com 15 redirects s.amazon-adsystem.com
match.sharethrough.com
www.mercurynews.com
20 tpc.googlesyndication.com www.mercurynews.com
cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com
ad.doubleclick.net
tpc.googlesyndication.com
acdn.adnxs-simple.com
cmp.osano.com
20 usersync.gumgum.com 1 redirects rtb.gumgum.com
eus.rubiconproject.com
ads.pubmatic.com
20 eus.rubiconproject.com s.amazon-adsystem.com
eus.rubiconproject.com
cs-server-s2s.yellowblue.io
rtb.gumgum.com
www.mercurynews.com
hb.adpone.com
20 www.googletagservices.com www.mercurynews.com
www.googletagservices.com
cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com
acdn.adnxs-simple.com
ad.doubleclick.net
20 gum.criteo.com 9 redirects cmp.osano.com
www.mercurynews.com
static.criteo.net
18 cdn.taboola.com cmp.osano.com
www.mercurynews.com
18 securepubads.g.doubleclick.net www.mercurynews.com
cmp.osano.com
securepubads.g.doubleclick.net
az416426.vo.msecnd.net
www.googletagservices.com
cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com
16 static.criteo.net cmp.osano.com
az416426.vo.msecnd.net
www.mercurynews.com
hb.adpone.com
static.criteo.net
16 a869.mercurynews.com www.mercurynews.com
a869.mercurynews.com
cmp.osano.com
15 a.audrte.com 11 redirects www.mercurynews.com
14 us.ck-ie.com 14 redirects
14 ads.betweendigital.com 14 redirects
14 acdn.adnxs.com www.mercurynews.com
sopalk.com
hb.adpone.com
13 images.taboola.com www.mercurynews.com
12 googleads4.g.doubleclick.net ad.doubleclick.net
acdn.adnxs-simple.com
12 www.google-analytics.com cmp.osano.com
www.googletagmanager.com
az416426.vo.msecnd.net
www.google-analytics.com
www.mercurynews.com
11 creativecdn.com 11 redirects
11 image2.pubmatic.com 2 redirects ads.pubmatic.com
s.amazon-adsystem.com
www.mercurynews.com
11 fastlane.rubiconproject.com htlbid.com
hb.adpone.com
10 sync.targeting.unrulymedia.com 5 redirects csync.smilewanted.com
10 match.prod.bidr.io 10 redirects
10 ads.pubmatic.com s.amazon-adsystem.com
rtb.gumgum.com
www.mercurynews.com
hb.adpone.com
10 secure.adnxs.com 6 redirects www.mercurynews.com
sopalk.com
10 id5-sync.com 9 redirects cdn.id5-sync.com
csync.smilewanted.com
9 sync.search.spotxchange.com 8 redirects csync.smilewanted.com
9 sync.taboola.com 2 redirects www.mercurynews.com
9 sopalk.com www.mercurynews.com
sopalk.com
cmp.osano.com
9 mug.criteo.com www.mercurynews.com
9 cs-server-s2s.yellowblue.io s.amazon-adsystem.com
cs-server-s2s.yellowblue.io
sync-amz.ads.yieldmo.com
9 ap.lijit.com 9 redirects
9 protected-by.clarium.io www.mercurynews.com
9 7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com cmp.osano.com
9 hbopenbid.pubmatic.com htlbid.com
hb.adpone.com
9 bidder.criteo.com htlbid.com
hb.adpone.com
8 cdn.doubleverify.com ad.doubleclick.net
www.mercurynews.com
acdn.adnxs-simple.com
8 adx.adform.net hb.adpone.com
8 prebid.smilewanted.com hb.adpone.com
8 prg.smartadserver.com hb.adpone.com
8 hb.adpone.com www.mercurynews.com
sopalk.com
8 i.liadm.com 4 redirects cmp.osano.com
i.liadm.com
www.mercurynews.com
8 ads.stickyadstv.com 8 redirects
8 bh.contextweb.com 4 redirects s.amazon-adsystem.com
bh.contextweb.com
www.mercurynews.com
8 pixel.tapad.com 4 redirects www.mercurynews.com
sync-amz.ads.yieldmo.com
s.amazon-adsystem.com
7 www.facebook.com
7 cm.adform.net 7 redirects
7 static.smilewanted.com csync.smilewanted.com
7 image6.pubmatic.com 3 redirects ads.pubmatic.com
7 pixel.rubiconproject.com 4 redirects eus.rubiconproject.com
7 cdn.adnxs.com www.mercurynews.com
hb.adpone.com
7 sync.mathtag.com 6 redirects i.liadm.com
7 www.google.com www.mercurynews.com
cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com
cmp.osano.com
7 fonts.gstatic.com fonts.googleapis.com
6 s0.2mdn.net sopalk.com
ad.doubleclick.net
acdn.adnxs-simple.com
6 ad.doubleclick.net www.googletagservices.com
acdn.adnxs-simple.com
6 sync-tm.everesttech.net 5 redirects ads.pubmatic.com
6 image8.pubmatic.com 5 redirects www.mercurynews.com
6 dsum-sec.casalemedia.com 1 redirects ssum-sec.casalemedia.com
6 b1sync.zemanta.com 6 redirects
6 eb2.3lift.com 3 redirects www.mercurynews.com
s.amazon-adsystem.com
6 ce.lijit.com 1 redirects s.amazon-adsystem.com
ce.lijit.com
www.mercurynews.com
6 ads.yieldmo.com 1 redirects htlbid.com
sync-amz.ads.yieldmo.com
www.mercurynews.com
6 sb.scorecardresearch.com 2 redirects www.mercurynews.com
cmp.osano.com
5 idsync.rlcdn.com 3 redirects i.liadm.com
www.mercurynews.com
5 www.i.matheranalytics.com www.mercurynews.com
5 adservice.google.com cmp.osano.com
www.mercurynews.com
5 www.googletagmanager.com cmp.osano.com
4 tpsc-ue1.doubleverify.com cdn.doubleverify.com
4 prod-dfm-proxy-connext.azurewebsites.net cdn.czx5eyk0exbhwp43ya.biz
4 tps.doubleverify.com cdn.doubleverify.com
www.mercurynews.com
4 simage4.pubmatic.com ads.pubmatic.com
4 pixel.sojern.com 4 redirects
4 choices.truste.com hb.adpone.com
ad.doubleclick.net
4 beacon.sojern.com hb.adpone.com
sopalk.com
4 token.rubiconproject.com 4 redirects
4 dis.criteo.com 4 redirects
4 ad.turn.com 4 redirects
4 cs.yellowblue.io cs-server-s2s.yellowblue.io
eus.rubiconproject.com
4 pr-bh.ybp.yahoo.com 3 redirects rtb.gumgum.com
4 us-u.openx.net 3 redirects rtb.gumgum.com
4 sync.outbrain.com 3 redirects rtb.gumgum.com
4 sync.srv.stackadapt.com 4 redirects
4 c1.adform.net 4 redirects
4 ssum-sec.casalemedia.com 1 redirects s.amazon-adsystem.com
ssum-sec.casalemedia.com
rtb.gumgum.com
4 bat.bing.com cmp.osano.com
4 www.google.ca www.mercurynews.com
4 connect.facebook.net cmp.osano.com
4 jadserve.postrelease.com cmp.osano.com
www.mercurynews.com
4 trc.taboola.com cdn.taboola.com
az416426.vo.msecnd.net
www.mercurynews.com
4 dpm.demdex.net 3 redirects www.mercurynews.com
4 pixel.sitescout.com 2 redirects www.mercurynews.com
4 session.mercurynews.com www.mercurynews.com
4 maps.googleapis.com www.mercurynews.com
maps.googleapis.com
cmp.osano.com
4 fonts.googleapis.com www.mercurynews.com
cmp.osano.com
3 beacon.krxd.net
3 usermatch.krxd.net 3 redirects
3 insight.adsrvr.org 3 redirects
3 dmp.adform.net 3 redirects
3 cms.quantserve.com 3 redirects
3 aax-eu.amazon-adsystem.com eus.rubiconproject.com
www.mercurynews.com
3 pixel-us-east.rubiconproject.com 3 redirects
3 sync-t1.taboola.com www.mercurynews.com
3 pixel-sync.sitescout.com 3 redirects
3 csync.loopme.me 3 redirects
3 ssbsync.smartadserver.com 2 redirects www.mercurynews.com
3 stags.bluekai.com 3 redirects
3 us-trc-events.taboola.com www.mercurynews.com
3 googleads.g.doubleclick.net cmp.osano.com
3 player-files.remixd.com www.mercurynews.com
3 cdn.czx5eyk0exbhwp43ya.biz cmp.osano.com
cdn.czx5eyk0exbhwp43ya.biz
3 sync.crwdcntrl.net 1 redirects www.mercurynews.com
3 s.w.org www.mercurynews.com
3 c.amazon-adsystem.com cmp.osano.com
c.amazon-adsystem.com
3 digitalfirstmedia.blueconic.net a869.mercurynews.com
cmp.osano.com
3 cmp.osano.com www.mercurynews.com
cmp.osano.com
3 accounts.google.com www.mercurynews.com
cmp.osano.com
accounts.google.com
3 cdn.jsdelivr.net www.mercurynews.com
cdn.jsdelivr.net
cmp.osano.com
2 dc.services.visualstudio.com az416426.vo.msecnd.net
2 io.narrative.io 1 redirects www.mercurynews.com
2 ads.creative-serving.com 2 redirects
2 pmp.mxptint.net 1 redirects www.mercurynews.com
2 pippio.com 2 redirects
2 px.owneriq.net 2 redirects
2 beacon.lynx.cognitivlabs.com 1 redirects ads.pubmatic.com
2 pm.w55c.net 2 redirects
2 cm.adgrx.com 2 redirects
2 eu-u.openx.net 2 redirects
2 pubmatic-match.dotomi.com 2 redirects
2 i.clean.gg acdn.adnxs-simple.com
2 8proof.com cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com
2 cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com www.mercurynews.com
2 k.p-n.io cdn.p-n.io
2 um.simpli.fi 2 redirects
2 thrtle.com 1 redirects s.amazon-adsystem.com
2 x.dlx.addthis.com 1 redirects i.liadm.com
2 p.rfihub.com 2 redirects
2 live.rezync.com 2 redirects
2 i6.liadm.com i.liadm.com
2 dsum.casalemedia.com 1 redirects www.mercurynews.com
2 u.openx.net 1 redirects www.mercurynews.com
2 rtb.mfadsrvr.com 2 redirects
2 uipglob.semasio.net 2 redirects
2 ih.adscale.de 2 redirects
2 secure-assets.rubiconproject.com 2 redirects
2 pulsepoint-match.dotomi.com 2 redirects
2 cs.admanmedia.com 2 redirects
2 tg.socdm.com 2 redirects
2 ups.analytics.yahoo.com 2 redirects
2 sync.go.sonobi.com 2 redirects
2 ad.360yield.com 2 redirects
2 match.deepintent.com 1 redirects rtb.gumgum.com
2 sync.technoratimedia.com 2 redirects
2 sync.ipredictive.com 2 redirects
2 crb.kargo.com s.amazon-adsystem.com
rtb.gumgum.com
2 amazon-tam-match.dotomi.com 2 redirects
2 rtb.gumgum.com 1 redirects s.amazon-adsystem.com
2 s.ad.smaato.net 2 redirects
2 geo.privacymanager.io launchpad.privacymanager.io
2 cdn.pranmcpkx.com cmp.osano.com
2 b-code.liadm.com cmp.osano.com
2 consent.api.osano.com cmp.osano.com
2 loadm.exelator.com 2 redirects
2 js.matheranalytics.com 1 redirects www.mercurynews.com
2 pm-widget.taboola.com cmp.osano.com
2 www.foo.software www.mercurynews.com
2 cdn.confiant-integrations.net cmp.osano.com
2 unpkg.com 1 redirects www.mercurynews.com
2 az416426.vo.msecnd.net www.mercurynews.com
cmp.osano.com
2 tags.remixd.com www.mercurynews.com
tags.remixd.com
2 htlbid.com www.mercurynews.com
1 cdn.callrail.com cmp.osano.com
1 server.cpmstar.com 1 redirects
1 sync.springserve.com 1 redirects
1 odr.mookie1.com 1 redirects
1 match.adsby.bidtheatre.com 1 redirects
1 ads.playground.xyz 1 redirects
1 rtb.adentifi.com www.mercurynews.com
1 bpi.rtactivate.com www.mercurynews.com
1 bcp.crwdcntrl.net www.mercurynews.com
1 tags.rd.linksynergy.com 1 redirects
1 core.iprom.net ads.pubmatic.com
1 matching.truffle.bid ads.pubmatic.com
1 mweb.ck.inmobi.com 1 redirects
1 ipac.ctnsnet.com ads.pubmatic.com
1 gocm.c.appier.net 1 redirects
1 s.tribalfusion.com ads.pubmatic.com
1 a.tribalfusion.com 1 redirects
1 ad.mrtnsvr.com 1 redirects
1 ums.acuityplatform.com 1 redirects
1 id.rlcdn.com www.mercurynews.com
1 sync.adotmob.com 1 redirects
1 sync.tidaltv.com www.mercurynews.com
1 dsp.adfarm1.adition.com 1 redirects
1 visitor.omnitagjs.com 1 redirects
1 wt.rqtrk.eu www.mercurynews.com
1 sonata-notifications.taptapnetworks.com 1 redirects
1 image4.pubmatic.com rtb.gumgum.com
1 synchroscript.deliveryengine.adswizz.com rtb.gumgum.com
1 sync.bfmio.com rtb.gumgum.com
1 acdn.adnxs-simple.com hb.adpone.com
1 cds.taboola.com az416426.vo.msecnd.net
1 pips.taboola.com az416426.vo.msecnd.net
1 px.ads.linkedin.com eus.rubiconproject.com
1 d.turn.com 1 redirects
1 bttrack.com 1 redirects
1 stats.g.doubleclick.net az416426.vo.msecnd.net
1 t.adx.opera.com www.mercurynews.com
1 match.taboola.com www.mercurynews.com
1 inv-nets.admixer.net 1 redirects
1 trace.mediago.io 1 redirects
1 tr.blismedia.com ce.lijit.com
1 onetag-sys.com cs-server-s2s.yellowblue.io
1 us-vid-events.taboola.com www.mercurynews.com
1 us-match.taboola.com cmp.osano.com
1 imprnjmp.taboola.com cmp.osano.com
1 cs.iqzone.com rtb.gumgum.com
1 sync.adkernel.com rtb.gumgum.com
1 contextual.media.net cs-server-s2s.yellowblue.io
1 ssc-cms.33across.com 1 redirects
1 d.adroll.com ssum-sec.casalemedia.com
1 s.company-target.com 1 redirects
1 ice.360yield.com 1 redirects
1 sync-amz.ads.yieldmo.com s.amazon-adsystem.com
1 sli.mercurynews.com www.mercurynews.com
1 ssbsync-us.smartadserver.com 1 redirects
1 cs.media.net 1 redirects
1 rp4.liadm.com www.mercurynews.com
1 rp.liadm.com 1 redirects
1 js.moatads.com www.mercurynews.com
1 vidstat.taboola.com cmp.osano.com
1 s.thebrighttag.com cmp.osano.com
1 paywall-ad-bucket.s3.amazonaws.com www.mercurynews.com
1 api-mg2.db-ip.com fp-cdn.azureedge.net
1 ams-pageview-public.s3.amazonaws.com www.mercurynews.com
1 pixel.quantserve.com www.mercurynews.com
1 launchpad.privacymanager.io cmp.osano.com
1 s.ntv.io cmp.osano.com
1 cdn.prod.uidapi.com cmp.osano.com
1 cdn.id5-sync.com cmp.osano.com
1 aax.amazon-adsystem.com c.amazon-adsystem.com
1 htlb.casalemedia.com htlbid.com
1 tlx.3lift.com htlbid.com
1 cdn.jwplayer.com tags.remixd.com
1 i.viafoura.co www.mercurynews.com
1 g2insights-cdn.azureedge.net cmp.osano.com
1 fp-cdn.azureedge.net cmp.osano.com
1 sync.teads.tv www.mercurynews.com
1 load77.exelator.com www.mercurynews.com
1 s.btstatic.com cmp.osano.com
1 rules.quantcount.com cmp.osano.com
1 pixel.wp.com www.mercurynews.com
1 api.viafoura.co cdn.viafoura.net
1 loader-cdn.azureedge.net ajax.googleapis.com
1 launchpad-wrapper.privacymanager.io cmp.osano.com
1 secure.quantserve.com cmp.osano.com
1 pubcast-files.remixd.com tags.remixd.com
1 p1.parsely.com www.mercurynews.com
1 polyfill.io ajax.googleapis.com
1 stats.wp.com www.mercurynews.com
1 cdn.viafoura.net www.mercurynews.com
1 cdn.parsely.com www.mercurynews.com
1 prodmg2.blob.core.windows.net www.mercurynews.com
1 cdn.p-n.io www.mercurynews.com
1 cdn.auth0.com www.mercurynews.com
1 ajax.googleapis.com www.mercurynews.com
0 cdn.8proof.com Failed 8proof.com
1030 280
Subject Issuer Validity Valid
mercurynews.com
R3		 2023-05-21 -
2023-08-19		 3 months crt.sh
htlbid.com
Amazon RSA 2048 M01		 2023-02-21 -
2023-11-19		 9 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2022 Q4		 2022-12-23 -
2024-01-24		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
*.auth0.com
Amazon RSA 2048 M01		 2023-02-24 -
2024-03-24		 a year crt.sh
accounts.google.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
pushlycdn.com
Amazon RSA 2048 M02		 2023-02-27 -
2024-02-13		 a year crt.sh
s762.pressenterprise.com
Amazon RSA 2048 M02		 2023-02-21 -
2023-11-02		 8 months crt.sh
cmp.osano.com
Amazon RSA 2048 M02		 2023-02-21 -
2023-09-30		 7 months crt.sh
*.blob.core.windows.net
Microsoft RSA TLS CA 01		 2023-03-20 -
2024-03-20		 a year crt.sh
*.remixd.com
Amazon RSA 2048 M02		 2023-02-09 -
2024-03-09		 a year crt.sh
*.parsely.com
Amazon RSA 2048 M02		 2023-05-06 -
2024-06-03		 a year crt.sh
viafoura.com
Amazon RSA 2048 M01		 2023-02-28 -
2023-10-06		 7 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
*.wp.com
Sectigo ECC Domain Validation Secure Server CA		 2022-11-14 -
2023-12-15		 a year crt.sh
*.vo.msecnd.net
DigiCert SHA2 Secure Server CA		 2023-05-05 -
2024-04-28		 a year crt.sh
polyfill.io
GlobalSign Atlas R3 DV TLS CA 2022 Q4		 2022-12-10 -
2024-01-11		 a year crt.sh
*.mercurynews.com
Amazon RSA 2048 M01		 2023-03-30 -
2024-04-28		 a year crt.sh
*.blueconic.net
Amazon RSA 2048 M01		 2023-06-08 -
2024-07-06		 a year crt.sh
*.taboola.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-12-08 -
2023-12-31		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
pubcast-files.remixd.com
GTS CA 1D4		 2023-05-25 -
2023-08-23		 3 months crt.sh
c.amazon-adsystem.com
Amazon RSA 2048 M01		 2023-02-28 -
2024-02-17		 a year crt.sh
*.quantserve.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-08-09 -
2023-09-09		 a year crt.sh
*.sitescout.com
GeoTrust Global TLS RSA4096 SHA256 2022 CA1		 2023-01-09 -
2024-02-02		 a year crt.sh
confiant-integrations.net
GTS CA 1P5		 2023-05-25 -
2023-08-23		 3 months crt.sh
*.privacymanager.io
Amazon RSA 2048 M02		 2023-02-22 -
2023-09-24		 7 months crt.sh
*.w.org
Sectigo ECC Domain Validation Secure Server CA		 2022-12-06 -
2024-01-06		 a year crt.sh
www.foo.software
Go Daddy Secure Certificate Authority - G2		 2022-12-29 -
2024-01-30		 a year crt.sh
quantserve.com
R3		 2023-06-13 -
2023-09-11		 3 months crt.sh
*.criteo.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-05-12 -
2023-08-10		 3 months crt.sh
s.btstatic.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2023-01-30 -
2024-02-20		 a year crt.sh
teads.tv
R3		 2023-05-11 -
2023-08-09		 3 months crt.sh
snibe7egl.wpc.edgecastcdn.net
DigiCert TLS RSA SHA256 2020 CA1		 2023-01-03 -
2024-02-03		 a year crt.sh
jwplayer.com
Amazon RSA 2048 M02		 2023-03-01 -
2023-12-25		 10 months crt.sh
*.yieldmo.com
Amazon RSA 2048 M02		 2023-02-28 -
2023-10-12		 7 months crt.sh
*.pubmatic.com
DigiCert Baltimore TLS RSA SHA256 2020 CA1		 2022-06-13 -
2023-07-14		 a year crt.sh
*.3lift.com
Amazon RSA 2048 M02		 2023-04-13 -
2024-05-11		 a year crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-03-05 -
2024-04-03		 a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2023-02-13 -
2024-03-15		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-05-22 -
2024-05-21		 a year crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com
Amazon RSA 2048 M01		 2023-03-16 -
2024-03-08		 a year crt.sh
cdn.prod.uidapi.com
R3		 2023-05-18 -
2023-08-16		 3 months crt.sh
*.criteo.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-05-27 -
2023-08-27		 3 months crt.sh
*.api.osano.com
Amazon RSA 2048 M01		 2023-02-24 -
2023-09-26		 7 months crt.sh
*.ntv.io
DigiCert TLS RSA SHA256 2020 CA1		 2022-10-24 -
2023-10-26		 a year crt.sh
*.liadm.com
Amazon RSA 2048 M02		 2023-02-28 -
2024-01-30		 a year crt.sh
*.scorecardresearch.com
Sectigo RSA Domain Validation Secure Server CA		 2022-12-15 -
2023-12-28		 a year crt.sh
player-files.remixd.com
GTS CA 1D4		 2023-06-02 -
2023-08-31		 3 months crt.sh
*.google.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
*.s3.amazonaws.com
Amazon RSA 2048 M01		 2023-03-21 -
2023-12-19		 9 months crt.sh
sni2bf2agl.wpc.edgecastcdn.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-10-31 -
2023-11-02		 a year crt.sh
signal.co
Entrust Certification Authority - L1K		 2023-02-10 -
2024-02-10		 a year crt.sh
www.i.matheranalytics.com
Amazon RSA 2048 M01		 2023-03-02 -
2024-01-13		 10 months crt.sh
*.id5-sync.com
R3		 2023-04-18 -
2023-07-17		 3 months crt.sh
s.amazon-adsystem.com
Amazon RSA 2048 M01		 2023-03-03 -
2024-02-19		 a year crt.sh
*.postrelease.com
Amazon RSA 2048 M01		 2023-03-01 -
2023-12-25		 10 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2023-03-30 -
2023-06-28		 3 months crt.sh
a248.e.akamai.net
DigiCert TLS RSA SHA256 2020 CA1		 2023-05-16 -
2024-05-15		 a year crt.sh
protected-by.clarium.io
Amazon RSA 2048 M01		 2022-12-16 -
2024-01-14		 a year crt.sh
www.google.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
*.google.ca
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
www.bing.com
Microsoft RSA TLS CA 02		 2023-02-16 -
2023-08-16		 6 months crt.sh
gumgum.com
Amazon RSA 2048 M02		 2023-06-07 -
2024-07-06		 a year crt.sh
casalemedia.com
Go Daddy Secure Certificate Authority - G2		 2022-12-13 -
2024-01-13		 a year crt.sh
*.sharethrough.com
Amazon RSA 2048 M01		 2023-06-14 -
2024-07-12		 a year crt.sh
sli.bayareanewsgroup.com
R3		 2023-04-14 -
2023-07-13		 3 months crt.sh
*.ads.yieldmo.com
Amazon RSA 2048 M01		 2023-03-26 -
2024-04-23		 a year crt.sh
*.contextweb.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-04-10 -
2024-05-09		 a year crt.sh
*.app.kargo.com
Amazon RSA 2048 M02		 2023-02-21 -
2024-01-18		 a year crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2		 2023-05-06 -
2024-05-04		 a year crt.sh
*.yellowblue.io
Amazon ECDSA 256 M02		 2023-04-18 -
2024-05-16		 a year crt.sh
*.deepintent.com
Go Daddy Secure Certificate Authority - G2		 2022-11-30 -
2024-01-01		 a year crt.sh
d.adroll.com
Amazon RSA 2048 M01		 2022-11-08 -
2023-12-07		 a year crt.sh
*.media.net
DigiCert TLS RSA SHA256 2020 CA1		 2023-02-10 -
2024-02-18		 a year crt.sh
*.adkernel.com
AlphaSSL CA - SHA256 - G4		 2023-01-03 -
2024-02-04		 a year crt.sh
*.iqzone.com
Go Daddy Secure Certificate Authority - G2		 2023-04-05 -
2024-05-06		 a year crt.sh
*.ad-server.k8s.ggops.com
Amazon RSA 2048 M01		 2023-02-28 -
2024-02-09		 a year crt.sh
sopalk.com
Amazon RSA 2048 M01		 2023-02-24 -
2023-10-02		 7 months crt.sh
cdn.adnxs.com
GeoTrust RSA CA 2018		 2022-10-21 -
2023-10-22		 a year crt.sh
*.onetag-sys.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-12-28 -
2024-01-28		 a year crt.sh
tr.blismedia.com
GTS CA 1D4		 2023-06-09 -
2023-09-07		 3 months crt.sh
*.smartadserver.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2023-01-21 -
2024-01-23		 a year crt.sh
*.openx.net
GeoTrust RSA CA 2018		 2022-07-21 -
2023-08-21		 a year crt.sh
*.adx.opera.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-05-22 -
2024-06-20		 a year crt.sh
*.mathtag.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-03-30 -
2024-04-29		 a year crt.sh
aax-eu.amazon-adsystem.com
Amazon RSA 2048 M01		 2023-01-27 -
2024-01-27		 a year crt.sh
*.everesttech.net
GlobalSign Atlas R3 DV TLS CA 2022 Q4		 2022-11-07 -
2023-12-09		 a year crt.sh
track.adform.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-09-20 -
2023-09-20		 a year crt.sh
*.p-n.io
Amazon RSA 2048 M01		 2023-02-27 -
2024-01-21		 a year crt.sh
*.sojern.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-01-17 -
2024-02-17		 a year crt.sh
*.truste.com
Amazon RSA 2048 M02		 2023-02-28 -
2024-01-16		 a year crt.sh
*.8proof.com
Sectigo RSA Domain Validation Secure Server CA		 2023-01-29 -
2024-02-07		 a year crt.sh
*.doubleclick.net
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
i.clean.gg
GTS CA 1D4		 2023-05-24 -
2023-08-22		 3 months crt.sh
*.trustarc.com
Amazon RSA 2048 M02		 2023-04-17 -
2024-05-14		 a year crt.sh
*.doubleverify.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-07-05 -
2023-07-07		 a year crt.sh
*.tps.doubleverify.com
Go Daddy Secure Certificate Authority - G2		 2022-09-28 -
2023-10-30		 a year crt.sh
*.bfmio.com
Amazon RSA 2048 M02		 2023-03-17 -
2024-04-14		 a year crt.sh
*.deliveryengine.adswizz.com
Amazon RSA 2048 M02		 2023-02-09 -
2024-02-13		 a year crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2023-04-04 -
2023-09-27		 6 months crt.sh
*.azurewebsites.net
Microsoft Azure TLS Issuing CA 02		 2023-03-10 -
2024-03-04		 a year crt.sh
*.tidaltv.com
Sectigo RSA Domain Validation Secure Server CA		 2023-06-08 -
2024-07-08		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2023-02-02 -
2024-03-03		 a year crt.sh
beacon.lynx.cognitivlabs.com
Amazon RSA 2048 M02		 2023-03-31 -
2024-04-28		 a year crt.sh
*.ctnsnet.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-01-04 -
2023-11-06		 10 months crt.sh
truffle.bid
R3		 2023-05-24 -
2023-08-22		 3 months crt.sh
*.iprom.net
R3		 2023-05-23 -
2023-08-21		 3 months crt.sh
*.crwdcntrl.net
Amazon RSA 2048 M01		 2022-11-07 -
2023-12-06		 a year crt.sh
*.tapad.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-09-14 -
2023-10-15		 a year crt.sh
rtactivate.com
Amazon RSA 2048 M01		 2023-03-14 -
2024-04-11		 a year crt.sh
adentifi.com
Amazon RSA 2048 M02		 2023-02-22 -
2023-09-03		 6 months crt.sh
*.richaudience.com
RapidSSL Global TLS RSA4096 SHA256 2022 CA1		 2023-02-27 -
2024-02-26		 a year crt.sh
*.targeting.unrulymedia.com
Sectigo RSA Domain Validation Secure Server CA		 2023-05-10 -
2024-05-10		 a year crt.sh
*.spotxchange.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2023-03-01 -
2024-03-15		 a year crt.sh
swappy.callrail.com
Amazon RSA 2048 M01		 2023-03-02 -
2023-09-08		 6 months crt.sh
in.applicationinsights.azure.com
Microsoft Azure TLS Issuing CA 05		 2023-05-03 -
2024-04-27		 a year crt.sh

This page contains 235 frames:

Primary Page: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Frame ID: 0A3F279A72DF7FEE1C97716314AEC903
Requests: 300 HTTP requests in this frame

Frame: https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
Frame ID: AC06E0F899160D37B061FAE68045A9AE
Requests: 6 HTTP requests in this frame

Frame: https://cmp.osano.com/
Frame ID: 2ECD9DD78AB012A4FABD133C1FA5FE2D
Requests: 1 HTTP requests in this frame

Frame: https://cdn.jwplayer.com/libraries/FUtg69tL.js
Frame ID: 64D99DD96A47CCDA0CF32691134591E8
Requests: 7 HTTP requests in this frame

Frame: https://cmp.osano.com/
Frame ID: E4F0E2EF37B312FE997F2E0722410AED
Requests: 1 HTTP requests in this frame

Frame: https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 4AF36ADB6CCCFEEC8C7C15AB397921F1
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Frame ID: 0B2E7121A7D17493DC33FDFEE8FFA956
Requests: 1 HTTP requests in this frame

Frame: https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: D27974A3061879846263145131149F54
Requests: 4 HTTP requests in this frame

Frame: https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 063754E3967BDF96A77E7FAA13B95965
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssJyWnsuurZc2LqaR14z6wA776WoZNDybCMfVInAu6rBRrx_ENRVG8VPeavLbwe3acWBp-pJYztT62njSpQHHyFYZvVdy4G7i8gQr-roOiuY5fzuAqyrX17_i0DUS1kF91vf2BqyzFLwQtiELbjrmkjJJubkraGdz-HBzuKEtezjSHQtvmcFU0LUbBS-VKlo6Hx_NH4uK8mu0-oAP10q9Sb9Cp_VKa-yTJBY1Seg5Ki8ldtxIZeCU2TWak_ivyDU55PxGj00LzySgLVLvYywUk9zjiZ5yp9bdMgwZ2-D6QffjUTbhPmIIc6BDwH2EpqHr8Lcf7JVDC1DJl9-S6nByPeZAZnhSRQ7pLwooJnqrbzfgPzxEleRuqQoNa_qEVLEpD-NlUW&sai=AMfl-YTiGc4dwoRa7QMjgcEQzSkO1n8J5zTneY7xBLai9mRsc3U1I7El14RP75sSPR1UiRbt3MO0tXu-Ur9AsTbH2rRMD-2e5hci3h8BYVqQwut_qCVkEcbQmYlIDofrgQ&sig=Cg0ArKJSzN3wzjKlHSV_EAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: 71C726AD04977FCBCE73F14BD0F34C94
Requests: 14 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Frame ID: 723093E70DD210739928511F9FF4ACCE
Requests: 3 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Frame ID: CCB0190361F687CB5D1C308C1075568E
Requests: 15 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Frame ID: 9B3A0DCAABFEC2AF106BC8EBCB98B5C4
Requests: 10 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=8231229510999469573&gdpr=0&gdpr_consent=
Frame ID: CC72355738C81DCC76FEAC59E0A8D336
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAHwrPka_OISwNtL3lEAAAAAAA&expiration=1687377500&is_secure=true&gdpr=0
Frame ID: BD743C77E4986F4B29732B169EAEEF99
Requests: 1 HTTP requests in this frame

Frame: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Frame ID: 380C9CEE0211EAE4D66C8F7FF72A13E0
Requests: 6 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Frame ID: 1E1A832B27055DC67594BF3DF7F1F56A
Requests: 11 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=&us_privacy=1---
Frame ID: E87C5FDBB24250BC9D4908A50C25053F
Requests: 2 HTTP requests in this frame

Frame: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Frame ID: 7CD68F0AB75A98C251D539B1F6899FE8
Requests: 7 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Frame ID: 01C9D7731495E23F09559CE854F75BD7
Requests: 11 HTTP requests in this frame

Frame: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
Frame ID: 2533B28C00F173C63BF1A3C283760AF2
Requests: 4 HTTP requests in this frame

Frame: https://crb.kargo.com/api/v1/dinitsync?partners=A9
Frame ID: A36937DCB0B9744CF3D1399464D4557E
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?id=3958812064475458525&ex=appnexus.com&gdpr=0
Frame ID: 2625099DD74602EDFEB7ADFC5379C7C2
Requests: 1 HTTP requests in this frame

Frame: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Frame ID: 18A239401A66F4E654F2B38676B6EB46
Requests: 7 HTTP requests in this frame

Frame: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Frame ID: 682FC2BFA7476D6ADDCBFB75FE009C6B
Requests: 13 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=3075899752081279888305
Frame ID: 6FB6D79140CE13771993585FA44D9C9D
Requests: 1 HTTP requests in this frame

Frame: https://sync.adkernel.com/user-sync?zone=181093&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dmdp%26i%3D%5BUID%5D&gdpr=0&gdpr_consent=&ccpa=
Frame ID: 577AE0E12716F3F4DE55EDE6F2747D00
Requests: 1 HTTP requests in this frame

Frame: https://cs.iqzone.com/e9d4ff858b5e32317e843f5ed11b2659.gif?puid=u_5f8a27c9-52a9-4f51-af59-852beb0ad309&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diqz
Frame ID: 9E2F8669EAC9C078E31D79C69BD92DAB
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Frame ID: 96296CEB015CF1DA2DB81FFCAC117F0C
Requests: 12 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=ttd&i=120447a6-30d3-414b-b8f9-7a5eddeefdcd
Frame ID: D664B47799609366BA07B32A4C305605
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=mmh&i=cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
Frame ID: 92D2B6366C2963456645DB9563BDA349
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=atm&i=ZJIE3AABR7XTlQAz&gdpr=0&gdpr_consent=&_test=ZJIE3AABR7XTlQAz
Frame ID: 054333C34B40B886DE9A8E207DAC4814
Requests: 1 HTTP requests in this frame

Frame: https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV81ZjhhMjdjOS01MmE5LTRmNTEtYWY1OS04NTJiZWIwYWQzMDk=&gdpr=0&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv
Frame ID: 5B49478B6D08B37738DE9D6A97DC87AC
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=sus&i=ZJIE3cCo8YMAANUleFsAAAAA
Frame ID: 4C6872EF3EC79C8C6A0816FAC644DD28
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=aad&i=d90855e2-a762-4191-8327-12f7f682caea
Frame ID: CBC14B827C845BC785E8BC5F79DCDD56
Requests: 1 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
Frame ID: DFFC2AE201191A45E768BA6A0F5874AB
Requests: 1 HTTP requests in this frame

Frame: https://imprnjmp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66361655&crid=-1&dast=V8r-ACLAZMDi_BQxivGBCYHF6ChzBeMSgAAABgYID-AEmtDMOVYbBcS0y-zVq0W5jWCtdouZYNNruZczTyrSwWIyCplWG4MgyWa4nJt1mLdgvTWuEaLdeywWY3c45GvpXFYgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxRBCcW_8dXr5SyIEakUYAQAAAKjEydw9MkknqFhU-f__77cCcAUAIABRW0xeI4vuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSC0skxsi81iuRl5liPnyLQyTjye3WDjsJhmu4nFewY1ZZu-h1EQ-4QIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYIZk3MwMq5cbuVm4nGLdpuVW-GyDNYq13IwcTlMHsPEuBa9PqaLcWJcuJZbJBiwuBfJ0yKdqGyOhXNmG86GC4_JNTMuVsbRajBZ-DYjl2szsVnEEs3JIp3ILvvSyjKxLTaL5WbkWY6cI9PKOPF4doONw2Ka7SYWf8fkHIyMK5dbuZl43KLdZuVWuCyDtcq1HExcDpPHMDGuRa-P6WKcGBeu5b4xG-4my8Vguds3ZsPdZLkYLHf7Dp3hu_qcjdLJUuwRCk2nc09ncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrhjuVgkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrH3D0CFWKvV6nZjrVYL!&cmcv=&pix=undefined&cb=1687291100660&uv=137215401&tms=1687291100660&abt=dfrc_vB!nonrv_vA!t45!ufm_vE!ul137215-401_vA&ft=0&su=6&unm=FEED_MANAGER&aure=false&agl=1&cirid=5e08e009-bd73-47a4-a549-6037f94d7ebb&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Frame ID: 088208BEE88ECFB0ECDB0CBCB1DAA57B
Requests: 1 HTTP requests in this frame

Frame: https://us-match.taboola.com/sync?dast=V8r-ACLAZMDi_BQxivGBCYHF6ChzBeMSgAAABgYID-AEmtDMOVYbBcS0y-zVq0W5jWCtdouZYNNruZczTyrSwWIyCplWG4MgyWa4nJt1mLdgvTWuEaLdeywWY3c45GvpXFYgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxRBCcW_8dXr5SyIEakUYAQAAAKjEydw9MkknqFhU-f__77cCcAUAIABRW0xeI4vuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSC0skxsi81iuRl5liPnyLQyTjye3WDjsJhmu4nFewY1ZZu-h1EQ-4QIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYIZk3MwMq5cbuVm4nGLdpuVW-GyDNYq13IwcTlMHsPEuBa9PqaLcWJcuJZbJBiwuBfJ0yKdqGyOhXNmG86GC4_JNTMuVsbRajBZ-DYjl2szsVnEEs3JIp3ILvvSyjKxLTaL5WbkWY6cI9PKOPF4doONw2Ka7SYWf8fkHIyMK5dbuZl43KLdZuVWuCyDtcq1HExcDpPHMDGuRa-P6WKcGBeu5b4xG-4my8Vguds3ZsPdZLkYLHf7Dp3hu_qcjdLJUuwRCk2nc09ncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrhjuVgkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrH3D0CFWKvV6nZjrVYL!&excid=22&docw=0&cijs=1&nlb=false
Frame ID: EF94EB12AE9EF2D907F1B72473D62377
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1922&pub_id=2234281
Frame ID: 123F2A81E649F27704C84018466DD40D
Requests: 2 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Frame ID: 6922AA11357DE4F383BA846254BC655A
Requests: 3 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=69f48c2160c8113&gdpr=0&gdpr_consent=
Frame ID: A215C34AFD2ACBD63BD8854410EDEEDA
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=rth&i=FOYPqMoXokSCEEaOCmV5&pi=gumgum&tc=1
Frame ID: 52D0B734A03426B4C41F94BC9A6C0556
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=gumgum
Frame ID: E794C0093547EB3E5BBF0E929E137367
Requests: 3 HTTP requests in this frame

Frame: https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZJIE3cCo8YMAANUleG8AAAAA
Frame ID: B6063AA10EA14422C9A0517D073F1EFD
Requests: 22 HTTP requests in this frame

Frame: https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 82D8B3CB7009BCEE096036AF1B68048C
Requests: 4 HTTP requests in this frame

Frame: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d65x5a82x2dqp0kjyedmwh&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Frame ID: 1A7C1A2F219A9594EE29CA89E9041FEB
Requests: 8 HTTP requests in this frame

Frame: https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: AC35DB0681FD3777775BEF9114E2051A
Requests: 4 HTTP requests in this frame

Frame: https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=
Frame ID: 104CE3DE782AF34F87B86074F93B5B83
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=970314640601641075
Frame ID: 6177323005BFD0ECA7F0336E21CDCDDC
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UIDF2EBBF7D-4C79-4F31-B67B-920625C98DEF
Frame ID: 10F0FCD57D6BF4752C930F9A3237A1C3
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: ACDA732D0A5B9B49349697CFEAAC3A3E
Requests: 22 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=eqxddgiid&e=1095001190858
Frame ID: 97F85EB4405E599E74117024022A35E4
Requests: 16 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=udynfi&e=1095001190858
Frame ID: 37D1D702348A9475CA7FD05EC042948C
Requests: 16 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=tmpnmjnvld&e=1095001190858
Frame ID: BC0F520F1BA54073B56DFFE0B6057870
Requests: 16 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=ibehklirob&e=1095001190858
Frame ID: 8FB107F8D7DF95F0D41B28D004D31DE9
Requests: 16 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=fumtwxvuy&e=1095001190858
Frame ID: 2938374088CEA05264C6494A2F501146
Requests: 16 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=qcbdufqvuq&e=1095001190858
Frame ID: F8C71028D7EAB38801E77D8260E488B3
Requests: 9 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=rubwwfuc&e=1095001190858
Frame ID: 3348367AE337C224F66A912E73CB25A0
Requests: 16 HTTP requests in this frame

Frame: https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 53080E0E56ED70947E124447D64A894D
Requests: 4 HTTP requests in this frame

Frame: https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 8073AF8386673C95596569F6679AB928
Requests: 4 HTTP requests in this frame

Frame: https://cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Frame ID: A64BE196F78D6DDCB92BE1662052D1D5
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagservices.com/dcm/dcmads.js
Frame ID: C7FECA6C56D461C2FE36CD238E6EE0DB
Requests: 16 HTTP requests in this frame

Frame: https://www.googletagservices.com/dcm/dcmads.js
Frame ID: AF75E3D9A64F14B58D78434AA201B072
Requests: 28 HTTP requests in this frame

Frame: https://www.googletagservices.com/dcm/dcmads.js
Frame ID: E9F9153D25AEBB47D1BA04D39171166A
Requests: 16 HTTP requests in this frame

Frame: https://www.googletagservices.com/dcm/dcmads.js
Frame ID: CFF2288D7A0D0E2C25966596052189F9
Requests: 16 HTTP requests in this frame

Frame: https://cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Frame ID: 156C4851B92759D44564B6DF1731E6F9
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 0DC9F0B97B9CFB7F568278A33BC82420
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: D87D5EEFC6F83C0E9D4626F80BE07E26
Requests: 2 HTTP requests in this frame

Frame: https://8proof.com/app/rtbmarkup/5111?id=515477663289&ctd=110096&crid=1178&ap=ZJIE3wACLGsKs_uOAAd70dmLTSCv8aULrQ7qBg
Frame ID: E8F295E1DD195736B2CFE41A49307FE7
Requests: 3 HTTP requests in this frame

Frame: https://acdn.adnxs-simple.com/strikeforce/script.js
Frame ID: 5269C1878598769C34F6398E62EAD00C
Requests: 18 HTTP requests in this frame

Frame: https://www.googletagservices.com/dcm/dcmads.js
Frame ID: ED8E1530BF96C5D1F7A7ECC0ABE7E3E1
Requests: 28 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Frame ID: 2B478677AD8F3BDEA5864CD3D87B8D90
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Frame ID: 0010AF1317519B6C9664B59AD08026FA
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Frame ID: B49DC0FAFDEA77C6F7D3A0E6F889EF44
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Frame ID: 6CD76678DB3F021A0CA6F3F00D803963
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 7E779FB95D6E064E7844D3FDB4EF2F5A
Requests: 3 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements3941.js
Frame ID: 89F2D5B1083BA184CFF903F58FCD9E47
Requests: 3 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements3941.js
Frame ID: B4B6E613A3299CAD8FCD3C454A4510D9
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 586F33DB141EB83DB83E514A5199D53D
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 35461C337BBE05AB3C84D5DE74EEF36C
Requests: 3 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements3941.js
Frame ID: 48CAEC1A71530D7BF480AFDB026BD848
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: E91F40C6564082231ADD4C06EEF1EE17
Requests: 3 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Frame ID: 83734C76DFAC0A2D4635A6773FD899C7
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Frame ID: 2F313B4D3ACA9880721CE80A611A6435
Requests: 2 HTTP requests in this frame

Frame: https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 62AAEC94D26A02092C786A4635CE3AC5
Requests: 4 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 16607E8C830B14BDBDE902C8B1740130
Requests: 3 HTTP requests in this frame

Frame: https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 156DAECF4BBDE649FEB587FB204898B9
Requests: 4 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&redir=true&gdpr=0&gdpr_consent=
Frame ID: 752EAD0C3503A518CFD70131F9B3C96B
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
Frame ID: B136C9C7C42C6FA4ABC3FD6BBC36A465
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAEJeE7JJAoAACD7r3WP1g&gdpr=0&gdpr_consent=
Frame ID: EEB8BF558F76CE1B7DC6C66ED1C8B4D4
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_d782ad8a5c874f3ebf8d6
Frame ID: 13B442EE08017DF58CE5651BED919BBD
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3958812064475458525&gdpr=0&gdpr_consent=
Frame ID: C0E016965D1CE29326F66379F2DF43B5
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=pbm&i=F2EBBF7D-4C79-4F31-B67B-920625C98DEF
Frame ID: DCC1E6E54D4BC1BB17296FB777DAA275
Requests: 1 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements3941.js
Frame ID: 01065F2A562EAB5C5554EF1DB7DEE7C3
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: A18656B4C773B943F009F4505498282C
Requests: 3 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 70E64445CBBA2B3F215FBE0A8F58815B
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: ADB76BBF95B37E7AD5A95E04B4DB2314
Requests: 7 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: 354159A7AAD9772D464D564DE1ADCFC8
Requests: 2 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: A021204C38663873E8AE7C3C759680B1
Requests: 2 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: 328519768BA38FABD6727A3A95FCD9CB
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 7337CFDAF677CE29E867B4347E9B197B
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: 0D4531D9D65D7B8C4C991DFCC9D2D188
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: 44FE36B21E1AF70064ACE9CD26125878
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: D8987E6C9DD852F08D8B90E44BE22719
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: 02AD1264A0FE0047175774D519DAAB32
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: 205C63194F9CDCA29F821AD018F92B48
Requests: 13 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: ED6C9D8196E38487FB0AFCA9BEBCDBF0
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 38125D3BF280F3A9728FABA14EA04D94
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: 4E62430584DAFF52F13752DFDB889004
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: 5A1ED1FD617E42F0D2311FA29168E74F
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: 8D1771D1F32617F79D29CC78702CE17F
Requests: 2 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: 4CB455F5D87931962597DDC9F0B6813D
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: E24013E462B674091DB50C1FE9FA4F73
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: B36EDDC9600A4A98D8F38CE32A570116
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: 1A36EE44A0592298792FB2B561BE291D
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: EA341A005D41F3D390764BCAEE7E5B73
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: F39226E1D85CEEE5934615754825782A
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: D1EF180BD520F0C7CEBB3B311C414BC4
Requests: 2 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: CF4A73DE475645BAB363CCF486935CDB
Requests: 2 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: 16D7402BFB9C1DCFBB817FAF65DA3A71
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 5AD2E252803D0F1487A5A458F26E1045
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: 44A5B45A403E62631994D9D3EED1BD10
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: 6AC76CF645FEFB53C2BF6CCEAA96D59E
Requests: 2 HTTP requests in this frame

Frame: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Frame ID: 7668DA4D003F15BAA134F3D1E4BA3290
Requests: 2 HTTP requests in this frame

Frame: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Frame ID: 38761E5E8B2736E8AEE19BB3071E7B1D
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: 66E11D29627A1AC3891634DEC063C177
Requests: 1 HTTP requests in this frame

Frame: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Frame ID: D50B9476B3D1E10F28874BA3DE0996AA
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Frame ID: 5D3BEDA4971AD932323C2E54A6AE03AC
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=neYIRJvmVU-GtlRFm-QcQcm2VUSGsFROkuPGfL6_
Frame ID: D7566DD417B09183B7A3D70892488BDA
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=d2fde370-0fa4-11ee-b2e6-13cc15e39a1e
Frame ID: 696CFC5FB4F1A44482C9A8E60C600534
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Frame ID: 0936607C0D54C4E4760B6E8CEF2AFF8B
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=ruPoSpZIUIJ7GLwbam2kAZU4mbs&gdpr=0&gdpr_consent=
Frame ID: 85702B93CA54E98DC91D2E39BA63A8F0
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:G7IN0PJx1QbHuI5&gdpr=0&gdpr_consent=
Frame ID: AA4EE8EB363C79B211B414550195C29E
Requests: 1 HTTP requests in this frame

Frame: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF
Frame ID: 7085B3BE78477C1FAD1DE096F521FC51
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=792503744794
Frame ID: 8CDC68048D556A60BE1E1EACDFED6200
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
Frame ID: 6C5F93DCE37FA7B08DEB00FADAA60C39
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Frame ID: 259F39A4C4AC043DD00B6A68B7DC826C
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Frame ID: D88FED19EEA07110C752A58FC89F970B
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Frame ID: 6D5528F7902486DD56A501DB15E8F0A5
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=tAdeHa1cC-S_ZuUT5ASSZA
Frame ID: 40B669900BF36810263EFD6B2C0B4F46
Requests: 1 HTTP requests in this frame

Frame: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]
Frame ID: FE86B19C4CA8016C7E8DD7D8DD3928BC
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=e7dec152-414a-4f0d-b405-72cafd61690d
Frame ID: D235CF38D5FC95E9DB26A8C4801AF2D6
Requests: 1 HTTP requests in this frame

Frame: https://matching.truffle.bid/sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID
Frame ID: 0586CD60DC9C21DB526F7A2088BE93F1
Requests: 1 HTTP requests in this frame

Frame: https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Frame ID: 96E575B8AF7DCA312B68A9E94764681D
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7405775081198469329
Frame ID: 3030A29017CB1446C91065F28989954F
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:28F7D4B9C0A54A32B1BE3A0226AC86D4&gdpr=0&gdpr_consent=
Frame ID: E7FA3AD62CEB5E357B26F593D31EA18D
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: 0F06070D6A5E498A15992CE6D7842749
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: A6D08DE9D6FD0744B58CBDE5B474C86C
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: B94E62E8CCBEF42E85E61D6F6E3D483B
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: 248E15CA63D6B796E8ADEDDD7707FEE8
Requests: 1 HTTP requests in this frame

Frame: https://sync.richaudience.com/a939d25b950298d0a5d324cea4fcd3d1/?uid=3958812064475458525&gdpr=0&gdpr_consent=
Frame ID: 54FC0067F433BC7E8CAD3E9964692559
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Frame ID: DBC64E35E76056E3C67299FE355C5AE4
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Frame ID: FCDA59A931CF278C33B1225966261E57
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Frame ID: 9DC81A3E5F6CFCCF35793AD88B43F2ED
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Frame ID: 090421B10062AEF917DBC747DBF45E9A
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Frame ID: 42AE932741C6195FA0A1AFE5CFD2BB58
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: 212E5CA033C11A2B31457534FF64FBB6
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: 3CA51356903CE77CAA79944F765D83D3
Requests: 1 HTTP requests in this frame

Frame: https://id5-sync.com/k/155.gif?id5AccountNum=155&numCascadesAllowed=9&puid=AAEJeE7JJAoAACD7r3WP1g
Frame ID: 47FA3782F056B4D19C73A4743D74702B
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Frame ID: E115F6A1C4844F0BE054B181AF24E02E
Requests: 1 HTTP requests in this frame

Frame: https://sync.richaudience.com/6ccbc109824ae3014a36fd8993cc151d/?uid=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44&gdpr=0
Frame ID: F6F95A18BE44B8B4294BD081D98FECF5
Requests: 1 HTTP requests in this frame

Frame: https://sync.richaudience.com/6ccbc109824ae3014a36fd8993cc151d/?uid=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44&gdpr=0
Frame ID: 735F6CD86FB31ABCADEF1FB8B697702A
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Frame ID: 34462096ACCB41B672AFA4B1A8A9B4B9
Requests: 1 HTTP requests in this frame

Frame: https://sync.richaudience.com/697a8452aebbe5875da0878cfaf3d0d0/?uid=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&gdpr_consent=&us_ps=
Frame ID: 345F0CEE5E1979F29C05F43AF8B32877
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Frame ID: D2ADBB5A24DF59114AA584C4DAF7AC06
Requests: 1 HTTP requests in this frame

Frame: https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Frame ID: E7FDBE546538ECC3BB2D2BEE4F45EC14
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Frame ID: F2D44D28DCBC0C3FA5107767DB0313DB
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Frame ID: B3006514AC91FD7DF2786FD76AFFC7F9
Requests: 1 HTTP requests in this frame

Frame: https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Frame ID: 2965BE32B1BAF0F795C82DCEACE5921A
Requests: 1 HTTP requests in this frame

Frame: https://sync.richaudience.com/a939d25b950298d0a5d324cea4fcd3d1/?uid=3958812064475458525&gdpr=0&gdpr_consent=
Frame ID: 73B37E2F101A8E532742652F179F3136
Requests: 1 HTTP requests in this frame

Frame: https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Frame ID: 818D2DF763E6AAE9CA2F12915C758D13
Requests: 1 HTTP requests in this frame

Frame: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Frame ID: B7C705C6BF2DF42696BF85845DA836F6
Requests: 2 HTTP requests in this frame

Frame: https://sync.search.spotxchange.com/partner?adv_id=6653&uid=cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
Frame ID: 8008B0375A77DC84C743778CF5496585
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Frame ID: A429C169816BC72B0460A084D075D503
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Frame ID: C40E40437DA422DC7EF64DEEB5D370CE
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Frame ID: 908053F7FCF366C9CCFAD06DB3D08E51
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Frame ID: 4DF62D7935779BEBEE93641A6809FF3A
Requests: 1 HTTP requests in this frame

Frame: https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Frame ID: 3964B7F3E4636EEDA9A320E762F8A9A3
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Frame ID: E646911572A9251C16D0521858D58DCC
Requests: 1 HTTP requests in this frame

Frame: https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Frame ID: D10053FF491A050A2C1C3F33CB31E848
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Frame ID: 31CE57CEB71EA946E61091E01FC60BDC
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/freewheel/3f80f6209b9252ca9426775c7eb8e89?gdpr_consent=&gdpr=0
Frame ID: 1DB75CCC8B163817FFF89EF178A14534
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Frame ID: 5FDCD8049BF199AC0D5AC03CBC073428
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Frame ID: C973F135B3108F40793A9C8A675C0344
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Frame ID: 2933DBB5307BEE163E1DB33D2AB20886
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Frame ID: 6A9AA98ADC6800635D61B2E26BE29FD0
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Frame ID: 97D21E3C975DA46EDB92F5DFEE7C3BC6
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Frame ID: 241D9D869F147D07560155C7C3A96113
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Frame ID: 67F692F86FE8417CE4ABD741A24D2B78
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Frame ID: 3EFC86A0224725D1176C2DFA54B5330C
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Frame ID: A2C87DA97C95D7C1855AE17B3E384557
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Frame ID: 7115F09E449018323A8AC8F9716855CE
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Frame ID: 7E86C60B58FBD1551A7F97082942652D
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Frame ID: B57D47D7C6B45DB730451B909718F68F
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/freewheel/3734a527a69bb6e9ffb5baa565b5b083?gdpr_consent=&gdpr=0
Frame ID: 5B36E43A3D81ADCF8AFCB7C74015F1EE
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Frame ID: 81AE7FE4B185DB6BC3CA22EC98C88527
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/freewheel/aad958804afe4ca273405e5673d62eef?gdpr_consent=&gdpr=0
Frame ID: 1806E893300692ABD6C3B7E5B4DAF729
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/freewheel/aad958804afe4ca273405e5673d62eef?gdpr_consent=&gdpr=0
Frame ID: 9A44949D1093231F21D79FD838631386
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Frame ID: 393A51B0DBADEFFE3C9C0A202E27EE24
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/freewheel/c38114cf2e856747dcd2252d549fb?gdpr_consent=&gdpr=0
Frame ID: 792219BA2F077ECD49EB7B4438CB9E3C
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Frame ID: E970CC23B59077730544947539A9ACFD
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Frame ID: B66C5E64A9AB94F260DB473FBD9508D1
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Frame ID: D77164CA080D1B23FAC85D7699755F4B
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Frame ID: 5810BB1113E4FA81C5076EAD66C7BE08
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Frame ID: B1ED178F9932CA28915CBA25FDFD6124
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/freewheel/99dadd3a4b121d59968c6b86fe6c61e1?gdpr_consent=&gdpr=0
Frame ID: 9D53597E7AE6953AA88F60F644418085
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Frame ID: 62745AA66817A4E041D857E0E1D7FBE4
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/freewheel/4a5ba88d7370bc1ec9f04c856efc52f6?gdpr_consent=&gdpr=0
Frame ID: 9B459B91AC5D409A2118EBCB33D7E96F
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Frame ID: 4287FD937F68E9F10F8E9F4CC886E2A6
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Frame ID: 659523FC6B5D850A917B7B0614DBB687
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Frame ID: AEA86F43981C25B5C82BB56193AE1C78
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Frame ID: E8932FEC148459F2515E269A9C190230
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Frame ID: 94FAFFA063F377AD3C8E0759D5FC3F62
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Frame ID: 39BE96B9FE27F3C1BD964988B99B7FFF
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Frame ID: 2F36203FDF4038040641F31801DD5847
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Frame ID: 8A6FE5018C3B98559CB17F75D5470C9A
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Frame ID: 1214A653EB9F4F018B40BCB3AC494256
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Frame ID: 26A3167E3F760D02555085B470E8DF97
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Frame ID: B55C62405BF3A21DFA3DF351EEEA53B4
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Frame ID: 7F657B9D886C7F0FC34D8E1422C59607
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Frame ID: 87CAFA18E488BBD81B7022FF6E6AA005
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Frame ID: B0C7DBF0BA550F64CA66410B2145500F
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: 487E9539CD853610E8C423D711951CC5
Requests: 2 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: 9EE10294F0270794E0D6E010F61E9F78
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 8C74B731AEDE7B45EE90BB9589CE6FB9
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 7CE4993D376950E5EF6639B3E0267BA7
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: C04146814AC9B4AF89446ACA1DD2E38B
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: C820C3FCC8AAB699739E19265E927A17
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 26786041BABDD39D723EAA5685ACFE22
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: 445125FA0807776DA6FCE3986E75179F
Requests: 2 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: 781B98CF3216108505F5F36854E0902B
Requests: 2 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: E7D9EB1EA32150129471428E24212BDB
Requests: 2 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: C516C8E0646EE11DEA3386037DD80D3F
Requests: 2 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: ADC60D35DCC8CC005EB1EB25CFE073FF
Requests: 2 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: 46D33FA36EBE185313A0C8638ED57116
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Meghan Markle earned more than The Weeknd for '12 hours work': Spotify

Page URL History Show full URLs

  1. http://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-... HTTP 301
    https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • //maps\.google(?:apis)?\.com/maps/api/js
Overall confidence: 100%
Detected patterns
  • accounts\.google\.com/gsi/client
Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • (?:prototype|protoaculous)(?:-([\d.]*[\d]))?.*\.js
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • tpc\.googlesyndication\.com/safeframe
Overall confidence: 100%
Detected patterns
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • moatads\.com
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net
Overall confidence: 100%
Detected patterns
  • /polyfill\.min\.js
Overall confidence: 100%
Detected patterns
  • adnxs\.com/[^"]*(?:prebid|/pb\.js)
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com
Overall confidence: 100%
Detected patterns
  • \.quantserve\.com/quant\.js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com
Overall confidence: 100%
Detected patterns
  • //s\.btstatic\.com/tag\.js
Overall confidence: 100%
Detected patterns
  • <iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon
  • \.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

1030
Requests

81 %
HTTPS

24 %
IPv6

175
Domains

280
Subdomains

174
IPs

13
Countries

11972 kB
Transfer

32610 kB
Size

317
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/ HTTP 301
    https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 45
  • https://unpkg.com/web-vitals@3/dist/web-vitals.iife.js HTTP 302
  • https://unpkg.com/web-vitals@3.3.2/dist/web-vitals.iife.js
Request Chain 72
  • https://pixel.sitescout.com/dmp/asyncPixelSync HTTP 302
  • https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
Request Chain 76
  • https://sb.scorecardresearch.com/b?c1=2&c2=6035443&ns__t=1687291096514&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1687291096514&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&c9=
Request Chain 77
  • https://pixel.sitescout.com/iap/d66dfa6e9938b7de HTTP 302
  • https://pixel.sitescout.com/iap/d66dfa6e9938b7de?cookieQ=1
Request Chain 107
  • https://js.matheranalytics.com/s/ma23578/239876506/wp/ml.js?cb=1627 HTTP 301
  • https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
Request Chain 109
  • https://dpm.demdex.net/ibs:dpid=82530&dpuuid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent= HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=
Request Chain 110
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2499&partner_device_id=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341 HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341
Request Chain 111
  • https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent= HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=&xl8blockcheck=1 HTTP 302
  • https://load77.exelator.com/pixel.gif
Request Chain 113
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=&ct=y
Request Chain 176
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift HTTP 302
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Request Chain 201
  • https://rp.liadm.com/j?dtstmp=1687291099053&aid=a-04i4&se=e30&duid=f107d3ac6b63--01h3d65x5a82x2dqp0kjyedmwh&tna=v2.7.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&us_privacy=1---&wpn=lc-bundle&gdpr=0&c=PHRpdGxlPk1lZ2hhbiBNYXJrbGUgZWFybmVkIG1vcmUgdGhhbiBUaGUgV2Vla25kIGZvciAnMTIgaG91cnMgd29yayc6IFNwb3RpZnk8L3RpdGxlPjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJNZWdoYW4gTWFya2xlIG9ubHkgcHJvZHVjZWQgMTIgaG91cnMgb2YgcG9kY2FzdCBjb250ZW50IGluIDLCvSB5ZWFycywgeWV0IHBvc3NpYmx5IGVhcm5lZCBtb3JlIHRoYW4gVGhlIFdlZWtuZCBmb3IgaGlzIGh1Z2UgaGl0ICdCbGluZGluZyBMaWdodHMuJyI-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzA2LzIwL21lZ2hhbi1tYXJrbGUtZWFybmVkLW1vcmUtdGhhbi10aGUtd2Vla25kLWZvci1qdXN0LTEyLWhvdXJzLXdvcmstZXgtc3BvdGlmeS1leGVjLXRlbGxzLWJiYy8iPjxoMSBjbGFzcz0ic2VjdGlvbi1oZWFkZXIiPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQ8L2E-PC9oMT48aDEgY2xhc3M9ImVudHJ5LXRpdGxlIj4KCjxkaXYgY2xhc3M9ImVudHJ5LXNlY3Rpb24iPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQgfCA8L2E-PC9kaXY-CQoJCQkJPHNwYW4gY2xhc3M9ImRmbS10aXRsZSBmcmVlIj4KCQkJTWVnaGFuIE1hcmtsZSBlYXJuZWQgbW9yZSB0aGFuIFRoZSBXZWVrbmQgZm9yIGp1c3Qg4oCYMTIgaG91cnMgd29yayzigJkgZXgtU3BvdGlmeSBleGVjIHRlbGxzIEJCQwkJPC9zcGFuPgoKCQoJPC9oMT4 HTTP 302
  • https://rp4.liadm.com/j?dtstmp=1687291099053&aid=a-04i4&se=e30&duid=f107d3ac6b63--01h3d65x5a82x2dqp0kjyedmwh&tna=v2.7.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&us_privacy=1---&wpn=lc-bundle&gdpr=0&c=PHRpdGxlPk1lZ2hhbiBNYXJrbGUgZWFybmVkIG1vcmUgdGhhbiBUaGUgV2Vla25kIGZvciAnMTIgaG91cnMgd29yayc6IFNwb3RpZnk8L3RpdGxlPjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJNZWdoYW4gTWFya2xlIG9ubHkgcHJvZHVjZWQgMTIgaG91cnMgb2YgcG9kY2FzdCBjb250ZW50IGluIDLCvSB5ZWFycywgeWV0IHBvc3NpYmx5IGVhcm5lZCBtb3JlIHRoYW4gVGhlIFdlZWtuZCBmb3IgaGlzIGh1Z2UgaGl0ICdCbGluZGluZyBMaWdodHMuJyI-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzA2LzIwL21lZ2hhbi1tYXJrbGUtZWFybmVkLW1vcmUtdGhhbi10aGUtd2Vla25kLWZvci1qdXN0LTEyLWhvdXJzLXdvcmstZXgtc3BvdGlmeS1leGVjLXRlbGxzLWJiYy8iPjxoMSBjbGFzcz0ic2VjdGlvbi1oZWFkZXIiPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQ8L2E-PC9oMT48aDEgY2xhc3M9ImVudHJ5LXRpdGxlIj4KCjxkaXYgY2xhc3M9ImVudHJ5LXNlY3Rpb24iPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQgfCA8L2E-PC9kaXY-CQoJCQkJPHNwYW4gY2xhc3M9ImRmbS10aXRsZSBmcmVlIj4KCQkJTWVnaGFuIE1hcmtsZSBlYXJuZWQgbW9yZSB0aGFuIFRoZSBXZWVrbmQgZm9yIGp1c3Qg4oCYMTIgaG91cnMgd29yayzigJkgZXgtU3BvdGlmeSBleGVjIHRlbGxzIEJCQwkJPC9zcGFuPgoKCQoJPC9oMT4&i6=MjYwNzo1MzAwOjYwOjc4Njc6OjY%3D&n3pc=true
Request Chain 235
  • https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E&gdpr=0 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3302926991455551000V10
Request Chain 236
  • https://s.ad.smaato.net/c/?adExInit=aps&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsmaato.com%26id%3D%24UID HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=d854fcfc
Request Chain 248
  • https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0 HTTP 302
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Request Chain 249
  • https://ssbsync-us.smartadserver.com/api/sync?callerId=2&gdpr=0 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=8231229510999469573&gdpr=0&gdpr_consent=
Request Chain 250
  • https://amazon-tam-match.dotomi.com/match/bounce/current?networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D&gdpr=0 HTTP 302
  • https://amazon-tam-match.dotomi.com/match/bounce/current?DotomiTest=5b0c14d254f505ef&is_secure=true&networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D&gdpr=0 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAHwrPka_OISwNtL3lEAAAAAAA&expiration=1687377500&is_secure=true&gdpr=0
Request Chain 265
  • https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint HTTP 302
  • https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
Request Chain 267
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid=%24UID&ex=appnexus.com&gdpr=0 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?id=3958812064475458525&ex=appnexus.com&gdpr=0
Request Chain 268
  • https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0 HTTP 301
  • https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0 HTTP 302
  • https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Request Chain 270
  • https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID&gdpr=0 HTTP 302
  • https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=3075899752081279888305
Request Chain 278
  • https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID HTTP 302
  • https://usersync.gumgum.com/usersync?b=apn&i=3958812064475458525
Request Chain 279
  • https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_5f8a27c9-52a9-4f51-af59-852beb0ad309&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=u_5f8a27c9-52a9-4f51-af59-852beb0ad309&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=gumgum2 HTTP 302
  • https://c1.adform.net/serving/cookie/match/?CC=1&party=24&bidswitch_ssp_id=gumgum2 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=70&user_id=5407894714181040436&ssp=gumgum2 HTTP 302
  • https://usersync.gumgum.com/usersync?b=bsw&i=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=&gdpr_consent=&us_privacy=
Request Chain 280
  • https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://usersync.gumgum.com/usersync?b=sta&i=0-aee3e84a-9648-5082-7b18-bc1b6a6da401$ip$149.56.153.187
Request Chain 281
  • https://b1sync.zemanta.com/usersync/gumgum/?puid=u_5f8a27c9-52a9-4f51-af59-852beb0ad309&gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__ HTTP 302
  • https://stags.bluekai.com/site/23178?id=enfOlcX9S9Dq6ua2mBcD&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2ZLOMZHWYY2YHFJTSRDRGZ2WCMTNIJRUI&gdpr=0 HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2ZLOMZHWYY2YHFJTSRDRGZ2WCMTNIJRUI HTTP 302
  • https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=enfOlcX9S9Dq6ua2mBcD
Request Chain 282
  • https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25 HTTP 302
  • https://usersync.gumgum.com/usersync?b=pln&i=sk2jAnLigg03&ev=1&pid=558355
Request Chain 283
  • https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D HTTP 302
  • https://usersync.gumgum.com/usersync?b=obn&i=ENC%286ul5yVUFDR0AFuRLLroJFAQ-_uzJjch8RttS1ms8m_CpS8R4PYdI1nGgZ7Jos-AJ%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26platformUid%3D%7Bplatform_uid%7D%26obuid%3DENC%286ul5yVUFDR0AFuRLLroJFAQ-_uzJjch8RttS1ms8m_CpS8R4PYdI1nGgZ7Jos-AJ%29%26gdpr%3D0 HTTP 302
  • https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_5f8a27c9-52a9-4f51-af59-852beb0ad309&obuid=ENC(6ul5yVUFDR0AFuRLLroJFAQ-_uzJjch8RttS1ms8m_CpS8R4PYdI1nGgZ7Jos-AJ)&gdpr=0 HTTP 302
  • https://sync.outbrain.com/syncPlatform?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0 HTTP 302
  • https://ice.360yield.com/server_match?partner_id=1863&r=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dimprove_digital%26uid%3D%7BPUB_USER_ID%7D%26obUid%3D6ul5yVUFDR0AFuRLLroJFAQ-_uzJjch8RttS1ms8m_CpS8R4PYdI1nGgZ7Jos-AJ%26gdpr%3D0%26gdpr_consent%3D%24CONSNT_STRING%26us_privacy%3D%24CCPA%26initiator%3Dplatform HTTP 302
  • https://sync.outbrain.com/cookie-sync?p=improve_digital&uid=cf5fb249-43c2-4293-b0ec-8acb4f767842&obUid=6ul5yVUFDR0AFuRLLroJFAQ-_uzJjch8RttS1ms8m_CpS8R4PYdI1nGgZ7Jos-AJ&gdpr=0&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA&initiator=platform
Request Chain 284
  • https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D HTTP 302
  • https://us-u.openx.net/w/1.0/cm?cc=1&_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D HTTP 302
  • https://usersync.gumgum.com/usersync?b=opx&i=b1d1f1b4-7f84-4c15-b187-b81bffd95c6d
Request Chain 285
  • https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent= HTTP 302
  • https://usersync.gumgum.com/usersync?b=oth&i=y-k8SBXOFE2pfQp.rR0edCRuu8R8kXbuYRJ9U4~A
Request Chain 286
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dvnt%26i%3D HTTP 302
  • https://usersync.gumgum.com/usersync?b=vnt&i=d73a5f9f-f848-4ab7-950f-b9fc12a99154
Request Chain 287
  • https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D HTTP 307
  • https://usersync.gumgum.com/usersync?b=snc&i=16F85AA78ED646369CC5112051089037
Request Chain 289
  • https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
  • https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
  • https://usersync.gumgum.com/usersync?b=idi&i=cf5fb249-43c2-4293-b0ec-8acb4f767842
Request Chain 290
  • https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent= HTTP 302
  • https://usersync.gumgum.com/usersync?b=sad&i=8231229510999469573
Request Chain 293
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=
Request Chain 294
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=
Request Chain 295
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=
Request Chain 296
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4 HTTP 302
  • https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=$UID HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=3958812064475458525
Request Chain 297
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZJIE3OP2OC752A2TKDUZ_AAADoAAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid= HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEL7wJTJiAOcwSLwcNq0t7Dc&google_cver=1
Request Chain 298
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZJIE3OP2OC752A2TKDUZ-AAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFuZvXRzkK0e2XpOeKl2lW4&google_cver=1
Request Chain 299
  • https://match.adsrvr.org/track/cmf/casale HTTP 302
  • https://match.adsrvr.org/track/cmb/casale HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&expiration=1689883100&gdpr=0&gdpr_consent=
Request Chain 301
  • https://match.prod.bidr.io/cookie-sync/ie HTTP 303
  • https://match.prod.bidr.io/cookie-sync/ie?_bee_ppp=1 HTTP 303
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAEJeE7JJAoAACD7r3WP1g&expiration=1688500701
Request Chain 302
  • https://s.company-target.com/s/ix?cm_dsp_id=18&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid= HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1703102300&external_user_id=fdc6fea8-0fb1-44f4-8faf-1c49c06a29f1
Request Chain 304
  • https://ssbsync.smartadserver.com/api/sync?callerId=82&gdpr=$%7bGDPR%7d&gdpr_consent=$%7bGDPR_CONSENT%7d HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=8231229510999469573&gdpr=0&gdpr_consent=
Request Chain 307
  • https://gum.criteo.com/sid/json?origin=publishertagids&domain=mercurynews.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=0Wn6MXx3eWFOQmZ0bHYvM3RNMFBwWXl5U3hPZmdVZVhxR2FCYVdXSDFLMURManYydkVKZEZHL1dQeEJDREtSejFwMDk5dUVxeXlJZHJ6WEx0UC8wcm94Q2drMGpRYXl2S2svOUFWUSs4L0hWVS9mMnZsZlNWc0JWOGRFQmYvMXRXZnNLYU13MCthRWVNSEdDcWRqNllsb0I5MEliUVJuQ1BNUll2TzNodkZ3eFhnaE5QZGxSMng0alRVMjNQQnBQNkV4dDhoMUlkand5K2lhbGN6RGROb2ZVaUNkSHpHbUpNaFpOS21iT0NWeUdMOTJvRElUSlRkK2NoYVdvZnpQcnl5NnJaQkQzK3NFbEJuNmlyY3ltVkFUdUxPdz09fA&cppv=2
Request Chain 309
  • https://ssc-cms.33across.com/ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11580%26puid%3D33XUSERID33X HTTP 302
  • https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212147305902640
Request Chain 310
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjJFQkJGN0QtNEM3OS00RjMxLUI2N0ItOTIwNjI1Qzk4REVG&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://cs-server-s2s.yellowblue.io/cs?aid=11576&id=F2EBBF7D-4C79-4F31-B67B-920625C98DEF
Request Chain 312
  • https://csync.loopme.me/?pubid=11362&gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11571%26id%3D%7Bdevice_id%7D HTTP 307
  • https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=f66eb2fc-b468-4574-8969-c71d03ddbfc2&gdpr_consent=null&gdpr=0
Request Chain 313
  • https://match.sharethrough.com/universal/v1?supply_id=5926d422&gdpr=0&gdpr_consent= HTTP 302
  • https://cs.yellowblue.io/cs?aid=11587&uid=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44&gdpr=0
Request Chain 314
  • https://ads.stickyadstv.com/user-matching?id=3663&gdpr=0&gdpr_consent= HTTP 302
  • https://cs.yellowblue.io/cs?aid=11601&id=dc7f10ceecad21d153e322ad1639d39a&gdpr_consent=&gdpr=0
Request Chain 315
  • https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11603%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$%7BBSW_UUID%7D HTTP 302
  • https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=56daf56a-28b1-40e7-a167-b6cb39d3f949
Request Chain 316
  • https://sync.go.sonobi.com/us?gdpr=0&consent_string=&loc=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D115667%26uid%3D%5BUID%5D HTTP 302
  • https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=7e845585-56d9-415f-9a4c-32558686bff3
Request Chain 317
  • https://us-u.openx.net/w/1.0/cm?id=58ceaaf5-c766-4c17-869a-d76e43401714&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11563%26id%3D HTTP 302
  • https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=aeec4952-807e-4906-9dbb-f46416208968
Request Chain 318
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11596%26id%3D$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=3958812064475458525&gdpr=0&gdpr_consent=
Request Chain 319
  • https://ups.analytics.yahoo.com/ups/58760/sync?redir=true&gdpr=0&gdpr_consent= HTTP 302
  • https://cs.yellowblue.io/cs?aid=11591&id=y-Yxk.24ZE2uKUAqzaS.qWspizPfz2jnch~A&gdpr_in_effect=0
Request Chain 326
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://usersync.gumgum.com/usersync?b=ttd&i=120447a6-30d3-414b-b8f9-7a5eddeefdcd
Request Chain 327
  • https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d HTTP 302
  • https://usersync.gumgum.com/usersync?b=mmh&i=cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
Request Chain 328
  • https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=ZJIE3AABR7XTlQAz HTTP 302
  • https://usersync.gumgum.com/usersync?b=atm&i=ZJIE3AABR7XTlQAz&gdpr=0&gdpr_consent=&_test=ZJIE3AABR7XTlQAz
Request Chain 330
  • https://tg.socdm.com/aux/idsync?proto=gumgum HTTP 302
  • https://usersync.gumgum.com/usersync?b=sus&i=ZJIE3cCo8YMAANUleFsAAAAA
Request Chain 331
  • https://cs.admanmedia.com/sync/gumgum?puid=u_5f8a27c9-52a9-4f51-af59-852beb0ad309&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Daad%26i%3D%5BDSP_USER_ID%5D&gdpr=0&gdpr_consent=&ccpa= HTTP 302
  • https://usersync.gumgum.com/usersync?b=aad&i=d90855e2-a762-4191-8327-12f7f682caea
Request Chain 333
  • https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=LU1qSVJVMmtTOGszaGFhc2ZHWVJrUQ&gdpr=0&gdpr_consent= HTTP 302
  • https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEBMsIDSDWrdjerDZZjGKunc&google_cver=1
Request Chain 334
  • https://pulsepoint-match.dotomi.com/match/bounce/current?networkId=14200&version=1&nuid= HTTP 302
  • https://pulsepoint-match.dotomi.com/match/bounce/current?DotomiTest=7d7ea8bcf09f15d8&is_secure=true&networkId=14200&version=1&nuid= HTTP 302
  • https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAACG66zQrJ-VQNny_ryAAAAAAA&expiration=1687377500&nuid=&is_secure=true
Request Chain 337
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3107&partner_device_id=g7eec97c22de0d66b1bd HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=c696eff3-e87b-4a1e-ba21-beda78dea841%252C%252C&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&ttd_puid=c696eff3-e87b-4a1e-ba21-beda78dea841%2C%2C
Request Chain 338
  • https://cm.g.doubleclick.net/pixel?google_nid=yieldmo_dbm&google_cm&pn_id=c HTTP 302
  • https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEH5G4iZmJxbVRw473ZzSapI&google_cver=1
Request Chain 339
  • https://sync.1rx.io/usersync2/rmpssp?sub=yieldmo&redir%3Dhttps%3A%2F%2Fads.yieldmo.com%2Fv000%2Fsync%3Fpn_id%3Dunl%26id%3D%5BRX_UUID%5D HTTP 302
  • https://sync.1rx.io/usersync2/rmpssp?sub=yieldmo&zcc=1&cb=1687291100973 HTTP 302
  • https://ad.turn.com/r/cs?pid=45&rndcb=1535260460 HTTP 302
  • https://sync.1rx.io/usersync/turn/8818067066479886686?dspret=1&gdpr=&gdpr_consent=&us_privacy= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005?redir=https%3A%2F%2Fads.yieldmo.com%2Fv000%2Fsync%3Fpn_id%3Dunl%26id%3DRX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005 HTTP 302
  • https://ads.yieldmo.com/v000/sync?pn_id=unl&id=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Request Chain 340
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=yieldmo&ttd_tpi=1&ttd_puid=g7eec97c22de0d66b1bd HTTP 302
  • https://ads.yieldmo.com/v000/sync?tdid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
Request Chain 341
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.yieldmo.com%252Fsync%253Fpn_id%253Dpub%2526id%253D%2523PMUID%2526gdpr%253DPM_GDPR%2526gdpr_consent%253DPM_CONSENT HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=N0MzQTdCREUtOUM2Mi00QTVBLTgyRkEtRjlFRkE3QzM3RTdE&gdpr=-1&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://cs-server-s2s.yellowblue.io/cs?aid=11576&id=F2EBBF7D-4C79-4F31-B67B-920625C98DEF
Request Chain 351
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=rise_engage&endpoint=us-east HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Request Chain 353
  • https://creativecdn.com/cm-notify?pi=gumgum HTTP 302
  • https://creativecdn.com/cm-notify?pi=gumgum&tc=1 HTTP 302
  • https://usersync.gumgum.com/usersync?b=rth&i=FOYPqMoXokSCEEaOCmV5&pi=gumgum&tc=1
Request Chain 354
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=gumgum
Request Chain 356
  • https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent= HTTP 302
  • https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=&tc=1 HTTP 302
  • https://ce.lijit.com/merge?pid=86&3pid=FOYPqMoXokSCEEaOCmV5&pi=sovrn&gdpr=0&gdpr_consent=&tc=1
Request Chain 357
  • https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent= HTTP 303
  • https://ce.lijit.com/merge?pid=85&3pid=AAEJeE7JJAoAACD7r3WP1g&gdpr=0
Request Chain 359
  • https://ap.lijit.com/dsp/google/cookiematch/dv?gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=RzJWdWNQWkg5VkVwdXhPclFtS3JLa2lB&gdpr=0
Request Chain 360
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=23&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=16&3pid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=
Request Chain 365
  • https://tg.socdm.com/aux/idsync?proto=taboola HTTP 302
  • https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZJIE3cCo8YMAANUleG8AAAAA
Request Chain 366
  • https://ih.adscale.de/su?gdpr=0&gdpr_consent=&tpid=22688&cburl=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fstroerrtbeur-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D__STROEER_USER_ID__ HTTP 302
  • https://ih.adscale.de/su?gdpr=0&gdpr_consent=&tpid=22688&cburl=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fstroerrtbeur-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D__STROEER_USER_ID__&nut&uu=df6e617353214db49e68936a344cacdd HTTP 302
  • https://sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/?taboola_hm=df6e617353214db49e68936a344cacdd
Request Chain 368
  • https://pixel.rubiconproject.com/exchange/sync.php?p=16698 HTTP 302
  • https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LJ4PJZ48-27-1JKH
Request Chain 369
  • https://pr-bh.ybp.yahoo.com/sync/taboola/cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59?gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-3grU.XJE2oTUKS_LYbwZqoC0nQuza5E44VkylA--~A
Request Chain 370
  • https://trace.mediago.io/ju/cs/taboola HTTP 302
  • https://sync.taboola.com/sg/baidurtb-network/1/rtb-h/?taboola_hm=9baf32f62846fdfc1db3baa355c22fe4
Request Chain 371
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm&google_sc HTTP 302
  • https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEJV4Q1nBqlQegGe-caNtcfg&google_cver=1
Request Chain 373
  • https://sync.taboola.com/sg/google-network/1/rtb/?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dtaboola_dbm%26google_sc%26gdpr%3D0%26gdpr_consent%3D&orig=trc HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59
Request Chain 374
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=054f32o&ttd_tpi=1 HTTP 302
  • https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=120447a6-30d3-414b-b8f9-7a5eddeefdcd
Request Chain 378
  • https://dis.criteo.com/dis/usersync.aspx?r=29&p=282&cp=taboolaortb&cu=1&url=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fcriteortb-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%40%40CRITEO_USERID%40%40 HTTP 302
  • https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=33ce34a0-aa4b-4208-9ad8-c7db1317a38f
Request Chain 379
  • https://id5-sync.com/s/464/9.gif?puid=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fid5-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%7BID5UID%7D HTTP 302
  • https://id5-sync.com/c/464/464/7/1.gif?puid=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F441%2F6%2F2.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/464/441/6/2.gif?puid=u_5f8a27c9-52a9-4f51-af59-852beb0ad309&gdpr=0&gdpr_consent= HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F429%2F5%2F3.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0 HTTP 302
  • https://id5-sync.com/c/464/429/5/3.gif?puid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/k/264.gif?puid=120447a6-30d3-414b-b8f9-7a5eddeefdcd&ttl=%%TTL%% HTTP 302
  • https://ib.adnxs.com/getuid?https://id5-sync.com/c/464/2/3/5.gif?puid=$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/464/2/3/5.gif?puid=3958812064475458525&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F108%2F2%2F6.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/464/108/2/6.gif?puid=c696eff3-e87b-4a1e-ba21-beda78dea841&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F434%2F1%2F7.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent= HTTP 302
  • https://id5-sync.com/c/464/434/1/7.gif?puid=7e845585-56d9-415f-9a4c-32558686bff3&gdpr=0&gdpr_consent= HTTP 302
  • https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F112%2F0%2F8.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://uipglob.semasio.net/id5/1/get2?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F112%2F0%2F8.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://id5-sync.com/c/464/112/0/8.gif?puid=711CE39FE8077C48&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.taboola.com/sg/id5-network/1/rtb-h/?taboola_hm=ID5-148auFSVvSxCtzl9jqLduUI9OFkslL7ZyIQ64epekQ
Request Chain 380
  • https://x.bidswitch.net/sync?ssp=taboola&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://inv-nets.admixer.net/adxcm.aspx?ssp=D41B0D84-4DB7-4D9C-81CC-3A497DB5D0A6&gdpr=0&consent=&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D354%26user_id%3D%24%24visitor_cookie%24%24%26ssp%3Dtaboola%26bsw_param%3D56daf56a-28b1-40e7-a167-b6cb39d3f949%26gdpr%3D0%26consent%3D%26gdpr_pd%3D%26expires%3D7 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=354&user_id=a03df4b2a76b43d09cb62f7d043a0456&ssp=taboola&bsw_param=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&consent=&gdpr_pd=&expires=7 HTTP 302
  • https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
Request Chain 381
  • https://rtb.mfadsrvr.com/sync?ssp=taboola HTTP 302
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=taboola HTTP 302
  • https://sync.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=1a2b4bb9-5661-4d14-97cd-37d814131325 HTTP 302
  • https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=1a2b4bb9-5661-4d14-97cd-37d814131325&tbid=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59&query=taboola_hm%3D1a2b4bb9-5661-4d14-97cd-37d814131325&isDirect=0
Request Chain 384
  • https://sync.srv.stackadapt.com/sync?nid=140 HTTP 302
  • https://sync.taboola.com/sg/stackadaptrtb-network/1/rtb-h?taboola_hm=ruPoSpZIUIJ7GLwbam2kAZU4mbs
Request Chain 386
  • https://u.openx.net/w/1.0/cm?gdpr=0&gdpr_consent=&ph=295bf259-a378-4089-aae8-a2a995ba8627&id=37f45540-fa88-4005-bf73-8a7ac39467e3&r=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fopenxrtb-network%2F1%2Frtb-h%2F%3Fgdpr%3D0%26us_privacy%3D1---%26orig%3Dvideo%26taboola_hm%3D HTTP 302
  • https://sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/?gdpr=0&us_privacy=1---&orig=video&taboola_hm=c1d6b6e7-bd90-4514-a452-a97096f4f99f
Request Chain 396
  • https://dsum.casalemedia.com/pbusermatch?origin=prebid&site_id=945271&p=1&i=0&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://bttrack.com/pixel/cookiesync?source=67e94f23-25d6-4008-8236-375d1743c2e0&secure=1 HTTP 302
  • https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=634c3c99-8329-4b19-9a7c-6032b037edd5
Request Chain 397
  • https://eb2.3lift.com/sync?px=1&src=prebid&us_privacy=1---& HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=3658&xuid=120447a6-30d3-414b-b8f9-7a5eddeefdcd&dongle=0cfd&gdpr=0&gdpr_consent=
Request Chain 398
  • https://ads.yieldmo.com/pbcas?us_privacy=1---&gdpr=0&gdpr_consent=&type=image HTTP 302
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=yieldmo HTTP 302
  • https://ads.yieldmo.com/sync?pn_id=rc&id=LJ4PJZ48-27-1JKH
Request Chain 403
  • https://d.turn.com/r/dd/id/L21rdC8xOTcxL2NpZC8xNzQ5ODczMjc1L3QvMg/url/https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=$!%7BTURN_UUID%7D&us_privacy=1--- HTTP 302
  • https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=3617687916288987172&us_privacy=1--- HTTP 303
  • https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@&us_privacy=1--- HTTP 302
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-hdkX0STfTNt33RYU-jtmrVnq3RNsqMpge4bwPQ&us_privacy=1--- HTTP 303
  • https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-hdkX0STfTNt33RYU-jtmrVnq3RNsqMpge4bwPQ&us_privacy=1---&us_privacy=1---
Request Chain 404
  • https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=5837ff19-efdc-41d5-968d-152ebd725d6e&us_privacy=1--- HTTP 302
  • https://p.rfihub.com/cm?pub=39342&in=1&userid=eebba6c9-87bf-4ef6-b3de-dcca9f36a268%3A1687291101.4033356&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3Deebba6c9-87bf-4ef6-b3de-dcca9f36a268%253A1687291101.4033356%26_%3D1687291101.407609&cb=1687291101.4076474 HTTP 302
  • https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=970314640601641075&referrer={encSite}&forward=https%3A%2F%2Fidsync.rlcdn.com%2F501709.gif%3Fpartner_uid%3Deebba6c9-87bf-4ef6-b3de-dcca9f36a268%253A1687291101.4033356%26_%3D1687291101.407609 HTTP 302
  • https://idsync.rlcdn.com/501709.gif?partner_uid=eebba6c9-87bf-4ef6-b3de-dcca9f36a268%3A1687291101.4033356&_=1687291101.407609 HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CM3PHhJBCj0IARAFGjdlZWJiYTZjOS04N2JmLTRlZjYtYjNkZS1kY2NhOWYzNmEyNjg6MTY4NzI5MTEwMS40MDMzMzU2EAAaDQjeicikBhIFCOgHEABCAEoA HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESEElp2P1EbzCoQYF9L9zVJE8&google_cver=1
Request Chain 405
  • https://x.bidswitch.net/syncd?dsp_id=256&user_group=2&user_id=5837ff19-efdc-41d5-968d-152ebd725d6e&redir=//i.liadm.com/s/52176?bidder_id%3D5298%26bidder_uuid%3D$%7BBSW_UID%7D&us_privacy=1--- HTTP 302
  • https://i.liadm.com/s/52176?bidder_id=5298&bidder_uuid=56daf56a-28b1-40e7-a167-b6cb39d3f949 HTTP 303
  • https://x.bidswitch.net/sync?ssp=liveintent&user_id=5837ff19-efdc-41d5-968d-152ebd725d6e HTTP 302
  • https://sync.srv.stackadapt.com/sync?nid=50&gdpr=&gdpr_consent=&gdpr_pd=&ssp=liveintent HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=188&user_id=ruPoSpZIUIJ7GLwbam2kAZU4mbs&user_group=1&ssp=liveintent HTTP 302
  • https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=56daf56a-28b1-40e7-a167-b6cb39d3f949
Request Chain 406
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0&us_privacy=1--- HTTP 302
  • https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=120447a6-30d3-414b-b8f9-7a5eddeefdcd HTTP 303
  • https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
Request Chain 408
  • https://x.dlx.addthis.com/e/live_intent_sync?na_exid=5837ff19-efdc-41d5-968d-152ebd725d6e&us_privacy=1--- HTTP 302
  • https://x.dlx.addthis.com/e/live_intent_sync?na_exid=5837ff19-efdc-41d5-968d-152ebd725d6e&us_privacy=1---&rd=Y
Request Chain 409
  • https://b1sync.zemanta.com/usersync/liveintent/?cb=//i.liadm.com/s/35004?bidder_id%3D98254%26bidder_uuid%3D__ZUID__&us_privacy=1--- HTTP 302
  • https://stags.bluekai.com/site/23178?id=enfOlcX9S9Dq6ua2mBcD&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DF4XWSLTMNFQWI3JOMNXW2L3TF4ZTKMBQGQ7WE2LEMRSXEX3JMQ6TSOBSGU2CMYTJMRSGK4S7OV2WSZB5MVXGMT3MMNMDSUZZIRYTM5LBGJWUEY2EEZSXQY3IMFXGOZJ5NRUXMZLJNZ2GK3TUEZ2XGX3QOJUXMYLDPE6TCLJNFU&us_privacy=1--- HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=F4XWSLTMNFQWI3JOMNXW2L3TF4ZTKMBQGQ7WE2LEMRSXEX3JMQ6TSOBSGU2CMYTJMRSGK4S7OV2WSZB5MVXGMT3MMNMDSUZZIRYTM5LBGJWUEY2EEZSXQY3IMFXGOZJ5NRUXMZLJNZ2GK3TUEZ2XGX3QOJUXMYLDPE6TCLJNFU HTTP 302
  • https://i.liadm.com/s/35004?bidder_id=98254&bidder_uuid=enfOlcX9S9Dq6ua2mBcD&us_privacy=1---
Request Chain 410
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&gdpr=0&gdpr=0&khaos=LJ4PJZ48-27-1JKH HTTP 302
  • https://s.amazon-adsystem.com/ecm3?id=LJ4PJZ48-27-1JKH&ex=d-rubiconproject.com&status=ok&gdpr=0
Request Chain 417
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr=0 HTTP 302
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=4xWyMjJYQcO_5hLXPrQKYw&rk=usync-na&gdpr=0 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=4xWyMjJYQcO_5hLXPrQKYw&gdpr=0
Request Chain 418
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&gdpr=0 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEHuWC9X0LNcdrm6NGEM-y4g&google_cver=1
Request Chain 419
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=&expires=30
Request Chain 420
  • https://token.rubiconproject.com/token?pid=36584&gdpr=0 HTTP 302
  • https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJ4PJZ48-27-1JKH&gdpr=0
Request Chain 421
  • https://token.rubiconproject.com/token?pid=2249&pt=n&gdpr=0 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=M2U4MjI4NTY5ZjQ5NjFhYzI3MWJlZDM0N2MwNzQyYWY3OTMxZWM0Ng&gdpr=0
Request Chain 423
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&gdpr=0 HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/MDM0IpdrYKW45v8h_xL498n5EUdSAgOZEtemQ7w0kco?csrc=&gdpr=0 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-Odvt869E2oIsc.OSaSQp_63GFf5WjMoHUfzrtg--~A
Request Chain 424
  • https://token.rubiconproject.com/token?pid=25470&gdpr=0 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TEo0UEpaNDgtMjctMUpLSA==&gdpr=0 HTTP 302
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&gdpr=0&google_gid=CAESEMgdr64zSVw6c_wWi0r3Mm8&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo0UEpaNDgtMjctMUpLSA==&google_push=&gdpr=0
Request Chain 433
  • https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=970314640601641075
Request Chain 435
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8uu_fUx5TzG2e5IGJcmN7w%3D%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Request Chain 436
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=F2EBBF7D-4C79-4F31-B67B-920625C98DEF HTTP 302
  • https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3Dc696eff3-e87b-4a1e-ba21-beda78dea841%252C%252C HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=3958812064475458525&pt=c696eff3-e87b-4a1e-ba21-beda78dea841%2C%2C
Request Chain 438
  • https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent= HTTP 302
  • https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&vxii_pid=12&vxii_pid1=10067&vxii_rcid=9f771fae-b7c1-4809-974b-0f87094c864b
Request Chain 439
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEHV_B9BYoUzouEElUHMVC7Y&google_cver=1
Request Chain 440
  • https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:28F7D4B9C0A54A32B1BE3A0226AC86D4
Request Chain 441
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8818067066479886686&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 442
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=
Request Chain 446
  • https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&gdpr_consent=undefined&gdpr=0&khaos=LJ4PJZ48-27-1JKH HTTP 302
  • https://usersync.gumgum.com/usersync?b=mag&i=LJ4PJZ48-27-1JKH&gdpr=0&gdpr_consent=undefined
Request Chain 447
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=rise_engage&gdpr_consent=undefined&gdpr=0&khaos=LJ4PJZ48-27-1JKH HTTP 302
  • https://cs.yellowblue.io/cs?aid=11590&id=LJ4PJZ48-27-1JKH&gdpr=0&gdpr_consent=undefined
Request Chain 595
  • https://pixel.sojern.com/pixel/img/291730?p_v=1&f_v=v3_image&vid=hot HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=tQADXm_ozub1-yT97yixrQ&google_nid=sojern__adx_open_bidder_seat&sjrn_id=ZNScVm_8HzJKfQzLZEqQCojagGvKxO8iZGmAhGfwwPJ1B3mbN7w1PXkF57m1bpkS&sjrn_r=aHR0cHM6Ly9zZWN1cmUuYWRueHMuY29tL3B4P2lkPTE1Mjg5NjEmdD0x&sjrn_ula=6514084203 HTTP 302
  • https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=ZNScVm_8HzJKfQzLZEqQCojagGvKxO8iZGmAhGfwwPJ1B3mbN7w1PXkF57m1bpkS&sjrn_r=aHR0cHM6Ly9zZWN1cmUuYWRueHMuY29tL3B4P2lkPTE1Mjg5NjEmdD0x&sjrn_ula=6514084203&google_gid=CAESEKMIFEnDhnzgGyi2BRUnuRU&google_cver=1 HTTP 307
  • https://secure.adnxs.com/px?id=1528961&t=1
Request Chain 632
  • https://pixel.sojern.com/pixel/img/291730?p_v=1&f_v=v3_image&vid=hot HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=tQADXm_ozub1-yT97yixrQ&google_nid=sojern__adx_open_bidder_seat&sjrn_id=ZNScVm_8HzJKfQzLZEqQCojagGvKxO8iZGmAhGfwwPJ1B3mbN7w1PXkF57m1bpkS&sjrn_r=aHR0cHM6Ly9zZWN1cmUuYWRueHMuY29tL3B4P2lkPTE1Mjg5NjEmdD0x&sjrn_ula=6514084203 HTTP 302
  • https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=ZNScVm_8HzJKfQzLZEqQCojagGvKxO8iZGmAhGfwwPJ1B3mbN7w1PXkF57m1bpkS&sjrn_r=aHR0cHM6Ly9zZWN1cmUuYWRueHMuY29tL3B4P2lkPTE1Mjg5NjEmdD0x&sjrn_ula=6514084203&google_gid=CAESEKMIFEnDhnzgGyi2BRUnuRU&google_cver=1 HTTP 307
  • https://secure.adnxs.com/px?id=1528961&t=1
Request Chain 689
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
Request Chain 690
  • https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent= HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFFSmVFN0pKQW9BQUNEN3IzV1AxZw&gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Csyn%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
  • https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Csyn%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 303
  • https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AAEJeE7JJAoAACD7r3WP1g&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Csyn%252Cpm%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2&gdpr=0 HTTP 302
  • https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Csyn%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AAEJeE7JJAoAACD7r3WP1g&pid=558502&do=add&gdpr=0 HTTP 303
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEJeE7JJAoAACD7r3WP1g&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dsyn%252Cpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID&gdpr=0 HTTP 302
  • https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=syn%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=8231229510999469573&gdpr=0&gdpr_consent= HTTP 303
  • https://sync.technoratimedia.com/services?srv=cs&pid=73&uid=AAEJeE7JJAoAACD7r3WP1g&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26userid%3D8231229510999469573%26gdpr%3D0%26gdpr_consent%3D%26bee_sync_partners%3Dpm%26bee_sync_current_partner%3Dsyn%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D4&gdpr=0 HTTP 307
  • https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&userid=8231229510999469573&gdpr=0&gdpr_consent=&bee_sync_partners=pm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=4 HTTP 303
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAEJeE7JJAoAACD7r3WP1g&gdpr=0&gdpr_consent=
Request Chain 691
  • https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent= HTTP 303
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_d782ad8a5c874f3ebf8d6
Request Chain 692
  • https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3958812064475458525&gdpr=0&gdpr_consent=
Request Chain 698
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&redir=true&gdpr=0&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-hxcr9SVE2uW_0uYPpkxnktY4jkhSgis-~A&gdpr=0
Request Chain 700
  • https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent= HTTP 302
  • https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=6f33179dc0e205ef&is_secure=true&networkId=17100&version=1&nuid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAB5mRHm03IoAMPllOYAAAAAAA&expiration=1687377505&nuid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&is_secure=true&gdpr_consent=&gdpr=0
Request Chain 701
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=d73a5f9f-f848-4ab7-950f-b9fc12a99154&gdpr=0&gdpr_consent=
Request Chain 702
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://sonata-notifications.taptapnetworks.com/web/cookie/bidswitch/sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&gdpr_consent=&gdpr_pd= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=413&ssp=pubmatic&user_id=csonata_b302fbb7-fdbb-4009-9633-f71c8aea77c7&bsw_param=56daf56a-28b1-40e7-a167-b6cb39d3f949&expires=10&gdpr=0&gdpr_consent=&gdpr_pd= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&gdpr_consent=&gdpr_pd=
Request Chain 736
  • https://bh.contextweb.com/bh/rtset?pid=560288&ev=1&rurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D92%26partneruserid%3D%25%25VGUID%25%25&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=sk2jAnLigg03&ev=1&pid=560288&gdpr_consent=&gdpr=0
Request Chain 737
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=150&partneruserid=0&redirurl=https%3A%2F%2Fwt.rqtrk.eu%3Fpid%3D58a76248-f101-4e52-b8f7-c4de9362ea12%26src%3Dwww%26type%3D100%26sid%3D0%26uid%3DSMART_USER_ID%26gdpr_pd%3D0&gdpr=0&gdpr_consent= HTTP 302
  • https://wt.rqtrk.eu/?pid=58a76248-f101-4e52-b8f7-c4de9362ea12&src=www&type=100&sid=0&uid=8231229510999469573&gdpr_pd=0&gdpr=0&gdpr_consent=
Request Chain 738
  • https://cms.quantserve.com/pixel/p-EtBqU4Lj3YbAv.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=F5iYHxGYxRQMyMQeEZqMGkPIxR8MzsQVGJ07SUos
Request Chain 739
  • https://ad.turn.com/r/cs?pid=33&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D32%26partneruserid%3D%23USER_ID%23%26gdpr%3D%23GDPR_APPLICABLE%23%26gdpr_consent%3D%23GDPR_CONSENT%23&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=8818067066479886686&gdpr=0&gdpr_consent=
Request Chain 740
  • https://a.audrte.com/get?p=M501991648&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D141%26partneruserid%3D$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=ZzY4WHNaeGdELTdTZk9aNnNwRjd5a3lhQQ==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2lcdTAwM2QxXHUwMDI2cGFydG5lcmlkXHUwMDNkMTQxXHUwMDI2cGFydG5lcnVzZXJpZFx1MDAzZGc2OFhzWnhnRC03U2ZPWjZzcEY3eWt5YUEiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn0seyJuYW1lIjoic21hcnQifV19%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://a.audrte.com/ddp?red=eyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2lcdTAwM2QxXHUwMDI2cGFydG5lcmlkXHUwMDNkMTQxXHUwMDI2cGFydG5lcnVzZXJpZFx1MDAzZGc2OFhzWnhnRC03U2ZPWjZzcEY3eWt5YUEiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn0seyJuYW1lIjoic21hcnQifV19&gdpr=0&gdpr_consent= HTTP 302
  • https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2lcdTAwM2QxXHUwMDI2cGFydG5lcmlkXHUwMDNkMTQxXHUwMDI2cGFydG5lcnVzZXJpZFx1MDAzZGc2OFhzWnhnRC03U2ZPWjZzcEY3eWt5YUEiLCJkIjpbeyJuYW1lIjoic21hcnQifV19&gdpr=0&gdpr_consent= HTTP 302
  • https://a.audrte.com/a?adform_uid=5407894714181040436&r=eyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2lcdTAwM2QxXHUwMDI2cGFydG5lcmlkXHUwMDNkMTQxXHUwMDI2cGFydG5lcnVzZXJpZFx1MDAzZGc2OFhzWnhnRC03U2ZPWjZzcEY3eWt5YUEiLCJkIjpbeyJuYW1lIjoic21hcnQifV19 HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=141&partneruserid=g68XsZxgD-7SfOZ6spF7ykyaA&gdpr=0&gdpr_consent=&redirurl=https%3A%2F%2Fa.audrte.com%2Fmatch%3Fuid%3DSMART_USER_ID%26p%3DM501991648%26r%3Dhttps%253A%252F%252Fa.audrte.com%252Fp%253F HTTP 302
  • https://a.audrte.com/match?uid=8231229510999469573&p=M501991648&r=https%3A%2F%2Fa.audrte.com%2Fp%3F&gdpr=0&gdpr_consent= HTTP 302
  • https://a.audrte.com/p
Request Chain 758
  • https://b1sync.zemanta.com/usersync/smart/?cb=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D116%26partneruserid%3D__ZUID__&gdpr=0&gdpr_consent= HTTP 302
  • https://stags.bluekai.com/site/23178?id=enfOlcX9S9Dq6ua2mBcD&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIWWG43ZNZRS443NMFZHIYLEONSXE5TFOIXGG33NF5ZGKZDJOIXT6ZLYMNUGC3THMU6XG3LBOJ2CMZ3EOBZD2MBGNFZXG2J5GETHAYLSORXGK4TJMQ6TCMJWEZYGC4TUNZSXE5LTMVZGSZB5MVXGMT3MMNMDSUZZIRYTM5LBGJWUEY2E&gdpr=0 HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIWWG43ZNZRS443NMFZHIYLEONSXE5TFOIXGG33NF5ZGKZDJOIXT6ZLYMNUGC3THMU6XG3LBOJ2CMZ3EOBZD2MBGNFZXG2J5GETHAYLSORXGK4TJMQ6TCMJWEZYGC4TUNZSXE5LTMVZGSZB5MVXGMT3MMNMDSUZZIRYTM5LBGJWUEY2E HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=enfOlcX9S9Dq6ua2mBcD
Request Chain 759
  • https://sync-tm.everesttech.net/upi/pid/gjIEMT18?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D94%26partneruserid%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=ZJIE3AABR7XTlQAz&gdpr=0&gdpr_consent=
Request Chain 760
  • https://visitor.omnitagjs.com/visitor/bsync?uid=627080440e659fbe0f85333c665ae1de&name=SMARTADSERVER&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D117%26partneruserid%3DPARTNER_USER_ID%26gdpr%3DGDPR%26gdpr_consent%3DGDPR_CONSENT&gdpr=0&gdpr_consent= HTTP 307
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=757349f6dab79002613d93ce22427ff9&gdpr=0&gdpr_consent=0
Request Chain 761
  • https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&pubid=5679&gdpr=0&gdpr_consent= HTTP 307
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=f66eb2fc-b468-4574-8969-c71d03ddbfc2&gdpr_consent=null&gdpr=0
Request Chain 762
  • https://secure.adnxs.com/getuid?https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D86%26partneruserid%3D$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=3958812064475458525&gdpr=0&gdpr_consent=
Request Chain 767
  • https://ad.turn.com/r/cs?pid=33&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D32%26partneruserid%3D%23USER_ID%23%26gdpr%3D%23GDPR_APPLICABLE%23%26gdpr_consent%3D%23GDPR_CONSENT%23&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=8818067066479886686&gdpr=0&gdpr_consent=
Request Chain 768
  • https://c1.adform.net/serving/cookie/match?party=10&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D22%26partneruserid%3DYOUR_USER_ID&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=5407894714181040436&gdpr=0&gdpr_consent=
Request Chain 769
  • https://dsp.adfarm1.adition.com/cookie/?ssp=5&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7246860123398011025&gdpr=0&gdpr_consent=
Request Chain 770
  • https://match.sharethrough.com/universal/v1?supply_id=v5hJK9Sl&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44&gdpr=0
Request Chain 771
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=135&partneruserid=TAM_OK&redirurl=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fdcm%3Fpid%3Df7a5db36-1d5c-4c26-81b6-b4d0807faffb%26id%3DSMART_USER_ID&gdpr=0&gdpr_consent= HTTP 302
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=8231229510999469573&gdpr=0&gdpr_consent=
Request Chain 776
  • https://a.audrte.com/get?p=M501991648&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D141%26partneruserid%3D$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2lcdTAwM2QxXHUwMDI2cGFydG5lcmlkXHUwMDNkMTQxXHUwMDI2cGFydG5lcnVzZXJpZFx1MDAzZGc2OFhzWnhnRC03U2ZPWjZzcEY3eWt5YUEiLCJkIjpbeyJuYW1lIjoic21hcnQifV19&gdpr=0&gdpr_consent= HTTP 302
  • https://a.audrte.com/a?adform_uid=5407894714181040436&r=eyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2lcdTAwM2QxXHUwMDI2cGFydG5lcmlkXHUwMDNkMTQxXHUwMDI2cGFydG5lcnVzZXJpZFx1MDAzZGc2OFhzWnhnRC03U2ZPWjZzcEY3eWt5YUEiLCJkIjpbeyJuYW1lIjoic21hcnQifV19 HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=141&partneruserid=g68XsZxgD-7SfOZ6spF7ykyaA&gdpr=0&gdpr_consent=&redirurl=https%3A%2F%2Fa.audrte.com%2Fmatch%3Fuid%3DSMART_USER_ID%26p%3DM501991648%26r%3Dhttps%253A%252F%252Fa.audrte.com%252Fp%253F HTTP 302
  • https://a.audrte.com/match?uid=8231229510999469573&p=M501991648&r=https%3A%2F%2Fa.audrte.com%2Fp%3F&gdpr=0&gdpr_consent= HTTP 302
  • https://a.audrte.com/p
Request Chain 777
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?&rd=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D91%26partneruserid%3D%23PM_USER_ID%26gdpr%3DPM_GDPR%26gdpr_consent%3DPM_CONSENT&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=91&partneruserid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
Request Chain 778
  • https://cs.admanmedia.com/e09bad714a425a93d6dea503dcf9c528.gif?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D130%26partneruserid%3D%5BUID%5D%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BGDPR_CONSENT%5D&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=130&partneruserid=d90855e2-a762-4191-8327-12f7f682caea&gdpr=0&gdpr_consent=[GDPR_CONSENT]
Request Chain 779
  • https://s.ad.smaato.net/c/?adExInit=sas&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D133%26partneruserid%3D$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=133&partneruserid=d854fcfc
Request Chain 780
  • https://sync.1rx.io/usersync2/smartadserver?gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4236283162 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/120447a6-30d3-414b-b8f9-7a5eddeefdcd HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fpartnerid%3D113%26partneruserid%3DRX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005 HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Request Chain 785
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=135&partneruserid=TAM_OK&redirurl=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fdcm%3Fpid%3Df7a5db36-1d5c-4c26-81b6-b4d0807faffb%26id%3DSMART_USER_ID&gdpr=0&gdpr_consent= HTTP 302
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=8231229510999469573&gdpr=0&gdpr_consent=
Request Chain 786
  • https://a.audrte.com/get?p=M501991648&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D141%26partneruserid%3D$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2lcdTAwM2QxXHUwMDI2cGFydG5lcmlkXHUwMDNkMTQxXHUwMDI2cGFydG5lcnVzZXJpZFx1MDAzZGc2OFhzWnhnRC03U2ZPWjZzcEY3eWt5YUEiLCJkIjpbeyJuYW1lIjoic21hcnQifV19&gdpr=0&gdpr_consent= HTTP 302
  • https://a.audrte.com/a?adform_uid=5407894714181040436&r=eyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2lcdTAwM2QxXHUwMDI2cGFydG5lcmlkXHUwMDNkMTQxXHUwMDI2cGFydG5lcnVzZXJpZFx1MDAzZGc2OFhzWnhnRC03U2ZPWjZzcEY3eWt5YUEiLCJkIjpbeyJuYW1lIjoic21hcnQifV19 HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=141&partneruserid=g68XsZxgD-7SfOZ6spF7ykyaA&gdpr=0&gdpr_consent=&redirurl=https%3A%2F%2Fa.audrte.com%2Fmatch%3Fuid%3DSMART_USER_ID%26p%3DM501991648%26r%3Dhttps%253A%252F%252Fa.audrte.com%252Fp%253F HTTP 302
  • https://a.audrte.com/match?uid=8231229510999469573&p=M501991648&r=https%3A%2F%2Fa.audrte.com%2Fp%3F&gdpr=0&gdpr_consent= HTTP 302
  • https://a.audrte.com/p
Request Chain 787
  • https://cms.quantserve.com/pixel/p-EtBqU4Lj3YbAv.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=F5iYHxGYxRQMyMQeEZqMGkPIxR8MzsQVGJ07SUos
Request Chain 788
  • https://eu-u.openx.net/w/1.0/cm?id=a547219b-814b-4e3e-8a4f-35c044fa1891&ph=ec81d0b7-c42e-4a42-b97a-9305af647d30&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D100%26partneruserid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=5365c23c-c653-4b2f-916e-16ca119a86ed
Request Chain 802
  • https://sync-tm.everesttech.net/upi/pid/gjIEMT18?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D94%26partneruserid%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=ZJIE3AABR7XTlQAz&gdpr=0&gdpr_consent=
Request Chain 803
  • https://secure.adnxs.com/getuid?https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D86%26partneruserid%3D$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=3958812064475458525&gdpr=0&gdpr_consent=
Request Chain 804
  • https://dis.criteo.com/dis/usersync.aspx?r=30&p=273&cp=smartortb&cu=1&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D79%26partneruserid%3D%40%40CRITEO_USERID%40%40&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=33ce34a0-aa4b-4208-9ad8-c7db1317a38f&gdpr=0&gdpr_consent=
Request Chain 805
  • https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent= HTTP 303
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEJeE7JJAoAACD7r3WP1g&gdpr=0
Request Chain 806
  • https://sync.mathtag.com/sync/img?mt_exid=39&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D25%26partneruserid%3D%5BMM_UUID%5D&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=25&partneruserid=cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
Request Chain 811
  • https://eu-u.openx.net/w/1.0/cm?id=a547219b-814b-4e3e-8a4f-35c044fa1891&ph=ec81d0b7-c42e-4a42-b97a-9305af647d30&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D100%26partneruserid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=5365c23c-c653-4b2f-916e-16ca119a86ed
Request Chain 812
  • https://sync.adotmob.com/cookie/smart?r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D66%26partneruserid%3D%7Bamob_user_id%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=66&partneruserid=093922040744add39d31a086&gdpr=0&gdpr_consent=
Request Chain 813
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=139&partneruserid=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D98KUz37ype9D3X2sf9ovgeTt%26source_user_id%3DSMART_USER_ID&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=8231229510999469573&gdpr=0&gdpr_consent=
Request Chain 814
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=76&partneruserid=GOOGLE_HOSTED_SI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc%26google_hm%3DSMART_USER_ID_B64&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_sc&google_hm=ODIzMTIyOTUxMDk5OTQ2OTU3Mw==&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEGQ_6d8VPjWWfZOkdsHEBow&gdpr=0&gdpr_consent=&google_cver=1
Request Chain 854
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID HTTP 307
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Request Chain 855
  • https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=neYIRJvmVU-GtlRFm-QcQcm2VUSGsFROkuPGfL6_
Request Chain 856
  • https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=d2fde370-0fa4-11ee-b2e6-13cc15e39a1e
Request Chain 857
  • https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@ HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Request Chain 858
  • https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=ruPoSpZIUIJ7GLwbam2kAZU4mbs&gdpr=0&gdpr_consent=
Request Chain 859
  • https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:G7IN0PJx1QbHuI5&gdpr=0&gdpr_consent=
Request Chain 860
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=085b959a-8ada-4bf5-97c1-bd2b77bb3e82&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID} HTTP 302
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF
Request Chain 861
  • https://ums.acuityplatform.com/tum?umid=6 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=792503744794
Request Chain 862
  • https://ad.mrtnsvr.com/sync/pubmatic?gdpr=0&gdpr_consent= HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw%26piggybackCookie%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
Request Chain 863
  • https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP 302
  • https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Request Chain 864
  • https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F1508%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=115762805 HTTP 302
  • https://sync.1rx.io/usersync3/mediamathtest/1508/cb896492-04dd-4900-a8be-bcb5698eda5a?zcc=0&sspret=1 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Request Chain 865
  • https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token} HTTP 307
  • https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Request Chain 866
  • https://gocm.c.appier.net/pubmatic HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=tAdeHa1cC-S_ZuUT5ASSZA
Request Chain 868
  • https://mweb.ck.inmobi.com/sync/15?redirect=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA%3D%3D%26piggybackCookie%3D%24DSP_CKID HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=e7dec152-414a-4f0d-b405-72cafd61690d
Request Chain 871
  • https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID HTTP 302
  • https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ7405775081198469329&uid=Q7405775081198469329&ref=%2Fepm HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7405775081198469329
Request Chain 872
  • https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:28F7D4B9C0A54A32B1BE3A0226AC86D4&gdpr=0&gdpr_consent=
Request Chain 873
  • https://idsync.rlcdn.com/712188.gif?partner_uid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent= HTTP 307
  • https://pippio.com/api/sync?pid=5324&it=1&iv=309b2b86923efcb94b5b12e54be52a071167914db5a9c9f8422b3708a0390cda791426b5417dce21&_=2 HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlAzMDliMmI4NjkyM2VmY2I5NGI1YjEyZTU0YmU1MmEwNzExNjc5MTRkYjVhOWM5Zjg0MjJiMzcwOGEwMzkwY2RhNzkxNDI2YjU0MTdkY2UyMRAAGgwI5InIpAYSBAgCEABCAEoA HTTP 302
  • https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlAzMDliMmI4NjkyM2VmY2I5NGI1YjEyZTU0YmU1MmEwNzExNjc5MTRkYjVhOWM5Zjg0MjJiMzcwOGEwMzkwY2RhNzkxNDI2YjU0MTdkY2UyMRAAGgwI5InIpAYSBAgCEABCAEoA&google_gid=CAESEIBXdz0UIrMF_m2bqcrVR_w&google_cver=1 HTTP 307
  • https://tags.rd.linksynergy.com/rcs?ns=lr&uid3= HTTP 303
  • https://idsync.rlcdn.com/458249.gif?partner_uid=5be19df6-7853-4bd9-8606-e81139b4cea9
Request Chain 878
  • https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33645_104947644_BB9C7463&r=https://pmp.mxptint.net/sn.ashx?ak=1 HTTP 302
  • https://pmp.mxptint.net/sn.ashx?ak=1
Request Chain 879
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=
Request Chain 880
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=5407894714181040436
Request Chain 881
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3958812064475458525
Request Chain 882
  • https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:c6c815c7-1cf2-483a-9a6d-c792c2e0047e&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Request Chain 887
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1 HTTP 303
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.richaudience.com%2Fa939d25b950298d0a5d324cea4fcd3d1%2F%3Fuid%3D$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.richaudience.com/a939d25b950298d0a5d324cea4fcd3d1/?uid=3958812064475458525&gdpr=0&gdpr_consent=
Request Chain 888
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID HTTP 307
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Request Chain 889
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID HTTP 307
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Request Chain 890
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F2069.66%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=1662735446 HTTP 302
  • https://sync.1rx.io/usersync3/mediamathtest/2069.66/cb896492-04dd-4900-a8be-bcb5698eda5a?zcc=0&sspret=1 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Request Chain 891
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID HTTP 307
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Request Chain 892
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID HTTP 307
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Request Chain 896
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1 HTTP 303
  • https://id5-sync.com/s/286/9.gif?puid=da00dd86-3202-4e8e-b67f-1zz1687291106&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fsync.richaudience.com%2Fa6c163b098d05a413cd1682e26fae172%2F%3Fuid%3D%7BID5UID%7D HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=10089&mt_exuid=ID5-148auFSVvSxCtzl9jqLduUI9OFkslL7ZyIQ64epekQ&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F286%2F3%2F8%2F2.gif%3Fpuid%3D%5BUUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/286/3/8/2.gif?puid=cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent= HTTP 302
  • https://match.deepintent.com/usersync/147?redir=https%3A%2F%2Fid5-sync.com%2Fc%2F286%2F987%2F7%2F3.gif%3Fpuid%3D%24%7BDI_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 303
  • https://id5-sync.com/c/286/987/7/3.gif?puid=di_d782ad8a5c874f3ebf8d6&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.loopme.me/?redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F286%2F821%2F6%2F4.gif%3Fpuid%3D%7Bdevice_id%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 307
  • https://id5-sync.com/c/286/821/6/4.gif?puid=f66eb2fc-b468-4574-8969-c71d03ddbfc2&gdpr=0&gdpr_consent= HTTP 302
  • https://rtd-tm.everesttech.net/upi/pid/dm4ha19W?redir=https%3A%2F%2Fid5-sync.com%2Fc%2F286%2F136%2F5%2F5.gif%3Fpuid%3D%24%7BTM_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://id5-sync.com/c/286/136/5/5.gif?puid=ZJIE3AABR7XTlQAz&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=108&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F286%2F826%2F4%2F6.gif%3Fpuid%3D%7BuserId%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://id5-sync.com/c/286/826/4/6.gif?puid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent= HTTP 302
  • https://ice.360yield.com/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-148auFSVvSxCtzl9jqLduUI9OFkslL7ZyIQ64epekQ&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F286%2F916%2F3%2F7.gif%3Fpuid%3D%7BPUB_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/cq/286/916/3/7.gif?puid=cf5fb249-43c2-4293-b0ec-8acb4f767842&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/check_uuid/https%3A%2F%2Fid5-sync.com%2Fc%2F286%2F104%2F2%2F8.gif%3Fpuid%3D%24%7BBSW_UUID%7D%26gdpr%3D0%26gdpr_consent%3D?gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/286/104/2/8.gif?puid=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&gdpr_consent= HTTP 302
  • https://match.prod.bidr.io/cookie-sync/id5?us_privacy= HTTP 303
  • https://id5-sync.com/k/155.gif?id5AccountNum=155&numCascadesAllowed=9&puid=AAEJeE7JJAoAACD7r3WP1g
Request Chain 897
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}&crf=1 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Request Chain 898
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1 HTTP 303
  • https://match.sharethrough.com/universal/v1?supply_id=mmnOOyXZ&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.richaudience.com/6ccbc109824ae3014a36fd8993cc151d/?uid=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44&gdpr=0
Request Chain 899
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1 HTTP 303
  • https://match.sharethrough.com/universal/v1?supply_id=mmnOOyXZ&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.richaudience.com/6ccbc109824ae3014a36fd8993cc151d/?uid=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44&gdpr=0
Request Chain 900
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID HTTP 307
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Request Chain 901
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1 HTTP 303
  • https://x.bidswitch.net/sync?ssp=richaudience&gdpr=0&gdpr_consent=&user_id=da00dd86-3202-4e8e-b67f-1zz1687291106 HTTP 302
  • https://ads.betweendigital.com/match?bidder_id=43092&gdpr=0&consent=&callback_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D429%26user_id%3D%24%7BUSER_ID%7D%26ssp%3Drichaudience%26expires%3D30%26user_group%3D%24%7BUSER_GROUP%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=429&user_id=1769ab5a-0153-53ab-806e-d191e4fcd575&ssp=richaudience&expires=30&user_group=1&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.richaudience.com/697a8452aebbe5875da0878cfaf3d0d0/?uid=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&gdpr_consent=&us_ps=
Request Chain 902
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID HTTP 307
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Request Chain 903
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted HTTP 302
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005&rndcb=6875174845 HTTP 302
  • https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=adconductor&bsw_custom_parameter=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=&gdpr_consent= HTTP 302
  • https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=adconductor&bsw_custom_parameter=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=4&user_id=dd2e1a02-8c76-4490-b97b-ff2e506e3120&ssp=adconductor&expires=30&user_group=5&bsw_param=56daf56a-28b1-40e7-a167-b6cb39d3f949 HTTP 302
  • https://sync.1rx.io/usersync/bidswitch/56daf56a-28b1-40e7-a167-b6cb39d3f949?gdpr=&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Request Chain 904
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Request Chain 905
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted HTTP 302
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005&rndcb=3544734509 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=adconductor&bsw_param=56daf56a-28b1-40e7-a167-b6cb39d3f949&google_hm=NTZkYWY1NmEtMjhiMS00MGU3LWExNjctYjZjYjM5ZDNmOTQ5 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEERQGkhWpu77Bcer9iT4tFM&google_cver=1&ssp=adconductor&bsw_param=56daf56a-28b1-40e7-a167-b6cb39d3f949 HTTP 302
  • https://sync.1rx.io/usersync/bidswitch/56daf56a-28b1-40e7-a167-b6cb39d3f949?gdpr=&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Request Chain 906
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted HTTP 302
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005&rndcb=5490865808 HTTP 302
  • https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=56daf56a-28b1-40e7-a167-b6cb39d3f949&ssp=adconductor&gdpr=&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=419&user_id=10598588408662670101&ssp=adconductor&gdpr=&gdpr_consent= HTTP 302
  • https://sync.1rx.io/usersync/bidswitch/56daf56a-28b1-40e7-a167-b6cb39d3f949?gdpr=&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Request Chain 907
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1 HTTP 303
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.richaudience.com%2Fa939d25b950298d0a5d324cea4fcd3d1%2F%3Fuid%3D$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.richaudience.com/a939d25b950298d0a5d324cea4fcd3d1/?uid=3958812064475458525&gdpr=0&gdpr_consent=
Request Chain 908
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted HTTP 302
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005&rndcb=32955881 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=adconductor&bsw_param=56daf56a-28b1-40e7-a167-b6cb39d3f949&google_hm=NTZkYWY1NmEtMjhiMS00MGU3LWExNjctYjZjYjM5ZDNmOTQ5 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEERQGkhWpu77Bcer9iT4tFM&google_cver=1&ssp=adconductor&bsw_param=56daf56a-28b1-40e7-a167-b6cb39d3f949 HTTP 302
  • https://sync.1rx.io/usersync/bidswitch/56daf56a-28b1-40e7-a167-b6cb39d3f949?gdpr=&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Request Chain 911
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1 HTTP 303
  • https://sync.search.spotxchange.com/partner?source=202100&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.search.spotxchange.com/partner?source=202100&gdpr=0&gdpr_consent=&__user_check__=1&sync_id=d389411d-0fa4-11ee-a631-183b8be90103 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_sc&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&gdpr_consent=&uid=CAESED63p2kod-w5w6E5j6Hucf0&google_cver=1 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=spotx&ttd_tpi=1&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=7028&uid=120447a6-30d3-414b-b8f9-7a5eddeefdcd&img=1 HTTP 302
  • https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZJIE3AABR7XTlQAz&img=1&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://match.prod.bidr.io/cookie-sync/sx?gdpr=0&gdpr_consent=&us_privacy= HTTP 303
  • https://sync.search.spotxchange.com/partner?adv_id=8304&uid=AAEJeE7JJAoAACD7r3WP1g&gdpr=0 HTTP 302
  • https://sync.springserve.com/usersync?redirect_url=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D8876%26uid%3DSS_UUID HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=8876&uid=cda85162-9abf-4dc4-9522-07916bc9e508 HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=44&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=7308&uid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=30&redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6653%26uid%3D%5BMM_UUID%5D&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=6653&uid=cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
Request Chain 912
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}&crf=1 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Request Chain 913
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Request Chain 914
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}&crf=1 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Request Chain 915
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}&crf=1 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Request Chain 916
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted HTTP 302
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005&rndcb=3495598572 HTTP 302
  • https://ads.betweendigital.com/match?bidder_id=43092&gdpr=&consent=&callback_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D429%26user_id%3D%24%7BUSER_ID%7D%26ssp%3Dadconductor%26expires%3D30%26user_group%3D%24%7BUSER_GROUP%7D%26gdpr%3D%26gdpr_consent%3D HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=429&user_id=1769ab5a-0153-53ab-806e-d191e4fcd575&ssp=adconductor&expires=30&user_group=1&gdpr=&gdpr_consent= HTTP 302
  • https://sync.1rx.io/usersync/bidswitch/56daf56a-28b1-40e7-a167-b6cb39d3f949?gdpr=&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Request Chain 917
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}&crf=1 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Request Chain 918
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted HTTP 302
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005&rndcb=2722881669 HTTP 302
  • https://server.cpmstar.com/usersync.aspx?bsw_custom_parameter=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D440%26ssp%3Dadconductor%26user_id%3D%24UID HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=440&ssp=adconductor&user_id=TFQGjrBCa-apPq2BcI-p0 HTTP 302
  • https://sync.1rx.io/usersync/bidswitch/56daf56a-28b1-40e7-a167-b6cb39d3f949?gdpr=&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Request Chain 920
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Request Chain 921
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/3f80f6209b9252ca9426775c7eb8e89?gdpr_consent=&gdpr=0
Request Chain 922
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Request Chain 923
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Request Chain 924
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Request Chain 925
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Request Chain 926
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Request Chain 927
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Request Chain 928
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Request Chain 929
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Request Chain 930
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Request Chain 931
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Request Chain 932
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Request Chain 933
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Request Chain 934
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/3734a527a69bb6e9ffb5baa565b5b083?gdpr_consent=&gdpr=0
Request Chain 935
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Request Chain 936
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/aad958804afe4ca273405e5673d62eef?gdpr_consent=&gdpr=0
Request Chain 937
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/aad958804afe4ca273405e5673d62eef?gdpr_consent=&gdpr=0
Request Chain 938
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Request Chain 939
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/c38114cf2e856747dcd2252d549fb?gdpr_consent=&gdpr=0
Request Chain 940
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Request Chain 941
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Request Chain 942
  • https://creativecdn.com/cm-notify?pi=smilewanted HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Request Chain 943
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Request Chain 944
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Request Chain 945
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/99dadd3a4b121d59968c6b86fe6c61e1?gdpr_consent=&gdpr=0
Request Chain 946
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Request Chain 947
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/4a5ba88d7370bc1ec9f04c856efc52f6?gdpr_consent=&gdpr=0
Request Chain 948
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Request Chain 949
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Request Chain 950
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Request Chain 951
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Request Chain 952
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Request Chain 953
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Request Chain 957
  • https://creativecdn.com/cm-notify?pi=smilewanted HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Request Chain 958
  • https://creativecdn.com/cm-notify?pi=smilewanted HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Request Chain 959
  • https://creativecdn.com/cm-notify?pi=smilewanted HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Request Chain 960
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Request Chain 961
  • https://creativecdn.com/cm-notify?pi=smilewanted HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Request Chain 962
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Request Chain 963
  • https://creativecdn.com/cm-notify?pi=smilewanted HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Request Chain 964
  • https://creativecdn.com/cm-notify?pi=smilewanted HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Request Chain 969
  • https://io.narrative.io/?companyId=673&id=pubmatic_id:F2EBBF7D-4C79-4F31-B67B-920625C98DEF HTTP 302
  • https://io.narrative.io/?io.narrative.guid.v2=d3d63c70-0fa4-11ee-b039-16c962239a11&companyId=673&id=pubmatic_id:F2EBBF7D-4C79-4F31-B67B-920625C98DEF
Request Chain 970
  • https://a.audrte.com/match?gdpr=0&gdpr_consent=&p=M1717054901&uid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF HTTP 302
  • https://a.audrte.com/p
Request Chain 977
  • https://insight.adsrvr.org/track/evnt/?adv=64gxdrp&ct=0:6swk5ma&fmt=3 HTTP 302
  • https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=120447a6-30d3-414b-b8f9-7a5eddeefdcd HTTP 302
  • https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
Request Chain 978
  • https://insight.adsrvr.org/track/evnt/?adv=64gxdrp&ct=0:z2z62d3&fmt=3 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
  • https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=120447a6-30d3-414b-b8f9-7a5eddeefdcd HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=krux&ttd_tpi=1&ttd_puid=PoI-Qclx&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=120447a6-30d3-414b-b8f9-7a5eddeefdcd HTTP 302
  • https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
Request Chain 979
  • https://insight.adsrvr.org/track/pxl/?adv=64gxdrp&ct=0:1ingnzv&fmt=3 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
  • https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=120447a6-30d3-414b-b8f9-7a5eddeefdcd HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=krux&ttd_tpi=1&ttd_puid=PoI-Qclx&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=120447a6-30d3-414b-b8f9-7a5eddeefdcd HTTP 302
  • https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
Request Chain 988
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=mercurynews.com&sn=ChromeSyncframe&so=3&topUrl=www.mercurynews.com&bundle=1EqRMF9HdTRYOVB6QUF5NmxPZiUyRk1lRXRDcU94Z2Vsc1klMkJBa2pjZWhYdTdEb1lXaXNHaU1ncmpqTGZnQVZCcU9mVmxjRTFrVDVnaW5ENExPJTJGYXNpRmJZbk52MTJJbmJ3SkEwVmtmMU5CU21reDE4MmNDUyUyRlZJWWxhSWFSTndVN0ttS1g1RXpDbkg4eFJHUjJ0YlI2aUVxaW1KdyUzRCUzRA&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=JJRjK3xsazhSVWE1QjBkSHd6MlZzT0V1d0VMZFNweFc0R2lMMTFvN21Wdm9UVG9pSWVvYWN2cGtleGp3cU9MN1gxTVdsNHI2bXR4TTN0aGZYVzdPbDlsT3JsRUdYdXI1M2JxRkxrYmdtQVF5YUE3VStWWWVIbG5kZVBnMkY2NVEvUmRJZlorS2NZWGFabEphcGFKK1NoUklwMldRVytvMFA2OFVrOXRhb1QyZ0pSZEZIVXVKc2RMbTJtN0g4TWxpcStjTjN4UmNJdTRpQ00vOWx1V3MxMEVHUVJuN3VQOUJTeGkrb0dUeS82c3BVM1FtSjFkTFdCa1BnUENwUkFHbFVyRXZhSnkvM1pVNXpIc0hJb0k1TWJaRVdTb3FxNUMxbmFIY2FRdVR3cEtSRkJkdz18&cppv=2
Request Chain 989
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=mercurynews.com&sn=ChromeSyncframe&so=3&topUrl=www.mercurynews.com&bundle=1EqRMF9HdTRYOVB6QUF5NmxPZiUyRk1lRXRDcU94Z2Vsc1klMkJBa2pjZWhYdTdEb1lXaXNHaU1ncmpqTGZnQVZCcU9mVmxjRTFrVDVnaW5ENExPJTJGYXNpRmJZbk52MTJJbmJ3SkEwVmtmMU5CU21reDE4MmNDUyUyRlZJWWxhSWFSTndVN0ttS1g1RXpDbkg4eFJHUjJ0YlI2aUVxaW1KdyUzRCUzRA&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=_rh7W3xuWDBTRHFvWXR0R0NjZysxcUZIeDJtNDRMY1hLeUwvQy9LcHBIWklIdm81Vk1JTEhkbTFPUCtiRU5uRnJVbXZkVkwvTjN6Y3k4ZEFSai93MVFCNXU0Sk9kR3NsOGRnbnFMV1hqTmVSOGovc1Z5S1Y2OUtoSnZWNDNWSzdKMW9CVFY2dUdubUlHY3VadmQ5bFhOUDB3ejhKOS8xd05Idjh4UEpSNDZ6bmR2MUtRaHdkVEkvSXVIR1NoRHFQTHE2SDE0aUNsUE45WnF5RGcyTkR6cThkZXF5a2dGM2U2aFdFeHl1R280R2NXeS9PUVJpQTVvWVJCM0s4YjN1ZGVSN0NvZkVUenA2ZGt0Y2ZmN3ZJS3ZlK3k3eHNFVUVkN1J6OHRwSDdDZFcxZGtCRT18&cppv=2
Request Chain 995
  • https://sb.scorecardresearch.com/c2/6035443/cs.js HTTP 302
  • https://sb.scorecardresearch.com/internal-c2/default/cs.js
Request Chain 1030
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=gnbT_3wrTE5RdDNiWS9QVmxoVHBMMnIzQUkwaEtoRGxndzBWUmN6ZTA5SFJNWGZHQkdFZXZCYlNYY2VDMXF2WitOSnZnYmxMYWFXdG1iU1plaHJjVW1yM0trdHI2NnlrMHRzaDFNRzFrV2dCM1N0QTczT0RxYkhBUmtOUWJoOVd1QzlzckR1RDdCUjBudXNNTjJ0V3dmU090cmM2Z2U4dVdNQ1k1VHo1cnRrck5oSXNLd1ZTNjV4Y0Z1cFlGamdCd090VzdDbWRGcUNKOXVXakZiVks4N2kyeElycXU5R1cyQjZYTzlITExJRVZVUXFSME93Zm5Sc3RuTHAwV05mdG95Y3RVR0dTVjkyYm1GVWQ1RHlRZE0yVndOdjd3dXZVNWxGVVNxaU5helNidktRaz18&cppv=2
Request Chain 1031
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=SKORIHxQcG50eUZ1eUdzYktJcndjc0ZoWVR5NlUxQlJRU0Nod2hZTEFjcTNLTk14OWZ4MndmUFlKZXJUTU5tVCsyRVJmM2pWRVpLZHowazFJZWdrOUpUbDZsaVA0RGpITm1FRGlvQVZac28wVU16ZUw4MENJNEN6dzY1dEx6NHI1MlN2eFB1c1kxU3dhMUJrV0V0ZURpSXVEVEpRNmhGWksvVkFTR3FTWnBpSzlkQS9ZT2JkMlZSb2xuRmU2OExyRjdtSWcxWk5uWXNoRVBoa2FBVUtCOUI0UVhRMUNnRnNGN2FkdStVamhzNU9pdytRYS9sSEFHTG0xZHhTdTVBTHFaUndvZmtBbXFJdVlGMmhDUWRSN0dXSFNuOTRPV0NaSis1NlNld1pLWWpEbzdKRT18&cppv=2
Request Chain 1032
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=pY8OAnxwR2dvRGxsRjJ3TXhwZWMxdkNPN2NPbGFkbk13Q1VQN3F2OE5aWnlyUnp6dTRxWFRzMHBFOEFNWWc5eE1TNFlhUWhvaDB0R0RWNjhKZHo4OW1JeVoyMEZIQWV4MjZxUjU5Yk9CV09yNXVSY1Q0SDgrOHg5MkJvQVFmSDhsTGNqN3ljQkdtSlF2Y3RGby9XL2pEMkR1TE5paHpubU5uenZneGZQeWVhZGhBZkt0RGRoVkhYKytEeHFENTBOZkdmQ05PWFFPaUhhUmRSVnF4bU5ObXBvaTZpNHFqSGtaZ2NYQ0VURzBaSlNWZ0VVWlZHZjA1T1ZaOEJjZTZ3eWFzallGcmREYjA3bW1sNTNmUkNLckVGZEhnd3h5NWM3RVBKSmNlTHdXMUlhcks2Yz18&cppv=2
Request Chain 1033
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=E_9HbnxRWlRoMFk0ZTJGN3h4ZkhyR0J6dms1Q2VLYjdaeEdNZWxSQ3lJTVZ0OXZuSlZ4UzhOQllDQk5ObVFZRktxbm9BMkJEZjYxRVk3MFVkTWt5SUpaMElFNTZQbFk0QXY1WHJ3TlFOWmp4SUtra3Q5NlVPNUptdEtuRWlQWnhpSnk3ZE9wcmNDNzhPNU9ONngyNUllVmdHd2pnc0VUTVE5Z2tNdXlHblpFRTB0d0NhdnVqWnp5UzRlL2VaN2tJSWlLYjdBRWJCUm1TdlE2ck42VXkxdHFNRWN6Sk9WRS9hM0VmdGNEa1BmN2dhSytkbnk3UUZRSEV4NHora0lDS3dEc0NjVlowSTVheDZJRmF5QW5pNUV5TmV2TVVHS1lSYzFGMEVMODY1aSs2OHZxQT18&cppv=2
Request Chain 1034
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=bmu-8XxXQWtVQWdnaEJKbHdsVFNiRitSRURzR3o2blJlT08xR1pQeXBtbFpSeEVXMERTWjBqZUZxRk9zdmlUQ2ZsUU9VMDAzb2hUbVFHSnF2WE5iNVhYMEJ5YlA3bklSakU2bGl2cTYxMVdNMGE0WU5qTFhYeTdFWnkwK2tPQ1VHcEd3UHNCMERKWWVaUWFhb1BpdjBHcStZMCtnSU5heDFzSU9QOEZWVWFLaHR5NCs2WDF0a3NsWWFZT0hnNExlZjVCUjR3L0FOOVdoRW1jOFJGQ3lWWldZU29ieGpEazRmTDJzUVZHa0lhanFCTVNQcW9KVHlqazhPbTNHd2w2eStsVExxOWRZZ3g5dndZQWw1VTVvUmloWlJURlVicm5CQTNTSnkwTXpUbnMzOEFvWT18&cppv=2
Request Chain 1035
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=WHQkanw4d3UwVnUzWUs3bmI4eWJiMTU4eCsvS25vTU5NNk1NbVliK09qNDQwY1BpY1JSWkRSQU92aWl1UVM4bXB2ZUZ4YmdWTmtSb050YzdKVHA3VS9oc2dFUzdKK3RNbmFqZkgzZ2FCaG0vNzBRL2JOMldsRklmbDUrdm5KY2JTUEUzakZTcmlqcDlHL3g3WHdad3N2aTRMSGJrRHZTM2lFbng5ZDNicUZhbENoSDk2dEtOVE5SdFk4ZzFwaVlsS2w2aFdyc1pBYUxmWmpYeWp5K003NHVrS1lZQlZDQ09EQnQ3K1p0REJpSnBVaTkxSndlVTJrSkhDcFF0QmQwS1hwRmdjaURJRVE4WGYwTFRMdUZxVnlmU3hYdkdyaDNRRUFFVzZsMmRMZ2ZrTDVLdz18&cppv=2

1030 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Redirect Chain
  • http://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
  • https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
215 KB
50 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx / WordPress VIP <https://wpvip.com>
Resource Hash
a800be47e589df526eee6a11643f60c0fbdb2f8d76428a4cd727a95be85959c6
Security Headers
Name Value
Content-Security-Policy default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob: wss://realtimeeventfeeds.viafoura.co wss://sub.viafoura.co; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
1941
cache-control
max-age=300, must-revalidate
content-encoding
gzip
content-length
49835
content-security-policy
default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob: wss://realtimeeventfeeds.viafoura.co wss://sub.viafoura.co; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:14 GMT
host-header
a9130478a60e5f9135f765b23f26593b
link
<https://www.mercurynews.com/wp-json/>; rel="https://api.w.org/" <https://www.mercurynews.com/wp-json/wp/v2/posts/9968021>; rel="alternate"; type="application/json" <https://wp.me/p7ShJJ-FP8x>; rel=shortlink
server
nginx
strict-transport-security
max-age=31536000;includeSubdomains
vary
Accept-Encoding
x-cache
grace
x-hacker
If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.
x-powered-by
WordPress VIP <https://wpvip.com>
x-rq
yyz1 85 188 443

Redirect headers

Connection
keep-alive
Content-Length
162
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:14 GMT
Location
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Server
nginx
boldcoastal.css
www.mercurynews.com/wp-content/themes/assets/static/css/ 		416 KB
63 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/themes/assets/static/css/boldcoastal.css?ver=1686774969
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
c6038de77c2fca2f75327c1e7ec4751a8d45cc3737395a2abe403ac6d8e98144
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"648a24b4-6808c"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=31536000
wp-emoji-release.min.js
www.mercurynews.com/wp-includes/js/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-includes/js/wp-emoji-release.min.js?ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Mon, 22 May 2023 14:14:06 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"646b78ae-4904"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
htlbid.css
htlbid.com/v3/mercurynews.com/ 		3 KB
690 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://htlbid.com/v3/mercurynews.com/htlbid.css?ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.60.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-60-66.ewr52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2f218961fc995f27f5868268ca3f765d4e7066eb6144139ce5b9eefe9b9ad443

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
content-encoding
br
via
1.1 bdc824c8e03ec386d5eb83e9ff916440.cloudfront.net (CloudFront)
last-modified
Mon, 05 Jun 2023 22:43:44 GMT
server
AmazonS3
x-amz-cf-pop
EWR52-C1
x-amz-server-side-encryption
AES256
etag
W/"d0ed30e2f703616022754e56fc09aa63"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
text/css
cache-control
max-age=600
x-amz-cf-id
9umkD_b5CvpjfiPb-AtRiW8CfC2x2f2Lf8-0OyVuio4MVveq30GuqA==
style.css
www.mercurynews.com/wp-content/client-mu-plugins/src/Sitemap/includes/ 		880 B
392 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/client-mu-plugins/src/Sitemap/includes/style.css?m=1676299207g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
c540cdeba4eb897beea1c93c6452269a4de7b86a2e670b5b0ad37f9bbfc78c53
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Mon, 13 Feb 2023 14:40:07 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"63ea4bc7-370"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=31536000
/
www.mercurynews.com/_static/ 		31 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??-eJyNztEKwjAMBdAfsstE2PRB/JYt62ywTUuT4u+7tT4JA98uCSe58E4GI6tlheTLk1hg9jEGs8ZsUpk9ibNZIEVRQGmh28IJ/qVip4yu4hYP+bIGo7mIGuKFcNK4c52UsPLfXReID4+57dfLMtQmzX9HrRzu8hHu52Hsb8N47S8fV1JlGg==
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
0f27b15848fb3a09df5fa1ba8e2ae9a80ca73faca61455767cd28318fd3c2c6b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 13 Dec 2022 21:43:23 GMT
server
nginx
x-rq
yyz1 85 187 443
vary
Accept-Encoding
x-cache
HIT
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
mng-digisubs.styles.css
www.mercurynews.com/wp-content/plugins/mng-digisubs/static/ 		14 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/plugins/mng-digisubs/static/mng-digisubs.styles.css?ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
aff8084000d2c0e029860444700f6c44b5d0124101ae9f87a9bb7d6b574fe24e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"648a24b4-385c"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=31536000
/
www.mercurynews.com/_static/ 		848 B
433 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??/wp-content/plugins/site-plugins/site-bang/static/css/screen.min.css,/wp-content/client-mu-plugins/src/Ads/assets/css/mobile-adhesion-style.css?m=1676299207
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
af791f4ecfb200dd519a03dc1760721fd4fc36cd3ef9f0b5caf592f9a3d49b91
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Mon, 13 Feb 2023 14:40:07 GMT
server
nginx
x-rq
yyz1 85 187 443
vary
Accept-Encoding
x-cache
HIT
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
bootstrap-icons.min.css
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/ 		56 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.min.css?ver=5.2.0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
123830b3c1bb951b81bee61657d5ff2d7061c67316a4210df730462d093b0a23
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Tue, 20 Jun 2023 19:58:15 GMT
x-content-type-options
nosniff
content-encoding
br
age
6092384
x-jsd-version
1.5.0
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
8819
x-served-by
cache-fra-eddf8230021-FRA, cache-yul12822-YUL
x-jsd-version-type
version
etag
W/"e199-MKfLdwDci4zij+cy307LMP/uJk4"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
css
fonts.googleapis.com/ 		4 KB
953 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
270fb1f5320e32a7e0b8af9d3102063d8eb8950f4feb0ce3bb6c00536c1daa60
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 19:16:53 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 20 Jun 2023 19:58:15 GMT
/
www.mercurynews.com/_static/ 		109 KB
26 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??-eJyNkN0KwjAMhV/ING74sxvxUaS03ai2TVlSx97eDhwoKniXk+R8nASnDIaSuCSYQxl8YrR9BG0hkmVk0eINGq6lGZ1LKvqkqtzgD+fd657KqCGPJCRzdivkdapY5uD4gxQLrLCrk6zNDZpWtVjDlLqPk7eDE0ahDJlYloQV9Dfn4pNBJuN1gEAD8Zv4etwv1PKTZ2PxnOOpOXTHttvu9u0DeIF9tg==
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f42437392991256301d04a743ae9c380aae62faef9a5bb0d4dde967ae9681df9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 20 Jun 2023 17:00:52 GMT
server
nginx
x-rq
yyz1 85 187 443
vary
Accept-Encoding
x-cache
HIT
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
htlbid.js
htlbid.com/v3/mercurynews.com/ 		404 KB
110 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.60.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-60-66.ewr52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0e8e9fab28b24199f9d2b90a2b0996495b9d68cbe71550e5c4780bbf7028296f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
content-encoding
br
via
1.1 bdc824c8e03ec386d5eb83e9ff916440.cloudfront.net (CloudFront)
last-modified
Mon, 05 Jun 2023 22:43:44 GMT
server
AmazonS3
x-amz-cf-pop
EWR52-C1
x-amz-server-side-encryption
AES256
etag
W/"19fe31e40e621db88498bc266f8f8880"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript
cache-control
max-age=600
x-amz-cf-id
nil3nApQneOwuVIP31DNbs-2vTn7tGTQ04X_8xdFYVtmn60tpgyodw==
sso-tools.min.js
www.mercurynews.com/wp-content/client-mu-plugins/src/SSO/assets/js/ 		5 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/client-mu-plugins/src/SSO/assets/js/sso-tools.min.js?m=1670967803g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
feb0e7f17014201ea9124f23e3f63965411385abf0103fc682595d0674087a0c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 13 Dec 2022 21:43:23 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"6398f1fb-1536"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80f::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Thu, 15 Jun 2023 18:05:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
438760
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
31021
x-xss-protection
0
last-modified
Fri, 08 May 2020 07:05:03 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 14 Jun 2024 18:05:35 GMT
loader.min.js
www.mercurynews.com/wp-content/plugins/loader-wp/static/ 		16 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
80fcbd06bbf276b74b41aa77405ffd52243587afb254d1efa88027c33fbba932
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 19:18:43 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"648a1293-3e4a"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
global.js
www.mercurynews.com/wp-content/plugins/bloom-for-publishers/lib/js/ 		14 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/plugins/bloom-for-publishers/lib/js/global.js?m=1670967803g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
041f41b6b98e101febe7d24b8d7fdd9fd696dabad0fbe296c978272491c2a791
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 13 Dec 2022 21:43:23 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"6398f1fb-3985"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
js
maps.googleapis.com/maps/api/ 		188 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps/api/js?key=AIzaSyDJUi9DGZnqI8YbyBueZXiiJjKzw9kGDlE&ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80a::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
scaffolding on HTTPServer2 /
Resource Hash
1399a208de4c491883a4af4dccf806555c8120282126f3935a25b9b1e6bcfcac
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
scaffolding on HTTPServer2
vary
Accept-Language, Origin, X-Origin, Referer
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
63734
x-xss-protection
0
auth0-spa-js.production.js
cdn.auth0.com/js/auth0-spa-js/1.13/ 		105 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.auth0.com/js/auth0-spa-js/1.13/auth0-spa-js.production.js?ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2511:a00:10:474e:104a:2961 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
01d6389de5581a2a3eb0cd4d6a05cb136bf07d221306f89173a080c73a38e392

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
6AzkYKZDwDnSxmQe5SqIWFlWTPBMtbyI
content-encoding
gzip
via
1.1 05b3bdb53d1146d1176c185d2da0d530.cloudfront.net (CloudFront)
date
Tue, 20 Jun 2023 19:05:27 GMT
last-modified
Thu, 07 Jan 2021 14:32:49 GMT
server
AmazonS3
x-amz-cf-pop
JFK50-P6
age
3169
etag
W/"8bea9e0d733d097381a1b5eb8c40983d"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=10800,public
x-amz-replication-status
FAILED
x-amz-cf-id
6mtGGSImEsOWSoT1bSpTKI_bIZuqeKgbl8tnd_Cfxd5601HE6-eZRw==
client
accounts.google.com/gsi/ 		192 KB
75 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/client?ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81d::200d Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
44e66d26c636e0035f575e54c62db3e563f04b4530428c5794b597403f09e459
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-giIVSKn__WakvIflHWhPhQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-security-policy
script-src 'report-sample' 'nonce-giIVSKn__WakvIflHWhPhQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type
application/javascript; charset=utf-8
cache-control
private, max-age=1800
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires
Tue, 20 Jun 2023 19:58:15 GMT
/
www.mercurynews.com/_static/ 		289 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??-eJyl0MEKwjAMBuAXsg3C6PQgXn2NdgslpYnDpLjHtx4EdxLcKeTnz3cIPBc33cVQDJbaMokCS3YzZdKWFNSi0bTJPEcSn5rMFX3RA/xj9APB1fYyvUxWkfvUvVajW3wDjx+QkqHbLClK/pDlK/PcH1X0ypdjOIVxHM5hKC/Yl4tq
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f9e7478a7ceb5f02339cda0af1f0df3c8f3d108b1f9d5323b962017919ae555f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz1 85 188 443
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
pushly-sdk.min.js
cdn.p-n.io/ 		300 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.p-n.io/pushly-sdk.min.js?domain_key=kxKkF9MK5Eh8oIGD7DDm6lvkHUj6DuIrCOQh&ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.146.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-146-34.ewr52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b34b500b4fe4d4f0be72fcb5b7c582c472495b1498072d19a1aaac0dc2022195

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:49:47 GMT
content-encoding
gzip
via
1.1 70afbe31994f2c69bf2f10f0b46f4736.cloudfront.net (CloudFront)
last-modified
Sun, 18 Jun 2023 05:05:18 GMT
server
AmazonS3
x-amz-cf-pop
EWR52-C2
age
509
x-amz-server-side-encryption
AES256
etag
W/"eeaa47f53affa0eb6622b034cf68505a"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=900
x-amz-cf-id
GDmqsRaxWWkU86O5gLXC1iOVMQ0Pet0PtWHY1ZdF92lTgHQ-NMq7Kw==
dfm-pushly.min.js
www.mercurynews.com/wp-content/plugins/dfm-pushly/static/js/ 		160 B
205 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/plugins/dfm-pushly/static/js/dfm-pushly.min.js?m=1686770323g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d9f2778c47db32b56109a39c8c3393b7e213095aa043df32153367708a50dcd0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
yyz1 85 187 443
last-modified
Wed, 14 Jun 2023 19:18:43 GMT
server
nginx
etag
"648a1293-a0"
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
accept-ranges
bytes
content-length
160
script.js
a869.mercurynews.com/ 		148 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/script.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
4a7cc3810e9012a315f69d1dc6a4089e5b1e8db39f1707d3dd4d22c67462bb51
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:56:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 82139f26335f87e45d45c08d5208817a.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
age
134
x-cache
Hit from cloudfront
p3p
policyref="", CP="DSP"
content-length
44451
x-xss-protection
1; mode=block
last-modified
Tue, 20 Jun 2023 19:54:59 GMT
server
-
etag
01c56a5810516920801a6040449259ac
content-type
text/javascript; charset=utf-8
cache-control
public, no-cache="Set-Cookie", max-age=600
x-robots-tag
noindex, nofollow
x-amz-cf-id
lQ6dmtKJej3c0OsW3Cohs5aQOO5lkSh5OtnvbA_MOomenqLnoceejQ==
expires
Tue, 20 Jun 2023 20:06:01 GMT
osano.js
cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/ 		351 KB
79 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2510:f400:3:b7e:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
CloudFront /
Resource Hash
ee004e19a65d9657ccfd05c3c15ed2a49fafecb011b8dc60c799da2fc606fdcf
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
br
via
1.1 5ba825173b1f7429171e730e7ae12588.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-amz-cf-pop
JFK50-P5
age
856
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
79886
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 08 Jun 2023 02:50:01 GMT
server
CloudFront
etag
"0b9c83f25e35cd08524597a129a269f9"
x-frame-options
SAMEORIGIN
vary
Origin
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=86400, s-maxage=86400, must-revalidate, proxy-revalidate, no-transform
x-amz-cf-id
D2GTx_0fLkJMio4Lc3mITRTWyLXyEjtw-RqGH5NWxs71E7BEzFtagw==
mg2nw.min.js
prodmg2.blob.core.windows.net/newsletterwidget/mngcep/ 		143 KB
144 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://prodmg2.blob.core.windows.net/newsletterwidget/mngcep/mg2nw.min.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.60.62.4 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
eabc0f4a5b76ceb76d11713e56e77dc230f3672c9df4c43a79089fa69b056033

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Tue, 20 Jun 2023 19:58:14 GMT
Last-Modified
Tue, 30 Aug 2022 11:57:42 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
qpxGb9QXImzRxhdRLqrrAA==
ETag
0x8DA8A7ED8105951
Content-Type
application/javascript
Access-Control-Allow-Origin
*
x-ms-request-id
fd8b3800-501e-0013-29b1-a3d3b2000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
Content-Length
146402
/
www.mercurynews.com/_static/ 		53 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??/wp-content/plugins/dfm-ad-mods/static/js/hhsl-check.min.js,/wp-content/plugins/mng-digisubs/static/mng-digisubs.articleShare.bundle.js?m=1686774964j
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
0152a088a37330522c1458229707cbc27e42f802e1ba385d887b8a0069927618
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz1 85 188 443
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
mn-logo.svg
www.mercurynews.com/wp-content/uploads/2020/09/ 		12 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mercurynews.com/wp-content/uploads/2020/09/mn-logo.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
69008835f2aaaefd424c308c3e726d6ad4897186ce73fdce8b612c225e86dd39
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 23 Sep 2020 17:38:16 GMT
server
nginx
x-rq
yyz1 80 130 443
etag
W/"497950346404e2d1"
vary
Accept-Encoding
x-cache
HIT
content-type
image/svg+xml
cache-control
max-age=31536000
index.js
tags.remixd.com/player/v5/ 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.214.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-214-18.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
91bcc65a1a6bb4755e48576889ae27c2f620e49d126b8127dd16c1a99945b9d5

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:12 GMT
content-encoding
gzip
via
1.1 a123807296d8a3060657bb737260f994.cloudfront.net (CloudFront)
last-modified
Tue, 21 Jun 2022 15:31:59 GMT
server
AmazonS3
x-amz-cf-pop
EWR50-C1
age
4
etag
"57b6f8ad4125903b7e06bb427c232d10"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
cache-control
public,max-age=1800
accept-ranges
bytes
content-length
10041
x-amz-cf-id
nRp5laqoEznmOTQ-C72YcTU524KQvvEKaZgDcoDMakPccqmFaaUMbw==
Trust-Logo-Horizontal.svg
www.mercurynews.com/wp-content/plugins/dfm-trust-indicators/static/images/ 		7 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mercurynews.com/wp-content/plugins/dfm-trust-indicators/static/images/Trust-Logo-Horizontal.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d3110f199d22d9d122a62c288cca3b3c80edccdb2979c02bcbfa0602a7b88039
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 13 Dec 2022 21:43:23 GMT
server
nginx
x-rq
yyz1 85 187 443
etag
W/"6398f1fb-1ab8"
vary
Accept-Encoding
x-cache
HIT
content-type
image/svg+xml
cache-control
max-age=31536000
banglogo_small.png
www.mercurynews.com/wp-content/themes/wp-mason/static/images/site-logo/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mercurynews.com/wp-content/themes/wp-mason/static/images/site-logo/banglogo_small.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
75e752bf99299219069a5af90f61408be1ab85af71df9aea097bc70e9075c122
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
yyz1 85 187 443
last-modified
Tue, 13 Dec 2022 21:43:24 GMT
server
nginx
etag
"6398f1fc-3b7b"
x-cache
HIT
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
content-length
15227
/
www.mercurynews.com/_static/ 		105 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??-eJyVkd1SAyEMhV9INlr/9sbxWdglXVgDYRLQ2T69YO2FY+3YK5jkfMk5AB/ZzJwKpgKZ6hKSQkyL8YXAqmJRcEHLqWYiOx1iSMOqN3CGnYg5mj2LyXWioB5FIXObsB7Pq0BFK7Pv6PH2F5w9F077QATvmBwL5DCXKthLl+z+BskeNg0H/JEypJmqQ+1Ovp7jW9xamWnrfNOglP9Aggs2rS0tq9RUQsQrd12Ue+a3s18UqznF7rOsKNJm7ocRphrIAbF1KI16jS93T+Pzbrx9eNytn7f9zJs=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
a41b806e591339f4357460a85a5c04b8f473f1c80ef3a1c3e3e14cf76f4471d4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 20 Jun 2023 17:00:52 GMT
server
nginx
x-rq
yyz1 85 188 443
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
p.js
cdn.parsely.com/keys/mercurynews.com/ 		56 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.parsely.com/keys/mercurynews.com/p.js?ver=3.8.4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.101.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-101-60.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
cdd102d71e33401eb5ebadb19f1732edafa44df8800da6d33f29329c3ed9baef

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Tue, 20 Jun 2023 13:52:05 GMT
content-encoding
gzip
via
1.1 07f7cebee7fc49278f602ad96f5f6790.cloudfront.net (CloudFront)
last-modified
Thu, 09 Dec 2021 15:22:33 GMT
server
nginx
x-amz-cf-pop
JFK50-P5
age
21976
etag
W/"61b21f39-df44"
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=86400, public
x-amz-cf-id
CV3smL_1PHcokrzeNQZwcFmlYAOMaQEI7TRdNzoQtbDq21VZjj_SQw==
expires
Wed, 21 Jun 2023 13:51:59 GMT
ads.js
www.mercurynews.com/wp-content/themes/wp-mason/static/js/ 		87 B
155 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/themes/wp-mason/static/js/ads.js?ver=1.0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
b36d838681171ab6906d3206d2fd6cc17a7a7a5867213c7595fe0865aeb9e969
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
yyz1 85 187 443
last-modified
Tue, 13 Dec 2022 21:43:24 GMT
server
nginx
etag
"6398f1fc-57"
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
accept-ranges
bytes
content-length
87
/
www.mercurynews.com/_static/ 		112 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??-eJydzkEKwjAQQNELmQ5KSXUhniUmaZuamQnOVPH2BnShIGLdfnjw4VqMZ9JICjpGjAJOJKqAqNPkYRLwjMjU+HGmU4OJmklW8IMrnG99ylmWoCPn4NnVkL+wWtAJ0wvMPLBJOBinev5ES56HRAKhR+OCQQ7yxmt73CzHsqFLCpH/kIW1Xj/hAfdru7Vd1+5sO90BHsOYcw==
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ba5a6577ef04a324ae8a4af890e1e26d341ac85bc5c49ad9be1678a61fcc3168
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz1 85 187 443
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
index.js
cdn.viafoura.net/entry/ 		34 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.viafoura.net/entry/index.js?ver=2.0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:4800:8:2ae1:d740:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
47837a16e7b231cca39151ae124c3cb8ad0fb875a78fb39ef15725f9bd7a8870

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
7clcVwJ2uZ2xninCT38x2KDy2PpKpuXM
content-encoding
gzip
via
1.1 c5c79ef7442267e414f3389ffcc2f0fa.cloudfront.net (CloudFront)
date
Tue, 20 Jun 2023 19:54:09 GMT
x-amz-cf-pop
EWR53-C2
age
249
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 14 Jun 2023 17:25:59 GMT
server
AmazonS3
etag
W/"738c5427d8f7c25ccede619b95ab7ac5"
vary
Accept-Encoding
content-type
text/javascript
cache-control
public,max-age=600,s-max-age=60
x-amz-cf-id
stn4iP8YM54z3b1m_SAlIx3MWyIwYKnCk_X6hjXCaBU1SD4TadTMsg==
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		79 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js?ver=2.0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
82759af516a4637540c242c907743840fd5ef5409ae76b8a456d317cb7802e07
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
26769
x-xss-protection
0
server
cafe
etag
0 / 19528 / m202306140101 / config-hash: 15645185001691524896
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:58:15 GMT
dfm-viafoura.main.bundle.js
www.mercurynews.com/wp-content/plugins/dfm-viafoura-prototype/static/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/plugins/dfm-viafoura-prototype/static/dfm-viafoura.main.bundle.js?m=1678993769g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
820bbf383e1e212ca7bd59f29af6ab490ea9da86e84d61ed3322b9c77ac2fc6c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Thu, 16 Mar 2023 19:09:29 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"64136969-603c"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
e-202325.js
stats.wp.com/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.wp.com/e-202325.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ab8517f3d5171dd42a8b9c22af6a2f944b41d00e7ea54ba02b4ed71a6c59e543

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT yyz
date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
br
last-modified
Fri, 19 May 2023 02:58:21 GMT
server
nginx
etag
W/"6466e5cd-3508"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
expires
Wed, 12 Jun 2024 13:30:21 GMT
sharing.min.js
www.mercurynews.com/wp-content/mu-plugins/jetpack-12.2/_inc/build/sharedaddy/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/mu-plugins/jetpack-12.2/_inc/build/sharedaddy/sharing.min.js?m=1687280452g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
9e1dae23d3ad3212f67d09ca79a50003c32953c36bab976f634c9b38d8a8c6dc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 20 Jun 2023 17:00:52 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"6491db44-2259"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
css
fonts.googleapis.com/ 		9 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,600,700&display=swap
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyNztEKwjAMBdAfsstE2PRB/JYt62ywTUuT4u+7tT4JA98uCSe58E4GI6tlheTLk1hg9jEGs8ZsUpk9ibNZIEVRQGmh28IJ/qVip4yu4hYP+bIGo7mIGuKFcNK4c52UsPLfXReID4+57dfLMtQmzX9HrRzu8hHu52Hsb8N47S8fV1JlGg==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
a63284d0b07236a49f89dd197f9aa2ea595e314e750b5d42834fbda2f7cba411
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:42:55 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 20 Jun 2023 19:58:15 GMT
ai.0.js
az416426.vo.msecnd.net/scripts/a/ 		94 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:17a5:191a:18d5:537:22f9 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/79DC) /
Resource Hash
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
x-ms-meta-lastmodified
2020-10-01 19:31:04
content-md5
HdY95yzx9wIyQkVEGES+Ew==
age
130
x-cache
HIT
content-length
22495
x-ms-lease-status
unlocked
last-modified
Thu, 11 Mar 2021 07:46:59 GMT
server
ECAcc (nya/79DC)
etag
0x8D8E461DA1A5889
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
1ded4b5b-801e-002a-3fb1-a307ad000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=1800
x-ms-version
2009-09-19
expires
Tue, 20 Jun 2023 20:28:15 GMT
polyfill.min.js
polyfill.io/v3/ 		101 B
673 B 		Script
General
Check archive.org
Download Go to
Full URL
https://polyfill.io/v3/polyfill.min.js?flags=gated&features=es5%2CCustomEvent%2CArray.from%2CArray.isArray%2CArray.prototype.filter%2CArray.prototype.find%2CArray.prototype.findIndex%2CArray.prototype.forEach%2CArray.prototype.indexOf%2CArray.prototype.keys%2CArray.prototype.lastIndexOf%2CArray.prototype.map%2CArray.prototype.reduce%2CDate.prototype.toISOString%2CDocumentFragment%2CDocumentFragment.prototype.append%2CDocumentFragment.prototype.prepend%2CElement%2CElement.prototype.after%2CElement.prototype.append%2CElement.prototype.before%2CElement.prototype.classList%2CElement.prototype.cloneNode%2CElement.prototype.closest%2CElement.prototype.dataset%2CElement.prototype.matches%2CElement.prototype.placeholder%2CElement.prototype.prepend%2CElement.prototype.remove%2CElement.prototype.replaceWith%2CElement.prototype.toggleAttribute%2CEvent%2CJSON%2CMap%2CNumber.parseInt%2CNumber.parseFloat%2CObject.assign%2CObject.create%2CObject.defineProperties%2CObject.defineProperty%2CObject.entries%2CObject.getOwnPropertyDescriptor%2CObject.getOwnPropertyNames%2CObject.is%2CObject.keys%2CObject.values%2CPromise%2CPromise.prototype.finally%2CSet%2CString.prototype.trim%2CXMLHttpRequest%2Cdocument.getElementsByClassName%2Cdocument.currentScript%2Cdocument.querySelector%2Cfetch%2CgetComputedStyle%2ClocalStorage%2CArray.prototype.some%2CDate.now%2CEvent.focusin%2CEventSource%2CFunction.prototype.bind%2CFunction.prototype.name%2CHTMLDocument%2CNodeList.prototype.forEach%2CNodeList.prototype.%40%40iterator%2CNode.prototype.contains%2CObject.getPrototypeOf%2CObject.setPrototypeOf%2CRegExp.prototype.flags%2CString.prototype.%40%40iterator%2CString.prototype.startsWith%2Cconsole%2Cconsole.debug%2Cconsole.error%2Cconsole.info%2Cconsole.log%2Cdocument%2Cdocument.head%2Cdocument.visibilityState%2Clocation.origin%2CrequestIdleCallback%2Cscreen.orientation%2CmatchMedia%2CURL
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::282 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d7f817255acac24d24766a420471f23c0796b5228b84f8432bf70570ed870b72
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 20 Jun 2023 19:58:15 GMT
age
41789
detected-user-agent
Chrome Mobile/114.0.0
useragent_normaliser
chrome/114.0.0
server-timing
HIT, fastly;desc="Edge time";dur=1
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
113
referrer-policy
origin-when-cross-origin
last-modified
Wed, 03 May 2023 00:17:37 GMT
fastly_service_version
195
vary
User-Agent, Accept-Encoding
access-control-allow-methods
GET,HEAD,OPTIONS
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
normalized-user-agent
chrome/114.0.0
cache-control
public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges
bytes
timing-allow-origin
*
gen_204
maps.googleapis.com/maps/api/mapsjs/ 		3 B
45 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDJUi9DGZnqI8YbyBueZXiiJjKzw9kGDlE&ver=6.2.2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80a::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
scaffolding on HTTPServer2 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
scaffolding on HTTPServer2
vary
Origin, X-Origin, Referer
x-frame-options
SAMEORIGIN
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23
x-xss-protection
0
session
session.mercurynews.com/api/ 		93 B
256 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://session.mercurynews.com/api/session
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyl0MEKwjAMBuAXsg3C6PQgXn2NdgslpYnDpLjHtx4EdxLcKeTnz3cIPBc33cVQDJbaMokCS3YzZdKWFNSi0bTJPEcSn5rMFX3RA/xj9APB1fYyvUxWkfvUvVajW3wDjx+QkqHbLClK/pDlK/PcH1X0ypdjOIVxHM5hKC/Yl4tq
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.218.39.135 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-218-39-135.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
04819970a784f5b35e5618e45433e7813caeabefca573681b08b4efe83a1c2f1

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:58:15 GMT
access-control-allow-credentials
true
content-length
93
vary
Origin
content-type
application/json; charset=utf-8
cs
digitalfirstmedia.blueconic.net/DG/DEFAULT/ 		16 B
700 B 		Script
General
Check archive.org
Download Go to
Full URL
https://digitalfirstmedia.blueconic.net/DG/DEFAULT/cs?&callback=bc_json355
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.200.130.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-200-130-143.compute-1.amazonaws.com
Software
- /
Resource Hash
cbaa97c65cc434cc1e1af32d1d79ffa851b696d709b4a523d304cbcf07c74810
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-permitted-cross-domain-policies
master-only
content-type
text/javascript; charset=utf-8
p3p
policyref="", CP="DSP"
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
content-length
36
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
cs
digitalfirstmedia.blueconic.net/DG/DEFAULT/ 		16 B
704 B 		Script
General
Check archive.org
Download Go to
Full URL
https://digitalfirstmedia.blueconic.net/DG/DEFAULT/cs?&callback=bc_json356
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.200.130.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-200-130-143.compute-1.amazonaws.com
Software
- /
Resource Hash
fd705313149bd84c7cb7b012cae41688c028a08c8c120560b9a888ff35c68cd1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-permitted-cross-domain-policies
master-only
content-type
text/javascript; charset=utf-8
p3p
policyref="", CP="DSP"
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
content-length
36
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
web-vitals.iife.js
unpkg.com/web-vitals@3.3.2/dist/
Redirect Chain
  • https://unpkg.com/web-vitals@3/dist/web-vitals.iife.js
  • https://unpkg.com/web-vitals@3.3.2/dist/web-vitals.iife.js
7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/web-vitals@3.3.2/dist/web-vitals.iife.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
2606:4700::6810:7aaf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
27e29a5aebbbc2d82b6f7d9dbbf03ced7ecaf592adf68338a02aff332b3e7bd5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
689534
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id
01H2RMJY0R3RHJ9DJ5TSRCZ0FZ-yul
server
cloudflare
etag
W/"1b99-+0VwSXVmoLd0uGhBB2XoSfehK74"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7da695e65b5a3400-YUL

Redirect headers

date
Tue, 20 Jun 2023 19:58:15 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
fly-request-id
01H3D62G7PFC13AFD9059RDE36-yul
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
109
vary
Accept, Accept-Encoding
content-type
text/plain; charset=utf-8
access-control-allow-origin
*
location
/web-vitals@3.3.2/dist/web-vitals.iife.js
cache-control
public, s-maxage=600, max-age=60
cf-ray
7da695e44fb83400-YUL
loader.js
cdn.taboola.com/libtrc/medianewsgroup-network/ 		505 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/medianewsgroup-network/loader.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6020e58617f93875554a133f107b287c97dd12c8d8b6c0eb3f46f2d04a722be4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
GfG4Ne0IZxvonN2uPJ49lY63yw5v1noD
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:58:15 GMT
x-amz-request-id
YW1STKWSKF041F9Y
age
81
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
FAILED
content-length
53269
x-amz-id-2
FG16ZoAzws9T1H1CjTtlHu1tsK9e6mRRya13RxVkrTil7nP+Wiac8ZnLQOO6pUUZmIeRZmbN830=
x-served-by
cache-yul12823-YUL
last-modified
Tue, 20 Jun 2023 09:48:47 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687291096.758281,VS0,VE0
etag
"ab1d787c5482a21bc61f4a1ca8a5e5ec"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
53
access-control-allow-origin
*
cache-control
private,max-age=14401
accept-ranges
bytes
x-cache-hits
466
gtm.js
www.googletagmanager.com/ 		499 KB
117 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:820::2008 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d5e889f775032de008372506f023edce28f84ca96ee75bed29e61f53ffea661d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:15 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
119376
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 20 Jun 2023 19:58:15 GMT
7233b1c2-ab94-431a-a072-7567d5dd59dd
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/7233b1c2-ab94-431a-a072-7567d5dd59dd
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
truncated
/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
182abb62bdb40059dbda691bf6631cf6b471499a85971a5fd04832453d7b4141

Request headers

Referer
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
font/truetype
SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2
fonts.gstatic.com/s/droidsans/v18/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/droidsans/v18/SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e803cd8c5031ac6b0d099a2d96ba1c3ee44782649a7f7c6f0d09b6410d93e216
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 18 Jun 2023 02:20:04 GMT
x-content-type-options
nosniff
age
236291
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
22376
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 18:25:01 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 17 Jun 2024 02:20:04 GMT
bootstrap-icons.woff2
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/ 		88 KB
89 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/bootstrap-icons.woff2?856008caa5eb66df68595e734e59580d
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.min.css?ver=5.2.0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a04:4e42::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
76506e128f2b47b7179f5037bd885a1674455ffeb6b5093cdb4c7eefbf436ce8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.min.css?ver=5.2.0
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Tue, 20 Jun 2023 19:58:15 GMT
x-content-type-options
nosniff
age
8405906
x-jsd-version
1.5.0
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
90528
x-served-by
cache-fra-eddf8230031-FRA, cache-yul12827-YUL
x-jsd-version-type
version
etag
W/"161a0-RkmHeGigBozlCxBdDSojXoAQyY8"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2
fonts.gstatic.com/s/droidsans/v18/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/droidsans/v18/SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7a291479495fbb281655d5e870c6d118dc6b7ed18e8c235aef5974c1e9de4e6c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 17 Jun 2023 10:39:34 GMT
x-content-type-options
nosniff
age
292721
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
21224
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 18:04:18 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 16 Jun 2024 10:39:34 GMT
tDbV2oqRg1oM3QBjjcaDkOJGiRD7OwE.woff2
fonts.gstatic.com/s/droidserif/v19/ 		25 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/droidserif/v19/tDbV2oqRg1oM3QBjjcaDkOJGiRD7OwE.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4fa898d9bdc34304905c4b165e561c8dc3fe452b0bdd7259140e1aa530a42136
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 17 Jun 2023 14:00:34 GMT
x-content-type-options
nosniff
age
280661
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
25980
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 18:47:46 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 16 Jun 2024 14:00:34 GMT
tDbI2oqRg1oM3QBjjcaDkOr9rAU.woff2
fonts.gstatic.com/s/droidserif/v19/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/droidserif/v19/tDbI2oqRg1oM3QBjjcaDkOr9rAU.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
aee4051a20e975b9bb6fdc20984a091eb1f55c35ea87abe441db4cdbe8c116d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 02:03:58 GMT
x-content-type-options
nosniff
age
582857
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
22476
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 19:19:08 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 13 Jun 2024 02:03:58 GMT
session
session.mercurynews.com/api/ 		93 B
255 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://session.mercurynews.com/api/session
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyl0MEKwjAMBuAXsg3C6PQgXn2NdgslpYnDpLjHtx4EdxLcKeTnz3cIPBc33cVQDJbaMokCS3YzZdKWFNSi0bTJPEcSn5rMFX3RA/xj9APB1fYyvUxWkfvUvVajW3wDjx+QkqHbLClK/pDlK/PcH1X0ypdjOIVxHM5hKC/Yl4tq
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.218.39.135 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-218-39-135.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
04819970a784f5b35e5618e45433e7813caeabefca573681b08b4efe83a1c2f1

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:58:15 GMT
access-control-allow-credentials
true
content-length
93
vary
Origin
content-type
application/json; charset=utf-8
session
session.mercurynews.com/api/ 		93 B
255 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://session.mercurynews.com/api/session
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyl0MEKwjAMBuAXsg3C6PQgXn2NdgslpYnDpLjHtx4EdxLcKeTnz3cIPBc33cVQDJbaMokCS3YzZdKWFNSi0bTJPEcSn5rMFX3RA/xj9APB1fYyvUxWkfvUvVajW3wDjx+QkqHbLClK/pDlK/PcH1X0ypdjOIVxHM5hKC/Yl4tq
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.218.39.135 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-218-39-135.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
04819970a784f5b35e5618e45433e7813caeabefca573681b08b4efe83a1c2f1

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:58:16 GMT
access-control-allow-credentials
true
content-length
93
vary
Origin
content-type
application/json; charset=utf-8
Britain_Royals_03732-1.jpg
www.mercurynews.com/wp-content/uploads/2023/03/ 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mercurynews.com/wp-content/uploads/2023/03/Britain_Royals_03732-1.jpg?w=862
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d563298c3ede28f01a71384931c619cda9aadce1007034f284f3c0f0316303f0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
yyz1 87 131 443
last-modified
Tue, 20 Jun 2023 19:44:00 GMT
server
nginx
etag
"b97b696761f2751a"
vary
Accept
x-cache
HIT
content-type
image/webp
cache-control
max-age=31536000
accept-ranges
bytes
content-length
31734
/
p1.parsely.com/plogger/ 		43 B
258 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p1.parsely.com/plogger/?rand=1687291096195&plid=16366160&idsite=mercurynews.com&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%7D&sid=1&surl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&sref=&sts=1687291096167&slts=0&title=Meghan+Markle+earned+more+than+The+Weeknd+for+%2712+hours+work%27%3A+Spotify&date=Tue+Jun+20+2023+19%3A58%3A16+GMT%2B0000+(GMT)&action=pageview&pvid=8695127&u=pid%3Dddb44230e1c8b1f4357047be7ad79b7d
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.205.167.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-205-167-202.compute-1.amazonaws.com
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:16 GMT
Cache-Control
no-cache
Last-Modified
Tuesday, 20-Jun-2023 19:58:16 GMT
Server
nginx
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
mercurynews.com
pubcast-files.remixd.com/player-configs/ 		8 KB
9 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pubcast-files.remixd.com/player-configs/mercurynews.com
Requested by
Host: tags.remixd.com
URL: https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
143.38.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
f9d24c71e954513157a412b5339112437e013cf99070b258e445101f16747500

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:51:51 GMT
age
385
x-guploader-uploadid
ADPycdu_j3uUL9Sm-r6D4u80QaAhyG5Uh5NazaJNsMnn6Z2viZfkWT4j82I0RyrkZjBfAhKMTViu9kvcSYiLaWbvQqh7b5clQD9D
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8352
last-modified
Thu, 15 Jun 2023 11:20:10 GMT
server
UploadServer
etag
"50de11d656548e115c3b3202413c53f2"
x-goog-generation
1686828010228687
x-goog-hash
crc32c=wwSIAQ==, md5=UN4R1lZUjhFcOzICQTxT8g==
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=3600
x-goog-meta-cache-control
public, no-cache, must-revalidate
x-goog-stored-content-length
8352
accept-ranges
bytes
content-type
application/json
expires
Tue, 20 Jun 2023 20:51:51 GMT
354
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		143 KB
22 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/354?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=&overruleReferrer=&time=2023-06-20T19%3A58%3A16%2B00%3A00&ts=1687291096252
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
94793d1f283d7310c7e6af2df264ab2500a74f48b4d20e48c01e8b855b7ba079
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 82139f26335f87e45d45c08d5208817a.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
21588
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
JhaQovC2yt8y7oPtxP7Rapt88ya3fWNXHlKScm_3tD1ZJbfehVw3tw==
expires
Thu, 01 Jan 1970 00:00:00 GMT
354
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		160 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/354?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=&overruleReferrer=&time=2023-06-20T19%3A58%3A16%2B00%3A00&ts=1687291096256
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
9b2b625993442a83fec803465a134e64eb5b3a3b792db5c113cb6181084970a4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 82139f26335f87e45d45c08d5208817a.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
159
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
DY_xkMiJMY40ILOeE2qVUaDo4j3PAiV2njopLOD58H_dA1XHGI6heA==
expires
Thu, 01 Jan 1970 00:00:00 GMT
style
accounts.google.com/gsi/ 		533 B
608 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/style
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81d::200d Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
1c4e7e389d73c6acf7f19cc812514e71230740791fde8a018c1d7edccf1590ae
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-RuDsp4kVO6IFzlB_MGVJ5A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
content-security-policy
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-RuDsp4kVO6IFzlB_MGVJ5A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type
text/css; charset=utf-8
cache-control
private, max-age=86400
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires
Tue, 20 Jun 2023 19:58:16 GMT
status
accounts.google.com/gsi/ 		40 B
530 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/status?client_id=682906792919-57292pukl717kpesjb0r4cnr5342j506.apps.googleusercontent.com&as=NKOMZMMhrG%2F5UYhHJCVEnw
Requested by
Host: accounts.google.com
URL: https://accounts.google.com/gsi/client?ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81d::200d Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d11c890775a394156175e04ecc45e9b4a963c04d145f5da14c024f99cd364040
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-Jz9x8OzWzsq_jcZIxKGncw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
content-security-policy
script-src 'report-sample' 'nonce-Jz9x8OzWzsq_jcZIxKGncw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
x-content-type-options
nosniff
content-encoding
gzip
content-disposition
attachment; filename="json.txt"; filename*=UTF-8''json.txt
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
pragma
no-cache
server
ESF
x-frame-options
SAMEORIGIN
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires
Mon, 01 Jan 1990 00:00:00 GMT
impl.20230620-6-RELEASE.js
cdn.taboola.com/libtrc/ 		771 KB
161 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/impl.20230620-6-RELEASE.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3-br /
Resource Hash
3d7a16ff1ffd8d8507acd6f1ac3f27609a4e979b0a8e37474d3e0ba43e20fe3c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
dW870OqV0Fjzx1sEnMaMAQCgQ8fcUdYZ
content-encoding
br
via
1.1 varnish
date
Tue, 20 Jun 2023 19:58:16 GMT
x-amz-request-id
Z75T968SMGRC8X71
age
9249
x-amz-server-side-encryption
AES256
x-cache
HIT
content-length
163991
x-amz-id-2
5tth4PkSPD9yJMmcFTFJ0cZmQp9J1M9z19lezwRVj9y/gJOfLZnyv+O1FIVeJxptr9EWsY/80cA=
x-served-by
cache-yul12823-YUL
last-modified
Tue, 20 Jun 2023 09:24:07 GMT
server
AmazonS3-br
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687291096.332866,VS0,VE0
etag
"fd6dea8d7a047382b08a9c2a433a2c8f"
vary
Accept-Encoding
content-type
application/javascript
abp
32
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
19396
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		78 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
534e7aaabe61c7ae11f88d1333b1e55502401eec2127286a1f5d04eadb531172
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
26483
x-xss-protection
0
server
cafe
etag
913 / 19528 / 31075400 / config-hash: 15645185001691524896
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:58:16 GMT
apstag.js
c.amazon-adsystem.com/aax2/ 		236 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.107.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-107-138.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6cdf5b8d8528713b5a7b3fae738d27e6107afa0cc3a8e691a9d612303f6dfd7a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:16:24 GMT
content-encoding
gzip
via
1.1 613faec4b883bfe2ebdd8a74d5006f4c.cloudfront.net (CloudFront), 1.1 153c5cd2b3e635613d0a2fa0f107993a.cloudfront.net (CloudFront)
last-modified
Thu, 15 Jun 2023 18:14:55 GMT
server
AmazonS3
x-amz-cf-pop
IAD89-C3, JFK50-P3
age
2513
x-amz-server-side-encryption
AES256
etag
W/"7c6a36eb4b73f6b7cf4a63a33418a2c9"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
public, max-age=3600
x-amz-cf-id
6fa2VZ2UcmIy7FnRGpgqhUXr8Zz7FisGaIxOWnvkuJzwLwTTWRlY_w==
session
session.mercurynews.com/api/ 		93 B
255 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://session.mercurynews.com/api/session
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyl0MEKwjAMBuAXsg3C6PQgXn2NdgslpYnDpLjHtx4EdxLcKeTnz3cIPBc33cVQDJbaMokCS3YzZdKWFNSi0bTJPEcSn5rMFX3RA/xj9APB1fYyvUxWkfvUvVajW3wDjx+QkqHbLClK/pDlK/PcH1X0ypdjOIVxHM5hKC/Yl4tq
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.218.39.135 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-218-39-135.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
04819970a784f5b35e5618e45433e7813caeabefca573681b08b4efe83a1c2f1

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:58:16 GMT
access-control-allow-credentials
true
content-length
93
vary
Origin
content-type
application/json; charset=utf-8
common.chunk.min.js
www.mercurynews.com/wp-content/themes/assets/static/js/ 		42 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/themes/assets/static/js/common.chunk.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
cbccc935557398179deeef044a5ab2353e97ca4961f313793c8ba03964c43e93
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"648a24b4-a619"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
common-async.chunk.min.js
www.mercurynews.com/wp-content/themes/assets/static/js/ 		64 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/themes/assets/static/js/common-async.chunk.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
a832c721859e66024092445300431d52b19ce96eb53588ad13954e78be2a8580
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz1 85 187 443
etag
W/"648a24b4-10029"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
boldcoastal-async.chunk.min.js
www.mercurynews.com/wp-content/themes/assets/static/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/themes/assets/static/js/boldcoastal-async.chunk.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
4d04e98fa76e2cdba4b0b45b0b206b13de39ff72f6371b7d97ed515e21646722
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"648a24b4-c75"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
quant.js
secure.quantserve.com/ 		22 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800b:21:a021:b886:81cc:55cf , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
e23decabee8464b650d1d0241283ba0c469806e14a2199efc5bb41771cb673c1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
content-encoding
gzip
etag
"sLp6xTjO7svFVaOemhLWUQ=="
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=604800
accept-ranges
bytes
expires
Tue, 27 Jun 2023 19:58:16 GMT
asyncPixelSync
pixel.sitescout.com/dmp/ Frame AC06
Redirect Chain
  • https://pixel.sitescout.com/dmp/asyncPixelSync
  • https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
207.198.113.205 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software
A /
Resource Hash
359a049d00d909bccf224dd3a9abffdd44e3e11d2813a05deffffbd3b4b06477

Request headers

Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
max-age=0,no-cache,no-store
content-length
1162
content-type
text/html;charset=UTF-8
date
Tue, 20 Jun 2023 19:58:16 GMT
expires
Tue, 11 Oct 1977 12:34:56 GMT
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma
no-cache
server
A

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:58:16 GMT
location
https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
server
A
config.js
cdn.confiant-integrations.net/3IyQ81Wnn-d6bieQLuWeDuN4PWM/gpt_and_prebid/ 		106 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.confiant-integrations.net/3IyQ81Wnn-d6bieQLuWeDuN4PWM/gpt_and_prebid/config.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:220a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
781b3e8726a42112cd2192dd9654cf6eaf79525c7780e3c4fd8469125cc99563

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 20 Jun 2023 18:45:48 GMT
server
cloudflare
x-amz-request-id
C5AWVG1YX67TQFT2
age
782
etag
W/"73b5877229bc86a7af5b3f53f5edaef7"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=900, stale-while-revalidate=3600
cf-ray
7da695e9de984bb8-YUL
alt-svc
h3=":443"; ma=86400
x-amz-id-2
8bqhK+WFXQ68hnV/bda6rsQvunsIbJsXr2OjEV50ldcQ0ERBsKwsl4UQrtp9sqR8OHa5V6ZCjb1+ULkLpNCsEg==
launchpad-liveramp.js
launchpad-wrapper.privacymanager.io/70bb23e5-a2a7-414e-b709-7066b1333c83/ 		9 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://launchpad-wrapper.privacymanager.io/70bb23e5-a2a7-414e-b709-7066b1333c83/launchpad-liveramp.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.35.93.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-35-93-111.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
21b580c0e786d0ff2b8ef69d2808f19c17e9106f4effdf1771475ac870c81ea1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
WVJHJlCeP1N2IpvGFdgw87IN7xdjr1fa
content-encoding
gzip
via
1.1 67d3f8867c3d6540e7495f9026c9c57a.cloudfront.net (CloudFront)
date
Tue, 20 Jun 2023 18:40:38 GMT
x-amz-cf-pop
JFK50-P8
age
4659
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
content-disposition
attachment; filename="launchpad-liveramp.js"
last-modified
Mon, 18 Jul 2022 17:01:39 GMT
server
AmazonS3
etag
W/"456ed7d264d33c8630706e5b37966010"
vary
Accept-Encoding
content-type
text/javascript
x-amz-cf-id
G82t2WpfnBNoxl-1Vh-4UQC9nzSRpc5Ep0H_sWIbYszSBzSneu01Mg==
js
www.googletagmanager.com/gtag/ 		139 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-11039244145
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:820::2008 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
012a69ca45064c59cd497a10a916a6100805aa44c6f9a4297deb131d6de49ed8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
54613
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 20 Jun 2023 19:58:16 GMT
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=6035443&ns__t=1687291096514&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%2...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1687291096514&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%...
0
224 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1687291096514&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&c9=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
108.139.47.33 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-47-33.jfk50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
via
1.1 aa7ca65bca4d95ba9a04dd166671496c.cloudfront.net (CloudFront)
accept-ch
UA, Platform, Arch, Model, Mobile
x-amz-cf-pop
JFK50-P1
x-amz-cf-id
-trLee89oM4PlItT12RVsbHOAsHxPypw_8_3DVT0aS7I3FiCauOX-g==
x-cache
Miss from cloudfront

Redirect headers

date
Tue, 20 Jun 2023 19:58:16 GMT
via
1.1 aa7ca65bca4d95ba9a04dd166671496c.cloudfront.net (CloudFront)
accept-ch
UA, Platform, Arch, Model, Mobile
x-amz-cf-pop
JFK50-P1
x-cache
Miss from cloudfront
location
/b2?c1=2&c2=6035443&ns__t=1687291096514&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&c9=
content-length
0
x-amz-cf-id
Bl-WVtAnQz0Gj1bDPwJ701t72QQe-loapHoKoc-Nzwoxlt71x5JE3w==
d66dfa6e9938b7de
pixel.sitescout.com/iap/
Redirect Chain
  • https://pixel.sitescout.com/iap/d66dfa6e9938b7de
  • https://pixel.sitescout.com/iap/d66dfa6e9938b7de?cookieQ=1
0
341 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.sitescout.com/iap/d66dfa6e9938b7de?cookieQ=1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
207.198.113.205 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software
AC1.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:15 GMT
cache-control
max-age=0,no-cache,no-store
server
AC1.1
expires
Tue, 11 Oct 1977 12:34:56 GMT

Redirect headers

location
https://pixel.sitescout.com/iap/d66dfa6e9938b7de?cookieQ=1
date
Tue, 20 Jun 2023 19:58:15 GMT
server
AC1.1
content-length
0
loader-config.json
loader-cdn.azureedge.net/prod/dfm/ 		4 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://loader-cdn.azureedge.net/prod/dfm/loader-config.json?_=1687291095379
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/1C73) /
Resource Hash
5ce0cb7f558c1aca9c6e94c7d85d76db859218132923c039b7ef7b38a29f8dfd

Request headers

Accept
*/*
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:58:16 GMT
content-encoding
gzip
content-md5
1iDtMuqZEAqLGRPxG2wEug==
age
704
x-cache
HIT
content-length
1300
x-ms-lease-status
unlocked
last-modified
Mon, 12 Jun 2023 07:44:01 GMT
server
ECAcc (nya/1C73)
etag
0x8DB6B18C9F2D8E6
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
0f81f7f3-001e-0031-4baf-a316ad000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
237e8fe7-e8dc-4188-b990-c244720d83bf
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/237e8fe7-e8dc-4188-b990-c244720d83bf
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
e05a46f0-48a5-43ae-8562-32a443dc3b58
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/e05a46f0-48a5-43ae-8562-32a443dc3b58
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
25495d71-40be-4970-b9d0-1f9608dc3533
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/25495d71-40be-4970-b9d0-1f9608dc3533
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
f517a844-974e-41b8-bc7b-c48363c81f76
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/f517a844-974e-41b8-bc7b-c48363c81f76
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
4471d3c1-446d-4e17-8187-2510a790ba9c
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/4471d3c1-446d-4e17-8187-2510a790ba9c
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
f15afbbc-f11f-40f9-a01d-e1450a60b187
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/f15afbbc-f11f-40f9-a01d-e1450a60b187
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
ee3f7409-b798-4f30-a861-36ec693401ec
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/ee3f7409-b798-4f30-a861-36ec693401ec
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
/
cmp.osano.com/ Frame 2ECD 		4 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cmp.osano.com/
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2510:f400:3:b7e:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a48b96eb4dbabdf7d10b4a7667062cd55b7c1f9aab381f05c916798ec4308f68
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
46122
content-encoding
br
content-type
text/html
date
Tue, 20 Jun 2023 07:09:35 GMT
etag
W/"287b497c992487af362d33204f87d28f"
last-modified
Thu, 21 Oct 2021 22:01:08 GMT
referrer-policy
strict-origin-when-cross-origin
server
AmazonS3
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Accept-Encoding Origin
via
1.1 5ba825173b1f7429171e730e7ae12588.cloudfront.net (CloudFront)
x-amz-cf-id
HCVvYkRLTxaxgdxaSsxGmFZtKd14ffT-8Fv39YsLzLeIA8IY15kOaA==
x-amz-cf-pop
JFK50-P5
x-amz-version-id
xT1PkIFehetvNf5lINcU02FbT3u47kBr
x-cache
Hit from cloudfront
x-content-type-options
nosniff
x-xss-protection
1; mode=block
v2
api.viafoura.co/v2/www.mercurynews.com/bootstrap/ 		7 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.viafoura.co/v2/www.mercurynews.com/bootstrap/v2
Requested by
Host: cdn.viafoura.net
URL: https://cdn.viafoura.net/entry/index.js?ver=2.0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:44f0:4851:acd5:7304:ba6b:1c44 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
945cb43e5f380aa7de1193b7db86ff334c715527497b26018f0d59e1132613bc

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-instance-id
i-0075c79845df4eb0b
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:16 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS, PUT, DELETE, PATCH, HEAD
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
max-age=0
access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
expires
Tue, 20 Jun 2023 19:58:16 GMT
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/ 		408 KB
126 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/pubads_impl.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5b70d8eb19ca32d244e29e759e816c343be893232978532c9d5943f838e60e0b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 06:48:24 GMT
content-encoding
br
x-content-type-options
nosniff
age
47392
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
129045
x-xss-protection
0
server
cafe
etag
16806126990728334555
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
expires
Wed, 19 Jun 2024 06:48:24 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/ 		616 B
320 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.mercurynews.com&ppc_eid=31075027
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js?ver=2.0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ac888a811086e5e08352c3dc0d0b704206641c37f78b1932c3ca956367aed497
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:58:16 GMT
g.gif
pixel.wp.com/ 		50 B
116 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=ext&blog=116372247&post=9968021&tz=-7&srv=www.mercurynews.com&hp=vip&j=1%3A12.2.1&host=www.mercurynews.com&ref=&fcp=1136&rand=0.7195905359420909
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:58:16 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
2615.svg
s.w.org/images/core/emoji/14.0.0/svg/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.w.org/images/core/emoji/14.0.0/svg/2615.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
s.w.org
Software
nginx /
Resource Hash
8b8afd8f60833ca51907899d4a3279cdfd355282858ba8a73cd1034d2a1e31ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT yyz 2
date
Tue, 20 Jun 2023 19:58:16 GMT
x-content-type-options
nosniff
last-modified
Tue, 12 Apr 2022 03:50:38 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
access-control-allow-origin
*
access-control-allow-methods
GET, HEAD
cache-control
max-age=315360000
accept-ranges
bytes
content-length
1294
expires
Thu, 31 Dec 2037 23:55:55 GMT
1f451.svg
s.w.org/images/core/emoji/14.0.0/svg/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.w.org/images/core/emoji/14.0.0/svg/1f451.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
s.w.org
Software
nginx /
Resource Hash
3916390d4395ed16641c0e23d5e5a1bef9de6ce71b02c3941c0ee6f2d899c806
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT yyz 2
date
Tue, 20 Jun 2023 19:58:16 GMT
x-content-type-options
nosniff
last-modified
Tue, 12 Apr 2022 03:53:43 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
access-control-allow-origin
*
access-control-allow-methods
GET, HEAD
cache-control
max-age=315360000
accept-ranges
bytes
content-length
1311
expires
Thu, 31 Dec 2037 23:55:55 GMT
1f393.svg
s.w.org/images/core/emoji/14.0.0/svg/ 		958 B
463 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.w.org/images/core/emoji/14.0.0/svg/1f393.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
s.w.org
Software
nginx /
Resource Hash
14e71be3ff5aa2e7773210530b6f25ac38218c1833c4efec611f8c89e650db52
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT yyz 2
date
Tue, 20 Jun 2023 19:58:16 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Tue, 12 Apr 2022 03:47:50 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
access-control-allow-origin
*
access-control-allow-methods
GET, HEAD
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
truncated
/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
14f3a2330f6d02bcd5407635a03c7ab8ed1aa494914c05881137c5e86ae20acf

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
img/png
truncated
/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f6d8894bccb6968f9c55a23894a63a454f3425a7a4c19251ba01d9e3493084a0

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
img/png
state-ny.png
www.mercurynews.com/wp-content/plugins/bloom-for-publishers/images/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mercurynews.com/wp-content/plugins/bloom-for-publishers/images/state-ny.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyNztEKwjAMBdAfsstE2PRB/JYt62ywTUuT4u+7tT4JA98uCSe58E4GI6tlheTLk1hg9jEGs8ZsUpk9ibNZIEVRQGmh28IJ/qVip4yu4hYP+bIGo7mIGuKFcNK4c52UsPLfXReID4+57dfLMtQmzX9HrRzu8hHu52Hsb8N47S8fV1JlGg==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f9c4ffcfab2c93ba07bd2d4a2dd53a1d23faace457ade18c52c3f4ea67b8ea68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/_static/??-eJyNztEKwjAMBdAfsstE2PRB/JYt62ywTUuT4u+7tT4JA98uCSe58E4GI6tlheTLk1hg9jEGs8ZsUpk9ibNZIEVRQGmh28IJ/qVip4yu4hYP+bIGo7mIGuKFcNK4c52UsPLfXReID4+57dfLMtQmzX9HrRzu8hHu52Hsb8N47S8fV1JlGg==
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
yyz1 85 187 443
last-modified
Tue, 13 Dec 2022 21:43:23 GMT
server
nginx
etag
"6398f1fb-26da"
x-cache
HIT
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
content-length
9946
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ 		47 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,600,700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 13 Jun 2023 22:34:53 GMT
x-content-type-options
nosniff
age
595403
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48412
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:08:53 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 12 Jun 2024 22:34:53 GMT
vitals
www.foo.software/api/ 		0
96 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.foo.software/api/vitals
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
137.184.240.117 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.25.0 / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:58:16 GMT
server
nginx/1.25.0
x-powered-by
Express
d8d9c077aeb2f07c7fe3017ecf6d44ca
a869.mercurynews.com/plugin/plugin/ 		233 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/plugin/plugin/d8d9c077aeb2f07c7fe3017ecf6d44ca
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
d623d4148afe3958f8cf929fccf8a2661b93a30e7f0550fd26f478dca78ab492
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 13 Jun 2023 20:26:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 82139f26335f87e45d45c08d5208817a.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
age
603113
x-cache
Hit from cloudfront
p3p
policyref="", CP="DSP"
content-length
56480
x-xss-protection
1; mode=block
last-modified
Mon, 12 Jun 2023 20:26:23 GMT
server
-
etag
d8d9c077aeb2f07c7fe3017ecf6d44ca
content-type
text/javascript; charset=utf-8
cache-control
public, no-cache="Set-Cookie", max-age=31536000
x-robots-tag
noindex, nofollow
x-amz-cf-id
oZnvwq8VtXNAnNnPnbElTduo0dIh-T-5oMk8xZb5kGP1MN64ytigrg==
expires
Wed, 12 Jun 2024 20:26:23 GMT
standard-player.html
tags.remixd.com/player/v5/players/ 		129 KB
30 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://tags.remixd.com/player/v5/players/standard-player.html
Requested by
Host: tags.remixd.com
URL: https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.214.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-214-18.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7f5d73c848836745a93ff7aa540a8f83f9899e3668628f42e9ba0cc6ef5e0b32

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:57:54 GMT
content-encoding
gzip
via
1.1 7a1287aac11cb484d13c7a9cbd2585b0.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR50-C1
age
23
x-cache
Hit from cloudfront
content-length
29730
last-modified
Tue, 21 Jun 2022 15:31:59 GMT
server
AmazonS3
etag
"9a2e807a291cbaccaab15c40f0629813"
access-control-max-age
60
access-control-allow-methods
GET, HEAD
content-type
text/html
access-control-allow-origin
*
cache-control
public,max-age=1800
vary
Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges
bytes
x-amz-cf-id
EX1ySduBjwHvnUKTshm6eSmY48rM1_aGDv-PMnyLEn5auMAdABNKzQ==
load.js
pm-widget.taboola.com/medianewsgroup-network/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pm-widget.taboola.com/medianewsgroup-network/load.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
986ccecb5ddec6d653cdb03022cbb35af07301b752cad8ac1d6c7aa66a11e661

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
iVYX3NWtVvLgaZWbuxTvffzyb1PlHiYS
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Tue, 20 Jun 2023 19:58:16 GMT
x-amz-request-id
X6YEKWD34AR5NGS6
age
146
x-cache
HIT, HIT
content-length
1078
x-amz-id-2
7b9FNLhXy4GnVVy+nbp9g24EBAwM15yM/81aPsFz3MTVqszOmj8qKD5O2ua7ukyyGC3/SGH+NaM=
x-served-by
cache-bur-kbur8200062-BUR, cache-yul12823-YUL
last-modified
Tue, 30 May 2023 04:23:23 GMT
server
AmazonS3
x-timer
S1687291097.963668,VS0,VE1
etag
"a9928842e0a03e30273550ed905b9329"
vary
Accept-Encoding,,
content-type
application/javascript; charset=utf-8
cache-control
max-age=300
accept-ranges
bytes
x-cache-hits
27535, 1
rules-p-4ctCQwtnNBNs2.js
rules.quantcount.com/ 		3 B
448 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rules.quantcount.com/rules-p-4ctCQwtnNBNs2.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:e400:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 03:07:12 GMT
via
1.1 aa7679f2d01b23d9a66bfa6e92991b04.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR53-C2
age
60666
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
3
last-modified
Sat, 04 Mar 2017 19:57:14 GMT
server
AmazonS3
etag
"8a80554c91d9fca8acb82f023de02f11"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
x-amz-cf-id
PIeZXE_V8rbLnrVHeP3LQfuSjg5VTJ8q91YtxCVq4iNG10_aKAOV8g==
sync
gum.criteo.com/ 		46 B
303 B 		Script
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sync?c=72&r=2&j=TRC.getRTUS&us_privacy=1---&gdpr=0&gdpr_consent=&gdpr_pd=
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
189b8ed64093b12937354b2ef71ccf1df59690d90432241a10fe1cb25000acba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:16 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=3600
server-processing-duration-in-ticks
218860
expires
60
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/ 		6 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.107.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-107-138.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
Zm_tZQQ808JKRizBfXGgSN2OWn8Z6JUU
content-encoding
gzip
via
1.1 134f499632d1e15750219cb766bdc50c.cloudfront.net (CloudFront)
date
Tue, 20 Jun 2023 12:05:04 GMT
x-amz-cf-pop
JFK50-P3
age
28394
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 26 May 2023 01:35:48 GMT
server
AmazonS3
etag
W/"a4d296427fc806b21335359e398c025c"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
vary
Accept-Encoding,Origin
x-amz-cf-id
qCO9tmqt2Gnm2iar0Id-Zy0MtPWsVOxkjnR1VQJQKdGw8jekTOQRrQ==
analytics.js
www.google-analytics.com/ 		51 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:817::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 20 Jun 2023 18:11:08 GMT
last-modified
Mon, 17 Apr 2023 22:36:01 GMT
server
Golfe2
age
6429
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20737
expires
Tue, 20 Jun 2023 20:11:08 GMT
js
www.googletagmanager.com/gtag/ 		254 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-LMTT1ZNHB1&l=dataLayer&cx=c
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:820::2008 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
2f857dafdd9e3ffc93f414d1f032d980451560631d4ba2b9db1f7cf169f2647e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:17 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
88675
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Tue, 20 Jun 2023 19:58:17 GMT
ml.br.js
js.matheranalytics.com/static/ltm/ma23578/wp/27/
Redirect Chain
  • https://js.matheranalytics.com/s/ma23578/239876506/wp/ml.js?cb=1627
  • https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
150 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
107.178.250.234 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
234.250.178.107.bc.googleusercontent.com
Software
nginx /
Resource Hash
320a526c59206598fcf37bc7e6950aa443a2d576bb2667a6bad7517d756f438c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 19 Jun 2023 21:43:22 GMT
content-encoding
br
via
1.1 google
last-modified
Mon, 12 Jun 2023 20:29:05 GMT
server
nginx
age
80095
etag
"85aef1250c3704a499337dcfc565d621"
vary
Accept-Encoding
x-cache
HIT Mon, 12 Jun 2023 20:39:11 GMT
content-type
application/x-javascript
cache-control
public,max-age=3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
44324

Redirect headers

date
Tue, 20 Jun 2023 19:58:17 GMT
via
1.1 google
server
nginx
vary
Accept-Encoding
location
https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
cache-control
public, max-age=269200
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-served-by
0-gc-northeast1c-54231010
tag.js
s.btstatic.com/ 		34 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.btstatic.com/tag.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.7.4.170 Bogotá, Colombia, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-7-4-170.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5c2b76989e49a2bd8c651a35634fd43081b13bde1a6385fb8e36dccc1d0d42d8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:17 GMT
Content-Encoding
gzip
Last-Modified
Wed, 26 Apr 2023 17:52:45 GMT
Server
nginx
Vary
Accept-Encoding
P3P
CP=NOI DSP COR NID
Content-Type
application/javascript
Cache-Control
public, max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
12525
demconf.jpg
dpm.demdex.net/ Frame AC06
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=82530&dpuuid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=
42 B
942 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
54.149.73.110 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-149-73-110.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

DCS
dcs-prod-usw2-2-v045-0c39708d2.edge-usw2.demdex.com 4 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
UoHBvV/1Q8U=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type
image/gif
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcs-prod-usw2-1-v045-0a0fc120b.edge-usw2.demdex.com 3 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
gHgU8mzkT0c=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
check
pixel.tapad.com/idsync/ex/receive/ Frame AC06
Redirect Chain
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2499&partner_device_id=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341
95 B
435 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:17 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type
image/png
access-control-allow-origin
*
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95

Redirect headers

date
Tue, 20 Jun 2023 19:58:17 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin
*
location
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
pixel.gif
load77.exelator.com/ Frame AC06
Redirect Chain
  • https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=
  • https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=&xl8blockcheck=1
  • https://load77.exelator.com/pixel.gif
43 B
366 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://load77.exelator.com/pixel.gif
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
2a02:6ea0:c400::12 New York, United States, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
newyorkUSNY
date
Tue, 20 Jun 2023 19:58:17 GMT
x-cache
HIT
x-77-cache
HIT
x-age
985417
x-accel-date
1686305680
content-length
43
x-77-nzt
AVm7sQ9MqWD/SQkPAA
x-accel-expires
@1687342480
last-modified
Wed, 25 Oct 2017 17:03:56 GMT
server
CDN77-Turbo
etag
"59f0c3fc-2b"
x-77-nzt-ray
49be14080db94cd7d90492646cdf0829
content-type
image/gif
access-control-allow-origin
*
accept-ranges
bytes

Redirect headers

date
Tue, 20 Jun 2023 19:58:17 GMT
server
nginx
x-powered-by
Undertow/1
p3p
policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location
https://load77.exelator.com/pixel.gif
content-type
image/gif
cache-control
no-cache
access-control-allow-credentials
true
content-length
0
um
sync.teads.tv/ Frame AC06 		23 B
279 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.teads.tv/um?eid=73&uid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.49.101.144 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-49-101-144.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.10 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

expires
Tue, 20 Jun 2023 19:58:17 GMT
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:17 GMT
cache-control
max-age=0, no-cache, no-store
server
akka-http/10.2.10
content-length
23
content-type
image/gif
qmap
sync.crwdcntrl.net/ Frame AC06
Redirect Chain
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=&ct=y
49 B
265 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=&ct=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
52.72.123.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-72-123-193.compute-1.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:17 GMT
server
Jetty(9.4.38.v20210224)
content-type
image/gif
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
*
cache-control
no-cache
x-server
10.40.34.165
content-length
49
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:17 GMT
server
Jetty(9.4.38.v20210224)
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=&ct=y
cache-control
no-cache
x-server
10.40.15.74
content-length
0
expires
0
9d17e5ca-fd26-4a4e-b418-cb4344a93066
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/9d17e5ca-fd26-4a4e-b418-cb4344a93066
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
ba166bdd-b473-467e-9d43-61be9ebe1fed
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/ba166bdd-b473-467e-9d43-61be9ebe1fed
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
fp.min.js
fp-cdn.azureedge.net/prod/dfm/ 		65 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fp-cdn.azureedge.net/prod/dfm/fp.min.js?
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/1C6F) /
Resource Hash
f3988a8a95c5faec9bb5307667596b220a12d277072950244393b5f33091e2fb

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:58:17 GMT
content-encoding
gzip
content-md5
VJ6k3v9dRV/0qT39eqFDjw==
age
20822
x-cache
HIT
content-length
23424
x-ms-lease-status
unlocked
last-modified
Mon, 12 Jun 2023 14:09:43 GMT
server
ECAcc (nya/1C6F)
etag
0x8DB6B4EABC41F1B
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
f26d5fd1-801e-003f-7f81-a33f1d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
g2insights.min.js
g2insights-cdn.azureedge.net/prod/dfm/ 		220 KB
48 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://g2insights-cdn.azureedge.net/prod/dfm/g2insights.min.js?
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/1C11) /
Resource Hash
743fab9929b06e6ea08ee7296b84d0068d27d9fe7552b69f351a3298b968910a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:58:17 GMT
content-encoding
gzip
content-md5
3vlRE270poARifXWcdSFQA==
age
681
x-cache
HIT
content-length
49062
x-ms-lease-status
unlocked
last-modified
Mon, 12 Jun 2023 07:19:27 GMT
server
ECAcc (nya/1C11)
etag
0x8DB6B155BAB7A80
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
8fde6a15-901e-008a-05af-a3ac0f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
t8y9347t.min.js
cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/ 		879 KB
205 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/t8y9347t.min.js?
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/1C1A) /
Resource Hash
1313e544d95566c0ed767f40117a8287940c2856fb450d6a4224b8db33a97902

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:58:17 GMT
content-encoding
gzip
content-md5
TKR/2Tq6xUUECucxJTe0nw==
age
2407
x-cache
HIT
content-length
209412
x-ms-lease-status
unlocked
last-modified
Mon, 12 Jun 2023 07:14:24 GMT
server
ECAcc (nya/1C1A)
etag
0x8DB6B14A70BE01E
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
02973d82-b01e-0046-04ab-a3c339000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
ingest
i.viafoura.co/v3/www.mercurynews.com/ 		67 B
325 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.viafoura.co/v3/www.mercurynews.com/ingest?t=%7B%22view%22%3A%7B%22domain%22%3A%22www.mercurynews.com%22%2C%22siteUuid%22%3A%2200000000-0000-4000-8000-c86bf0725f23%22%2C%22pageViews%22%3A1%2C%22outgoing%22%3A10%2C%22sessionStart%22%3A1687291097%2C%22isRecirculation%22%3Afalse%2C%22uniqueId%22%3A%2250b6f4f5-c151-4f14-97e0-af9264313a9a%22%2C%22firstVisit%22%3A1687291097%2C%22previousVisit%22%3A1687291097%2C%22currentVisit%22%3A1687291097%2C%22visitCount%22%3A1%2C%22referrerStart%22%3A1687291097%2C%22refVisitCount%22%3A1%2C%22ref%22%3A%7B%22medium%22%3A%22direct%22%2C%22source%22%3A%22%22%2C%22sharer_uuid%22%3A%22%22%2C%22terms%22%3A%22%22%7D%7D%2C%22meta%22%3A%7B%22domain%22%3A%22www.mercurynews.com%22%2C%22site%22%3A%2200000000-0000-4000-8000-c86bf0725f23%22%2C%22section%22%3A%2200000000-0000-4000-8000-c86bf0725f23%22%2C%22pageImage%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2Fwp-content%2Fuploads%2F2023%2F03%2FBritain_Royals_03732-1.jpg%3Fw%3D1024%26h%3D683%22%2C%22ref%22%3A%7B%7D%2C%22vf%22%3Afalse%2C%22url%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%22%2C%22path%22%3A%22%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%22%2C%22title%22%3A%22Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20just%20%E2%80%9812%20hours%20work%2C%E2%80%99%20ex-Spotify%20exec%20tells%20BBC%22%2C%22privilege%22%3A%22guest%22%2C%22page_type%22%3A%22article%22%2C%22page_description%22%3A%22Even%20though%20Markle%20only%20produced%2012%20hours%20of%20podcast%20content%20in%202%201%2F2%20years%2C%20she%20possibly%20earned%20far%20more%20money%20than%20The%20Wknd%20for%20%E2%80%98Blinding%20Lights%2C%E2%80%99%20the%20most%20streamed%20song%20in%20Spotify%26%238%E2%80%A6%22%2C%22topics%22%3A%5B%5D%2C%22amp%22%3Afalse%2C%22thirdparty_enabled%22%3Afalse%2C%22container_id%22%3A%229968021%22%7D%2C%22ua%22%3A%7B%22nl%22%3A%22en-US%22%2C%22nu%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.133%20Safari%2F537.36%22%2C%22sr%22%3A%221600x1200%22%2C%22sd%22%3A24%2C%22vp%22%3A%221600x1200%22%2C%22dt%22%3A%22Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify%22%2C%22de%22%3A%22UTF-8%22%2C%22dl%22%3A%22en-US%22%7D%2C%22rq%22%3A%225ef79775-8d69-48cc-ab30-6df803f2f413%22%2C%22w%22%3A%5B%22vf-conversations%22%2C%22vf-tray%22%2C%22vf-content-recirculation%22%5D%2C%22event_type%22%3A%22analytics.view_lite%22%7D
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.199.123.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-199-123-15.compute-1.amazonaws.com
Software
/
Resource Hash
ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/png
date
Tue, 20 Jun 2023 19:58:17 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
67
expires
Fri, 01 Jan 1990 00:00:00 GMT
5d4a3224-d6d1-46ab-864a-bef00a67b72d
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/5d4a3224-d6d1-46ab-864a-bef00a67b72d
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
dd033c7f-5504-45d4-a594-e4cdc768a014
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/dd033c7f-5504-45d4-a594-e4cdc768a014
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
FUtg69tL.js
cdn.jwplayer.com/libraries/ Frame 64D9 		108 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jwplayer.com/libraries/FUtg69tL.js
Requested by
Host: tags.remixd.com
URL: https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2209:cc00:1:a3fa:7cc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
openresty /
Resource Hash
36ed4c503d280b26964aeb735d6345fe6f6b1a39a853045dca583c608185a024

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:57:54 GMT
content-encoding
gzip
via
1.1 6e01480ef7aa01c23bf600698a613304.cloudfront.net (CloudFront)
server
openresty
x-amz-cf-pop
EWR53-P1
age
23
x-cache
Hit from cloudfront
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=180
x-robots-tag
noindex, indexifembedded
content-length
41225
x-amz-cf-id
nZDcmSvyLIXbEngdztyaw-Q20-46bMEhLy93clkPzKFDKgX5MdG_Hg==
cdb
bidder.criteo.com/ 		0
198 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=35&wv=7.46.0&cb=18387806728&lsavail=1
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:58:16 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
prebid
ads.yieldmo.com/exchange/ 		0
228 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.yieldmo.com/exchange/prebid?pbav=7.46.0&p=%5B%7B%22placement_id%22%3A%22htlad-1-gpt%22%2C%22callback_id%22%3A%226d5cf2ff596ab3%22%2C%22sizes%22%3A%5B%5B300%2C50%5D%2C%5B320%2C50%5D%5D%2C%22ym_placement_id%22%3A%223263962355775513258%22%2C%22gpid%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fsponsorship_1%231%22%2C%22tid%22%3A%22e4e6a7ea-38e9-49b3-bc3c-e0dd18c95d17%22%2C%22auctionId%22%3A%22900bde5c-e133-4dab-8462-1cf67ded6112%22%7D%2C%7B%22placement_id%22%3A%22htlad-3-gpt%22%2C%22callback_id%22%3A%227dfb90b7298c0f%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B970%2C90%5D%2C%5B970%2C250%5D%5D%2C%22ym_placement_id%22%3A%223263962357730058934%22%2C%22gpid%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Ftop_leaderboard%231%22%2C%22tid%22%3A%22beb65606-c655-4587-863f-e6f0c33696d3%22%2C%22auctionId%22%3A%22900bde5c-e133-4dab-8462-1cf67ded6112%22%7D%2C%7B%22placement_id%22%3A%22htlad-6-gpt%22%2C%22callback_id%22%3A%228f7f917fb1e6ce%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%2C%5B300%2C1050%5D%2C%5B160%2C600%5D%5D%2C%22ym_placement_id%22%3A%223263962352562676374%22%2C%22gpid%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fcube1_rrail_atf%231%22%2C%22tid%22%3A%22ed1ee3b6-47bc-4cca-a1ba-62503af6e6ee%22%2C%22auctionId%22%3A%22900bde5c-e133-4dab-8462-1cf67ded6112%22%7D%5D&page_url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bust=1687291097294&dnt=false&description=Meghan%20Markle%20only%20produced%2012%20hours%20of%20podcast%20content%20in%202%C2%BD%20years%2C%20yet%20possibly%20earned%20more%20than%20The%20Weeknd%20for%20his%20huge%20hit%20%27Blinding%20Lights.%27&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%2C%22gpp%22%3A%22%22%2C%22gpp_sid%22%3A%22%22%7D&us_privacy=1---&pr=&scrd=1&title=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&w=1600&h=1200
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.164.127.24 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-164-127-24.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mercurynews.com
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:17 GMT
access-control-allow-credentials
true
x-robots-tag
none,NOINDEX,NOFOLLOW
access-control-allow-methods
POST, GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma
translator
hbopenbid.pubmatic.com/ 		0
119 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:58:16 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
auction
tlx.3lift.com/header/ 		19 B
578 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=7.46.0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tmax=2000&us_privacy=1---
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.226.65.198 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-226-65-198.compute-1.amazonaws.com
Software
/
Resource Hash
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:17 GMT
accept-ch
sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness
x-auction-status
12, 12, 12
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-length
19
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		524 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=15594&site_id=469134&zone_id=2768250&size_id=43&alt_size_ids=44&us_privacy=1---&rf=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.domain=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.pbadslot=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fsponsorship_1%231&tk_flint=pbjs_lite_v7.46.0&x_source.tid=e4e6a7ea-38e9-49b3-bc3c-e0dd18c95d17&l_pb_bid_id=18bc8162026d389&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=e4e6a7ea-38e9-49b3-bc3c-e0dd18c95d17&rp_maxbids=1&p_gpid=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fsponsorship_1%231&slots=1&rand=0.23723403604488924
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:300::99 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
ffb5be291b495f1911e27e992160ade6b35159ba682a4d0a3d5575026ab8037a

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:17 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.mercurynews.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
524
expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		524 B
860 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=15594&site_id=469134&zone_id=2768258&size_id=2&alt_size_ids=55%2C57&us_privacy=1---&rf=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.domain=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.pbadslot=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Ftop_leaderboard%231&tk_flint=pbjs_lite_v7.46.0&x_source.tid=beb65606-c655-4587-863f-e6f0c33696d3&l_pb_bid_id=195a35881245391&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=beb65606-c655-4587-863f-e6f0c33696d3&rp_maxbids=1&p_gpid=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Ftop_leaderboard%231&slots=1&rand=0.8163017944040332
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:300::99 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
a6911b93d58f69e12e4de2a4d9367553d6ec3cde022316d36e3884255d21e625

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:17 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.mercurynews.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
524
expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		524 B
860 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=15594&site_id=469134&zone_id=2768236&size_id=15&alt_size_ids=9%2C10%2C54&us_privacy=1---&rf=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.domain=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.pbadslot=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fcube1_rrail_atf%231&tk_flint=pbjs_lite_v7.46.0&x_source.tid=ed1ee3b6-47bc-4cca-a1ba-62503af6e6ee&l_pb_bid_id=20348affa47ccdf&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=ed1ee3b6-47bc-4cca-a1ba-62503af6e6ee&rp_maxbids=1&p_gpid=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fcube1_rrail_atf%231&slots=1&rand=0.773776789348996
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:300::99 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
fa6c9a57d2b1b4f5b343af93f462f46895bdef76492379b49c33d39a3ff61a07

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:17 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.mercurynews.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
524
expires
Wed, 17 Sep 1975 21:32:10 GMT
prebid
ib.adnxs.com/ut/v3/ 		378 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
de39a860f34cfc161a6c88b3acd18a5a113114e00d5f2a6bbb0b51a47401e48d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:17 GMT
AN-X-Request-Uuid
0d5d9c7e-7e4e-4fe5-8848-372ff4e6e4af
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
application/json; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.mercurynews.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
378
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
pbjs
htlb.casalemedia.com/openrtb/ 		36 B
553 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/openrtb/pbjs?s=945271
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.25.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3542791df1565c5c4aff131de65e61fe174c1f11fc569812d5f8e6912a3d3129

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:17 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rNQkkJ4CBURQZmbQFUcUwPfcwRWnHS2w50UccwJ13aBteaTntYIBWJN%2By9RTAbN%2FdP5HITeTqw3%2BLdZyBqplPQ7zQtknPsCg7LmeU%2Bvs1GafdiLkRMzC1IoW%2BlpQg%2FGoGoyjiwCB"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache
access-control-allow-credentials
true
cf-ray
7da695ee9f0b36aa-YYZ
alt-svc
h3=":443"; ma=86400
content-length
36
expires
0
config
c.amazon-adsystem.com/cdn/prod/ 		320 B
671 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/cdn/prod/config?src=3391&u=https%3A%2F%2Fwww.mercurynews.com
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.107.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-107-138.jfk50.r.cloudfront.net
Software
Server /
Resource Hash
7bd8b3e8c5d0f5c0a1c5ed3b69c09e4ae5edb40519ad8a1882b007ac3bf91901

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:13:51 GMT
via
1.1 153c5cd2b3e635613d0a2fa0f107993a.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
JFK50-P3
age
6265
x-cache
Hit from cloudfront
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
max-age=21550, s-maxage=21600
access-control-allow-credentials
true
content-length
320
x-amz-cf-id
GO7fbh2LP5mujk7zmv2rPtvkLshL8LmrBcuZCFJuWoBeB6Ldywo4Xw==
bid
aax.amazon-adsystem.com/e/dtb/ 		244 B
688 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://aax.amazon-adsystem.com/e/dtb/bid?src=3391&u=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&pid=I2IR8xQPJA6LC&cb=0&ws=1600x1200&v=23.612.1758&t=2000&slots=%5B%7B%22sd%22%3A%22htlad-1-gpt%22%2C%22s%22%3A%5B%22320x50%22%5D%2C%22sn%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fsponsorship_1%22%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A10%7D%2C%7B%22sd%22%3A%22htlad-3-gpt%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Ftop_leaderboard%22%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A10%7D%2C%7B%22sd%22%3A%22htlad-6-gpt%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%2C%22160x600%22%5D%2C%22sn%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fcube1_rrail_atf%22%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A10%7D%5D&gpp=DBACOe~~~&gpp_sid=%5B5%5D&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.107.227 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-107-227.jfk50.r.cloudfront.net
Software
Server /
Resource Hash
f8e60fa507399273a3862f6ca5b4daf3df1b225801d641c564a10336e84773e5
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:17 GMT
strict-transport-security
max-age=47474747; includeSubDomains; preload
via
1.1 5a588475f9a075d76c33229107634f8e.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
JFK50-P6
x-amz-rid
ZQAE3KG2GAFV33T5CCDP
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
access-control-allow-credentials
true
timing-allow-origin
*
content-length
244
x-amz-cf-id
Eez3EoGJCNGxsF615hCroCWUH3BcOqjBcMeFm2nVSP-SL62DYUrlug==
esp.js
cdn.id5-sync.com/api/1.0/ 		83 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.id5-sync.com/api/1.0/esp.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4c216860f82a201e909b917ff2eca53e9787b05ec1fe5a69a0d4b994d95781c5
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:17 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 20 Jun 2023 07:12:13 GMT
server
cloudflare
x-amz-request-id
X6X36P6AYV2RQ42X
age
2487
etag
W/"916c7961f99d2ada149bc1a94a1bf864"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
text/javascript;charset=utf-8
cache-control
public, max-age=3600
cf-ray
7da695eefaa7238a-EWR
x-amz-id-2
Vt7z9O67X5IMwF7HB0lJZjA0pk0GGLfP/eXvd1CLp7odJN4rh0LZcqY/M5Rrvs4TjRmjd4RbCdQbemMQA/Slwg==
pubcid.min.js
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 		732 B
644 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Tue, 20 Jun 2023 19:58:17 GMT
x-content-type-options
nosniff
content-encoding
br
age
31115
x-jsd-version
master
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
439
x-served-by
cache-fra-eddf8230042-FRA, cache-yul12822-YUL
x-jsd-version-type
branch
etag
W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
uid2SecureSignal.js
cdn.prod.uidapi.com/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2511:8000:a:e047:753:be1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a695b8b12c7d88355d0b1b33d6c643a7913bcfbeae91553bd7560019188b1032

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
null
Date
Tue, 20 Jun 2023 09:17:00 GMT
Via
1.1 2f276f8b7ce92ba7a0844268d20c32ba.cloudfront.net (CloudFront)
Last-Modified
Thu, 04 May 2023 00:14:06 GMT
Server
AmazonS3
X-Amz-Cf-Pop
JFK50-P6
Age
38478
x-amz-server-side-encryption
AES256
ETag
"4d5acbf33f4a0592ac0515db92fe88e6"
X-Cache
Hit from cloudfront
Content-Type
text/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1858
X-Amz-Cf-Id
J8fumlFCsQUHMJt5R2MHUGb1ujPe7IQvsYqmio_L1eI9nB0wZOceZA==
publishertag.ids.js
static.criteo.net/js/ld/ 		42 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.ids.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
839c424b188a9bdafd46e5b643a2c5afb4b7df5e51f0321ffafd5f23b118e259
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:17 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 31 May 2023 13:09:50 GMT
server
nginx
etag
W/"6477471e-a980"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:58:17 GMT
pmk-20220605.3.js
pm-widget.taboola.com/medianewsgroup-network/ 		109 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pm-widget.taboola.com/medianewsgroup-network/pmk-20220605.3.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
463b965e90a6c1e92161047e09f18a7b0c5bfe39c59de875536a744922f18285

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
EpZzlJAx.0y9.uC5nEuXRKLfz.04Efo4
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Tue, 20 Jun 2023 19:58:17 GMT
x-amz-request-id
DAM11Y8WW0441GFC
age
1870492
x-cache
HIT, HIT
content-length
30633
x-amz-id-2
R1WtWYmDdmYhnE6C2z0FDpK8g1Uy3NwQv2MAMZmqF1e28TOsr7BJebrxzYXfpeuqVE45bHxiAj4=
x-served-by
cache-bur-kbur8200175-BUR, cache-yul12823-YUL
last-modified
Tue, 30 May 2023 04:23:22 GMT
server
AmazonS3
x-timer
S1687291097.371084,VS0,VE0
etag
"ad88e58bdaa38d8b8e9028ad431a5e02"
vary
Accept-Encoding,,
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
8, 2128
65c25df5710daac71512ce59624729c1
a869.mercurynews.com/plugin/library/ 		438 KB
138 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/plugin/library/65c25df5710daac71512ce59624729c1
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
d8b0939d4ad62069a09916859d301d5a0d9c00e9174ad682c53bc122a35bf80e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 31 May 2023 07:17:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 82139f26335f87e45d45c08d5208817a.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
age
1773677
x-cache
Hit from cloudfront
p3p
policyref="", CP="DSP"
content-length
140593
x-xss-protection
1; mode=block
last-modified
Tue, 30 May 2023 07:17:00 GMT
server
-
etag
65c25df5710daac71512ce59624729c1
content-type
text/javascript; charset=utf-8
cache-control
public, no-cache="Set-Cookie", max-age=31536000
x-robots-tag
noindex, nofollow
x-amz-cf-id
GyzjE3ofnvuVP-59PRsWZnK5coaMxWCn_miEe5QBlhUKNt5vVXLZTQ==
expires
Thu, 30 May 2024 07:17:00 GMT
LB-Zone-3
a869.mercurynews.com/DG/DEFAULT/rest/rpc/354/ 		139 B
838 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/354/LB-Zone-3?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=&overruleReferrer=&time=2023-06-20T19%3A58%3A17%2B00%3A00&ts=1687291097399
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
ce06fb43716decbbd5182b120b5f1190987489a47a06c14f2d7da24d72a01338
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:58:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 82139f26335f87e45d45c08d5208817a.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
144
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
WLSQTHMXB-RPg9RzsWxOcI6eY_vareUSEXJ2qYbwfmHItOIRY0ohTQ==
expires
Thu, 01 Jan 1970 00:00:00 GMT
/
cmp.osano.com/ Frame E4F0 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cmp.osano.com/
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2510:f400:3:b7e:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
46123
content-encoding
br
content-type
text/html
date
Tue, 20 Jun 2023 07:09:35 GMT
etag
W/"287b497c992487af362d33204f87d28f"
last-modified
Thu, 21 Oct 2021 22:01:08 GMT
referrer-policy
strict-origin-when-cross-origin
server
AmazonS3
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Accept-Encoding Origin
via
1.1 5ba825173b1f7429171e730e7ae12588.cloudfront.net (CloudFront)
x-amz-cf-id
CMurLHJfIbWl4hWDJ0Sh3sYW23JsG256scQ4uzYT99nwivc2Y3Sqkw==
x-amz-cf-pop
JFK50-P5
x-amz-version-id
xT1PkIFehetvNf5lINcU02FbT3u47kBr
x-cache
Hit from cloudfront
x-content-type-options
nosniff
x-xss-protection
1; mode=block
record
consent.api.osano.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://consent.api.osano.com/record
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.116.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-116-84.jfk50.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods
POST,OPTIONS
access-control-allow-origin
*
content-length
0
content-type
application/json
date
Tue, 20 Jun 2023 19:58:17 GMT
via
1.1 1d45cc40d1dd29d2b3aaefb9f85bceee.cloudfront.net (CloudFront)
x-amz-apigw-id
G1WyEF46IAMFgzw=
x-amz-cf-id
cqbOj2SykfTnyA3feiJlEn5Lz2YLETrU8-A-UA-k84YzDLhWAQTeWA==
x-amz-cf-pop
JFK50-P6
x-amzn-requestid
0383a14c-b71f-4c88-a72b-4889e10a4d94
x-cache
Miss from cloudfront
load.js
s.ntv.io/serve/ 		575 KB
157 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.ntv.io/serve/load.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.173.155 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-173-155.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
c5993f8467dfbb45dfd3f751abd48089b840da8105caca380d0bc0f8ec387b11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:17 GMT
Content-Encoding
gzip
x-amz-request-id
13HKHWSMPFVCNQJS
x-amz-server-side-encryption
AES256
Transfer-Encoding
chunked
Connection
keep-alive, Transfer-Encoding
x-amz-id-2
TvlUpPi17t6Go53nIVcJsF0sWl40yZC+BrS3oqwdakoDUJ08EqwOOWrieEHcJtCt4mkG+lraCeM=
Last-Modified
Fri, 16 Jun 2023 13:31:32 GMT
Server
AmazonS3
ETag
"9ac11617889ee511c7463118047f195a"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
a-04i4.min.js
b-code.liadm.com/ 		42 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://b-code.liadm.com/a-04i4.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:23cb:4200:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
dc0da2082ec514b4250ffe29a176826c3aef94d4ca0f887586528add66a99f16

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 06:23:34 GMT
content-encoding
gzip
via
1.1 aea539314dea6e591d10d79d61e42090.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P1
age
48883
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
"public, max-age=86400"
x-amz-cf-id
P-y6txiGSyFC6xtz0u-SNAGVhMNUCqwGLTMDOvEiYSuZrAfGSc9aEg==
beacon.js
sb.scorecardresearch.com/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.47.33 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-47-33.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1aee66e2e24e851039801c0dace90f3efb7a1a17b033f7d5bbc12ca7c1d19432

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 17:20:02 GMT
content-encoding
gzip
via
1.1 aa7ca65bca4d95ba9a04dd166671496c.cloudfront.net (CloudFront)
last-modified
Thu, 09 Mar 2023 09:22:40 GMT
server
AmazonS3
x-amz-cf-pop
JFK50-P1
age
61281
x-amz-server-side-encryption
AES256
etag
W/"a06e7a176f40dc26aa5e9567ac9d2d5e"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=86400
x-amz-cf-id
RDNlG4emCfGeRLNKj1oWXynBmZ6I6tFyRHnMLJYvkEl15FZ0qDSQ8g==
json
trc.taboola.com/medianewsgroup-mercurynews/trc/3/ 		104 KB
29 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/medianewsgroup-mercurynews/trc/3/json?tim=19%3A58%3A17.469&lti=deflated&data=%7B%22id%22%3A392%2C%22ii%22%3A%22%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22lbt%22%3A1687254511415%2C%22vi%22%3A1687291097459%2C%22cv%22%3A%2220230620-6-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%22%2C%22bv%22%3A%220%22%2C%22wc%22%3Atrue%2C%22ul%22%3A%5B%22en-US%22%2C%22en%22%5D%2C%22uad%22%3A%7B%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%7D%2C%22cmps%22%3A0%2C%22ga%22%3Afalse%2C%22ccpa_ps%22%3A%221---%22%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bu%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%22%2C%22vpi%22%3A%22%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1600%2C%22dh%22%3A6958%2C%22nsid%22%3A%22medianewsgroup-network%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A6%2C%22uim%22%3A%22thumbnails-a%3Apub%3Dmedianewsgroup-network%3Aabp%3D0%22%2C%22uip%22%3A%22Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22Below%20Article%20Thumbnails%22%2C%22cd%22%3A5182.578125%2C%22mw%22%3A954.875%7D%5D%2C%22cacheKey%22%3A%22text%3D%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2CBelow%20Article%20Thumbnails%3Dthumbnails-a%3Apub%3Dmedianewsgroup-network%3Aabp%3D0%22%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22deflated%22%7D&llvl=2
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20230620-6-RELEASE.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
35c21208c49b0522829345f46b651128b91ebd172add45203896265b49ba85b0

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

x-vcl-time-ms
769
date
Tue, 20 Jun 2023 19:58:18 GMT
content-encoding
gzip
via
1.1 varnish
x-fastly-to-nlb-rtt
9885
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version
v2
x-served-by
cache-yul12823-YUL
server
nginx
x-timer
S1687291097.480962,VS0,VE769
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
record
consent.api.osano.com/ 		0
438 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://consent.api.osano.com/record
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.116.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-116-84.jfk50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/json
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 20 Jun 2023 19:58:18 GMT
via
1.1 1d45cc40d1dd29d2b3aaefb9f85bceee.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P6
x-amzn-trace-id
Root=1-649204d9-2ca72eec3101df6c2f7060bc
x-amzn-requestid
751c09d2-b010-40a3-bee8-6f11426a911b
x-cache
Miss from cloudfront
access-control-allow-methods
POST,OPTIONS
access-control-allow-origin
*
access-control-allow-headers
Accept, Authorization, Content-Length, Content-Type, Origin, X-Requested-With
x-amz-apigw-id
G1WyEGUUoAMFdpg=
x-amz-cf-id
-NjuH-IbKdy6MOHI2hwSwNWIpwkOSg570ILgqOO3ZgFO6yxkOH8Haw==
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2c95bbac8e167a1fd9297768d9c45d1f50db54733b750ae889b3a5efd2fae8fa

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/svg+xml
css2
fonts.googleapis.com/ Frame 64D9 		3 KB
624 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Barlow:wght@400;500;600&display=swap
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
933ff38629199ba200d23e1a3afda3ca9cae06352169926a4609942ab4d3742b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:58:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 19:10:49 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 20 Jun 2023 19:58:17 GMT
ping.gif
player-files.remixd.com/ Frame 64D9 		43 B
588 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://player-files.remixd.com/ping.gif?action=playerImpression&userId=null&referrerUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&domain=mercurynews.com&adDuration=&inViewDuration=&sessionDuration=7&sessionId=b4466f91-f5a8-4c9f-8b8f-2c30b9abd201&volume=null&speed=1&position=null&mediaLength=null&isAMP=false
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
143.38.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:17 GMT
x-guploader-uploadid
ADPycdu9Ey6FtxLO1BQbwv0G_l0T1vGF2ahxZVGSSNrkgBwfUY5nHWh79gVwp3MQgvXuRe4kZ0ZDv1o51uF8F-lYIrZLVYBU7MrQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Wed, 23 Oct 2019 15:45:02 GMT
server
UploadServer
etag
"cc8f8e28fe4d3aa85ca835a029fe08a5"
x-goog-generation
1571845502045744
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=CskzBw==, md5=zI+OKP5NOqhcqDWgKf4IpQ==
access-control-expose-headers
Content-Type
cache-control
no-cache, no-store, must-revalidate
x-goog-stored-content-length
43
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:58:17 GMT
ping.gif
player-files.remixd.com/ Frame 64D9 		43 B
195 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://player-files.remixd.com/ping.gif?action=loading&userId=null&referrerUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&domain=mercurynews.com&adDuration=&inViewDuration=&sessionDuration=8&sessionId=b4466f91-f5a8-4c9f-8b8f-2c30b9abd201&volume=null&speed=1&position=null&mediaLength=null&isAMP=false
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
143.38.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:17 GMT
x-guploader-uploadid
ADPycdsT2aXirjw_j5H18bbNiR7jppr-aNTXhsy9KwW81SjeCZser78Fguqn_lxvKrhNypQlLpcp5wMx5jQ44Bj0k9ksoAyla_GR
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Wed, 23 Oct 2019 15:45:02 GMT
server
UploadServer
etag
"cc8f8e28fe4d3aa85ca835a029fe08a5"
x-goog-generation
1571845502045744
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=CskzBw==, md5=zI+OKP5NOqhcqDWgKf4IpQ==
access-control-expose-headers
Content-Type
cache-control
no-cache, no-store, must-revalidate
x-goog-stored-content-length
43
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:58:17 GMT
ping.gif
player-files.remixd.com/ Frame 64D9 		43 B
199 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://player-files.remixd.com/ping.gif?action=loaded&userId=null&referrerUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&domain=mercurynews.com&adDuration=&inViewDuration=&sessionDuration=9&sessionId=b4466f91-f5a8-4c9f-8b8f-2c30b9abd201&volume=null&speed=1&position=null&mediaLength=null&isAMP=false
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
143.38.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:17 GMT
x-guploader-uploadid
ADPycdunjd8ZR9mmC_Gfh6JSJHYQT9PjQle9pYNHERVHiyO_OiRf2f84RBTpRGsVAF7pTynuUVHQxWGVxjUICFj3gxiP2CKIM0Z4
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Wed, 23 Oct 2019 15:45:02 GMT
server
UploadServer
etag
"cc8f8e28fe4d3aa85ca835a029fe08a5"
x-goog-generation
1571845502045744
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=CskzBw==, md5=zI+OKP5NOqhcqDWgKf4IpQ==
access-control-expose-headers
Content-Type
cache-control
no-cache, no-store, must-revalidate
x-goog-stored-content-length
43
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:58:17 GMT
card-interference-detector.20230620-6-RELEASE.es6.js
cdn.taboola.com/libtrc/ 		5 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/card-interference-detector.20230620-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2aa50c9706f2175ff0a141b65a82f4c0a8907f75779f00d9d29d31a09c58121f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
d9g80bYGwlrI5Ugcc2XKm7V6T0Er6clB
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:58:17 GMT
x-amz-request-id
RM19DYDTDKDAXYEN
age
34474
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
2179
x-amz-id-2
LfgJThIAG/Fwcv5cOwYkq/rGd15anZbnC67Rtnx4zr6ZNOJdBGBTqY5GenmjLzGElZzdRQ1KIFA=
x-served-by
cache-yul12823-YUL
last-modified
Tue, 20 Jun 2023 10:23:43 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687291098.618835,VS0,VE0
etag
"72624d6dc4cb1ef95c5884952b9a75a2"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
93
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
14983
wrap.js
cdn.confiant-integrations.net/gptprebidnative/202305161109/ 		247 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.confiant-integrations.net/gptprebidnative/202305161109/wrap.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:220a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a9b8757ef83403b67a3f6d10da0c8f4259179fe48a775020aeb65ab9e1791cc3

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:17 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 16 May 2023 15:12:41 GMT
server
cloudflare
x-amz-request-id
FT4HVGQB7CCRFX0J
age
3037117
etag
W/"c445da83949e16f2c7f56d37a9f719f0"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
cf-ray
7da695f008ed4bb8-YUL
alt-svc
h3=":443"; ma=86400
x-amz-id-2
nO4SmJlCFWE3tYLd1eHTnRzftKXrxOvU4kwqYbbPBc9j7s8g5EWJxiHO9/oA0MLoZxzVGL5i6BU=
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/?random=1687291097069&cv=11&fst=1687291097069&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&hn=www.googleadservices.com&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&us_privacy=1---&auid=337517794.1687291097&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
99c47758a036d48e79e2e9eecf9c9d6ffd5c6774b1c8a853b6ea04181349e60e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:17 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1435
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
launchpad.bundle.js
launchpad.privacymanager.io/1/ 		25 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://launchpad.privacymanager.io/1/launchpad.bundle.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.116.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-116-107.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b9d318b3157ccbfc3bb00e82a446613294f9a592c01537662386bd848882b7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
IBczV1acfLsLLKzHm11PkizTXPxE9_cH
content-encoding
br
via
1.1 a0be26685e47d6d6220ccd40bc5f0a4e.cloudfront.net (CloudFront)
date
Tue, 20 Jun 2023 19:42:36 GMT
x-amz-cf-pop
JFK50-P6
age
942
x-amz-server-side-encryption
AES256
x-amz-meta-codebuild-buildarn
arn:aws:codebuild:eu-west-1:469675294282:build/LaunchPadLibraryBuild-prod:f09170b2-5416-4e55-be91-38e5eec207ec
x-cache
Hit from cloudfront
x-amz-meta-codebuild-content-md5
a78f2a5a4864424e54348ce47b156abb
last-modified
Thu, 10 Mar 2022 13:10:48 GMT
server
AmazonS3
etag
W/"3e312624cdc2445a38a716f92dc3c0cd"
vary
Accept-Encoding
content-type
application/x-javascript
x-amz-meta-codebuild-content-sha256
e4ad213b137401d20a50fe1692169cc5f8b39867b6fe39afed7e307e1b9c967e
cache-control
must-revalidate,public,max-age=3600
x-amz-cf-id
LtNg5SXxNol4orEOoWWzAxp598Kne_PPXZ5X95MWrv_7rqMUzpybHw==
collect
www.google-analytics.com/g/ 		0
165 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-LMTT1ZNHB1&gtm=45je36e0&_p=1727863478&cid=1182837468.1687291098&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1687291097&sct=1&seg=0&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LMTT1ZNHB1&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:817::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:17 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
t8y9347t.min.css
cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/ 		389 KB
54 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/t8y9347t.min.css?
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/1C04) /
Resource Hash
8f5b3f7177261796d36de2d220664c09162d3877eb2e3868406c27ac952520a1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:58:17 GMT
content-encoding
gzip
content-md5
w1JcKG+K3j0xPG8xaqE6vA==
age
2406
x-cache
HIT
content-length
55210
x-ms-lease-status
unlocked
last-modified
Mon, 12 Jun 2023 07:14:24 GMT
server
ECAcc (nya/1C04)
etag
0x8DB6B14A70ACED9
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
011c085f-f01e-001a-1dab-a39661000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
a882a417-b007-431e-8cdb-0987aa50cc84
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/a882a417-b007-431e-8cdb-0987aa50cc84
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
pixel;r=432512096;labels=BayAreaNewsGroup;source=gtm;rf=0;a=p-4ctCQwtnNBNs2;url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work...
pixel.quantserve.com/ 		35 B
372 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.quantserve.com/pixel;r=432512096;labels=BayAreaNewsGroup;source=gtm;rf=0;a=p-4ctCQwtnNBNs2;url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F;uht=2;fpan=1;fpa=P0-2117583683-1687291096997;pbc=;ns=0;ce=1;qjs=1;qv=c818c8ec-20230509111053;cm=;gdpr=0;us_privacy=1---;ref=;d=mercurynews.com;dst=0;et=1687291097864;tzo=0;ogl=type.article%2Ctitle.Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20just%20%E2%80%9812%20hours%20work%252C%E2%80%99%20ex-Spotify%20e%2Curl.https%3A%2F%2Fwww%252Emercurynews%252Ecom%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd%2Cdescription.Even%20though%20Markle%20only%20produced%2012%20hours%20of%20podcast%20content%20in%202%201%2F2%20years%252C%20she%2Csite_name.The%20Mercury%20News%2Cimage.https%3A%2F%2Fwww%252Emercurynews%252Ecom%2Fwp-content%2Fuploads%2F2023%2F03%2FBritain_Royals_03732-1%252Ejp%2Cimage%3Awidth.1024%2Cimage%3Aheight.683%2Cimage%3Aalt.%2Clocale.en_US;ses=bf7c5e76-545d-4054-b40c-352c7f098c7c;mdl=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800b:21:a021:b886:81cc:55cf , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:17 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type
image/gif
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
e6cea257-c2cd-4974-b3aa-4d1017d13c9c
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/e6cea257-c2cd-4974-b3aa-4d1017d13c9c
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
integrator.js
adservice.google.com/adsid/ 		107 B
456 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.mercurynews.com
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80b::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		94 KB
18 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3467493086232492&correlator=1722184357575493&eid=31073560%2C31075027%2C31075065%2C31074793%2C31070232&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Csponsorship_1%2Cinterstitial%2Ctop_leaderboard%2Coutstream_video%2Ccube1_rrail_atf&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2C%2F0%2F1%2F2%2F3%2F5%2C%2F0%2F1%2F2%2F3%2F6%2C%2F0%2F1%2F2%2F3%2F7%2C%2F0%2F1%2F2%2F3%2F8&prev_iu_szs=300x50%7C320x50%2C1x1%2C728x90%7C970x90%7C970x250%2C480x360%2C300x250%7C300x600%7C300x1050%7C160x600&ifi=1&adks=1140109686%2C3360478133%2C142133714%2C824671996%2C2052175676&didk=1622125026~356144529~303353385~359666826~302492128&sfv=1-0-40&prev_scp=pos%3DSponsorship_1%7Cpos%3Dinterstitial%7Cpos%3Dtop_leaderboard%7Cpos%3DOutstream_Video%7Cpos%3DCube1_RRail_ATF&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D425393090679%26rurl%3D%26articleid%3D9968021&sc=1&cookie_enabled=1&abxe=1&dt=1687291097961&lmt=1687291097&dlt=1687291095117&idt=2133&adxs=1144%2C160%2C436%2C397%2C1138&adys=79%2C242%2C368%2C2605%2C874&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C1%7C0&ucis=1%7C2%7C3%7C4%7C5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=300x0%7C1x0%7C728x0%7C711x0%7C300x0&msz=300x0%7C1x0%7C728x0%7C711x0%7C300x0&fws=4%2C4%2C4%2C4%2C4&ohw=501%2C1%2C1280%2C711%2C304&ga_vid=1182837468.1687291098&ga_sid=1687291098&ga_hid=1727863478&ga_fc=true&a3p=EhkKCnB1YmNpZC5vcmcYk-aL040xSABSAghqEh0KDmVzcC5jcml0ZW8uY29tGP3hi9ONMUgAUgIIZBIZCgp1aWRhcGkuY29tGP3hi9ONMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Y_OGL040xSABSAghk&dblt=testdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdata
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e290f9c19dfad3c2315c85940a7a71eaf7c05a66339b46cdcd4aa35a757122a9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:18 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
18005
x-xss-protection
0
google-lineitem-id
-1,-2,-1,-2,6159522902
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-1,-2,-1,-2,138413520352
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 4AF3 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:18 GMT
expires
Wed, 19 Jun 2024 19:58:18 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
7cHqv4kjgoGqM7E3_-gs51os.woff2
fonts.gstatic.com/s/barlow/v12/ Frame 64D9 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3_-gs51os.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:wght@400;500;600&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 17 Jun 2023 17:16:40 GMT
x-content-type-options
nosniff
age
268897
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20960
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 19:18:28 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 16 Jun 2024 17:16:40 GMT
7cHpv4kjgoGqM7E_DMs5.woff2
fonts.gstatic.com/s/barlow/v12/ Frame 64D9 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlow/v12/7cHpv4kjgoGqM7E_DMs5.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:wght@400;500;600&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c9c80a6c32c0619d61c28f28723e68c5f8f75163e77ee5cf64c39e640e0d71e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 17 Jun 2023 08:12:48 GMT
x-content-type-options
nosniff
age
301529
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
21144
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 19:43:23 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 16 Jun 2024 08:12:48 GMT
1x1-pixel.png
ams-pageview-public.s3.amazonaws.com/ 		68 B
448 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ams-pageview-public.s3.amazonaws.com/1x1-pixel.png?id=1a461e4fcca4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.231.171.65 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:19 GMT
Last-Modified
Mon, 26 Oct 2020 16:52:19 GMT
Server
AmazonS3
x-amz-request-id
29TJDE32773RM93F
ETag
"91e42db1c66c0b276abf6234dc50b2eb"
Content-Type
image/png
Cache-Control
no-store
Accept-Ranges
bytes
Content-Length
68
x-amz-id-2
3eC2RwAYAbKFiIoP6x6PRD1nlGqR6jFZCBtqdUwaOAytj1QhyGavsA1/wmjDQjFwXQntCdP5Ia0=
self
api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/ 		613 B
794 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/self?_=1687291098002
Requested by
Host: fp-cdn.azureedge.net
URL: https://fp-cdn.azureedge.net/prod/dfm/fp.min.js?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.75.166 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab7ff044ec2e95bca736f374cf86af08c260384fbcf871032bd54e2b4ef509a9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:18 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 20 Jun 2023 19:58:18 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zu9RYa7A0Idw5BTi0qwanLloy0zGa1Ey4lINnkqM2sY9BOUi2nAqLO9Ka%2B%2F2iG3Jf7SnYXb9N30CKYh8XAmqzlcIQ4OsKlqtAFV%2FLFq%2B8PjF5diLUiWTGF%2BAXMkBu%2Fg%2F0XIJ"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=1800
cf-ray
7da695f30d4ec44f-EWR
alt-svc
h3=":443"; ma=86400
ai.0.js
az416426.vo.msecnd.net/scripts/a/ 		94 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:17a5:191a:18d5:537:22f9 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/79DC) /
Resource Hash
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:58:18 GMT
content-encoding
gzip
x-ms-meta-lastmodified
2020-10-01 19:31:04
content-md5
HdY95yzx9wIyQkVEGES+Ew==
age
133
x-cache
HIT
content-length
22495
x-ms-lease-status
unlocked
last-modified
Thu, 11 Mar 2021 07:46:59 GMT
server
ECAcc (nya/79DC)
etag
0x8D8E461DA1A5889
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
1ded4b5b-801e-002a-3fb1-a307ad000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=1800
x-ms-version
2009-09-19
expires
Tue, 20 Jun 2023 20:28:18 GMT
index.js
cdn.pranmcpkx.com/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.pranmcpkx.com/index.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/7991) /
Resource Hash
6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:58:18 GMT
content-encoding
gzip
content-md5
nynBpfvYghYqzIzsvfssRw==
age
207320
x-cache
HIT
content-length
2382
x-ms-lease-status
unlocked
last-modified
Fri, 17 Jun 2022 17:08:13 GMT
server
ECAcc (nya/7991)
etag
0x8DA5083F65AD9E0
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
x-ms-request-id
771178af-101e-005f-22ce-a14382000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
DFM__BANGWPPRODWAB__MERC.json
cdn.czx5eyk0exbhwp43ya.biz/prod/data/dfm/ 		521 KB
522 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.czx5eyk0exbhwp43ya.biz/prod/data/dfm/DFM__BANGWPPRODWAB__MERC.json?_=1687291098074
Requested by
Host: cdn.czx5eyk0exbhwp43ya.biz
URL: https://cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/t8y9347t.min.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
2943a138fb8248f4ef8d8ac14a988ef46f8bb5d3aa964ff227082c1651e46dbf

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
AppendBlob
date
Tue, 20 Jun 2023 19:58:17 GMT
last-modified
Wed, 14 Jun 2023 20:35:44 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-committed-block-count
1
etag
0x8DB6D16EDC2DB4F
content-type
application/octet-stream
access-control-allow-origin
*
x-ms-request-id
5b262f9e-b01e-0034-7db1-a3c476000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,x-ms-blob-committed-block-count,Content-Length,Date,Transfer-Encoding
cache-control
no-cache
x-ms-version
2009-09-19
content-length
533460
ad_300_250.jpg
paywall-ad-bucket.s3.amazonaws.com/ 		631 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://paywall-ad-bucket.s3.amazonaws.com/ad_300_250.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.5.10.155 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:19 GMT
Last-Modified
Tue, 15 Oct 2019 13:44:16 GMT
Server
AmazonS3
x-amz-request-id
29TNSZ16S0TG2AAK
ETag
"ef2cc7f55b7ab677b023e36033e26471"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
631
x-amz-id-2
KRihDkXvNDTt3YRlSyiU8NMm+XVjInWwkjwGDGtuO4F+bL0+q0x3L6oV8S2hfyOQbUjSEXg2y0c2LdEyqy0BUw==
x-amz-meta-s3b-last-modified
20191015T134358Z
tag
s.thebrighttag.com/ 		14 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.thebrighttag.com/tag?site=t4tmU86&H=-2umnyqz
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.12.100.41 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-12-100-41.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
f67c1dae64731f037f0dcd7598af600024c9546bbdeed1c9f7185b027ef65bb4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:18 GMT
x-bt-requestid
cced9700-0fa4-11ee-b5da-0000ac1701bb
server
nginx
etag
ea073f4c32be2f10a6117ca27c31b8e7
content-type
text/javascript
access-control-allow-origin
https://www.mercurynews.com
p3p
CP=NOI DSP COR NID
cache-control
private, must-revalidate
content-length
14502
expires
Thu, 01 Jan 1970 00:00:00 GMT
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=pv&page=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&artid=9968021&artpubt=1687284760&artsrc=Bay%20Area%20News%20Group&arttype=free&artupt=1687287137&auth=Martha%20Ross&chrcnt=5021&cms=WP&hier=Entertainment%7CThings%20To%20Do&ptype=article&pubname=The%20Mercury%20News&sec=Entertainment&wrdcnt=801&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=b001bfd2-6bf8-4383-9e4c-0b15407dcc61&pid=96430c62-9e9b-4e9e-9c51-bae8ae4a6a48&dtm=1687291098140&qnm=_matherq&visible=1&tabid=a2cbfdc5-fc55-4203-bb3e-307d8f7af5bb&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&vp=1600x1200&ds=1600x6958&tofa=1687291098&vid=1&lvidt=1687291098&duid=db7bf053-61e0-4111-899e-812311da85ef&fp=967226427&cid=ma23578&mrk=239876506&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTY4NzI5MTA5NDgxMSIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiI0Mi4xbWIiLCJoZWFwVCI6IjcyLjJtYiIsImZzdFBhaW50IjoiMTEzNiIsImZldGNoUyI6IjM4IiwiZG9tYWluUyI6IjM5IiwiZG9tYWluRSI6IjM5IiwiY29ublMiOiIzOSIsImNvbm5FIjoiNzUiLCJzc2xTIjoiNTUiLCJyZXF1UyI6Ijc1IiwicmVzcFMiOiIzMDEiLCJyZXNwRSI6IjMzNyIsImRvbUxvYWQiOiIzMDYiLCJkb21JbnRlciI6IjE4NTEiLCJkb21Mb2FkUyI6IjE4OTkiLCJkb21Mb2FkRSI6IjE5NDYifSwiaWRlbnRpdGllcyI6W3sidHlwZSI6ImdhIiwiaWQiOiIxMTgyODM3NDY4IiwicmVmVGltZSI6IjE2ODcyOTEwOTgxMzkifV0sImNhdGVnb3J5Ijp7ImNhdGVnb3JpZXMiOltbIkVudGVydGFpbm1lbnQiLCJUaGluZ3MgVG8gRG8iXV19LCJhdXRoMF9zdWIiOiIiLCJhdWRpZW5jZSI6W3sicHJvdmlkZXIiOiJ1c2VyREIiLCJzZWdtZW50cyI6WyJNQVRIRVJfVTlfSU5TVEFOVEJfMjAyMDAyMDMiXSwicGFnZUlkIjoiOTY0MzBjNjItOWU5Yi00ZTllLTljNTEtYmFlOGFlNGE2YTQ4In0seyJwcm92aWRlciI6ImlTZWdzIiwic2VnbWVudHMiOlsiTUFUSEVSX1U5X0lOU1RBTlRCXzIwMjAwMjAzIl0sInBhZ2VJZCI6Ijk2NDMwYzYyLTllOWItNGU5ZS05YzUxLWJhZThhZTRhNmE0OCJ9XX0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.162.81.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-162-81-74.compute-1.amazonaws.com
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date
Tue, 20 Jun 2023 19:58:18 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
increment
id5-sync.com/api/esp/ 		0
328 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/api/esp/increment?counter=no-config
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.119 , France, ASN16276 (OVH, FR),
Reverse DNS
ns31533570.ip-162-19-138.eu
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:58:18 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-credentials
true
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
iu3
s.amazon-adsystem.com/ Frame 0B2E
Redirect Chain
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
373 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
19cf792a649556b6e99d788a69b1e501dc0748c010896e4fd4081eca8ab0983c
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
373
Content-Type
text/html;charset=ISO-8859-1
Date
Tue, 20 Jun 2023 19:58:18 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid
BBS2CNT8V9D69SC0XXJY

Redirect headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:18 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Location
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid
EAGV1JN2SE7T8HB85HEY
t
jadserve.postrelease.com/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://jadserve.postrelease.com/t?ntv_url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ntv_mvi&us_privacy=1---
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.228.62.117 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-228-62-117.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
1daff9b550fa13c5747e554b1913fd7da9c8c52a504ab47b1ed0f63e08fae8dd

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:18 GMT
content-encoding
gzip
server
nginx/1.12.2
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
1449
expires
Mon, 1 Jan 1990 12:00:00 GMT
3bedf50f-48e2-46fd-a065-c97bb11317b3
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/3bedf50f-48e2-46fd-a065-c97bb11317b3
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
b
sb.scorecardresearch.com/ 		0
320 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b?c1=7&c2=34354936&cs_it=b9&cv=4.0.0%2B2301240627&ns__t=1687291098383&ns_c=UTF-8&c3=1&gdpr=0&gdpr_p1t=&gdpr_li=&gdpr_purps=&gdpr_pcc=&cs_cmp_nc=0&cs_cmp_id=279&cs_cmp_sv=1707&cs_cmp_rt=1&c7=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c9=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.47.33 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-47-33.jfk50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:18 GMT
via
1.1 aa7ca65bca4d95ba9a04dd166671496c.cloudfront.net (CloudFront)
accept-ch
UA, Platform, Arch, Model, Mobile
x-amz-cf-pop
JFK50-P1
x-amz-cf-id
qiHbp7Ja4J-Q8fSvoD5wHLBJLMkOncWWF7ArUwUq00F6L1YdK4adEw==
x-cache
Miss from cloudfront
fddc5adb29bdf95c848ea54469cf60a5
a869.mercurynews.com/templates/ 		479 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/templates/fddc5adb29bdf95c848ea54469cf60a5
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
2f218987261e49e368f7f85f9e5bf66f49f62032e96bb064c43064df8fc4e2fd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 26 Mar 2023 19:28:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 82139f26335f87e45d45c08d5208817a.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
age
7432202
x-cache
Hit from cloudfront
p3p
policyref="", CP="DSP"
content-length
71125
x-xss-protection
1; mode=block
last-modified
Sat, 25 Mar 2023 19:28:16 GMT
server
-
etag
fddc5adb29bdf95c848ea54469cf60a5
content-type
text/javascript; charset=utf-8
cache-control
public, no-cache="Set-Cookie", max-age=31536000
x-robots-tag
noindex, nofollow
x-amz-cf-id
DmfVc7T8IPSwbVHI89g825cTIodZsiUhuOtFLcgEDPxvc80x76PwDg==
expires
Mon, 25 Mar 2024 19:28:16 GMT
354
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		139 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/354?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=be399aa0-132e-4391-a831-8e5d0bef06ab&overruleReferrer=&time=2023-06-20T19%3A58%3A18%2B00%3A00&ts=1687291098538
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
2a8bef1574342093b7a1f8057984f7e606eac758d05d1d08ec9ff728e97c53e4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:58:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 82139f26335f87e45d45c08d5208817a.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
144
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
57okDpFCPVjhCUkujIKW_-k_y0R6OnsZdekEH-rYnYAh6SW_2W3Z8Q==
expires
Thu, 01 Jan 1970 00:00:00 GMT
fbevents.js
connect.facebook.net/en_US/ 		108 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
64816ef42196992f1120608cafa36df8e03c81064551abb6f23bc00f69bf6727
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Tue, 20 Jun 2023 19:58:18 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
27810
x-xss-protection
0
pragma
public
x-fb-debug
0fscqmtO4yR3X3U9rjLumfb8SBqNipvI/0bywb9nIsTLrNi+m2OPZbzoqrYQL4ASWTDboc9PW1omLkpGa3djVg==
x-fb-trip-id
1679558926
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
stats
a869.mercurynews.com/rest/recommendations/ 		14 B
856 B 		Script
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/rest/recommendations/stats?storeId=0595003b-1825-43bc-89bd-9877ca21042f&action=view&itemId=9968021&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&profileId=undefined&isEntrypage=true&hash=788aeb3068b96c1677f6d8b260dbf322&lastmodified=1687284760000&referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&&callback=bc_json357
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
c9a5de87df1a5954c5cdae18f6fc369eb606102c6410bc789452c3275f0a6b19
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 82139f26335f87e45d45c08d5208817a.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
34
x-xss-protection
1; mode=block
pragma
no-cache
server
-
content-type
text/javascript;charset=utf-8
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
x-amz-cf-id
um7V3jG5C5HqF51CtY9j0PO0eD--zhtDTFQAidd6cDdkPb-xNrMF7A==
expires
Thu, 01 Jan 1970 00:00:00 GMT
354
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		565 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/354?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=be399aa0-132e-4391-a831-8e5d0bef06ab&overruleReferrer=&time=2023-06-20T19%3A58%3A18%2B00%3A00&ts=1687291098610
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
f12d6fbc698a86e031a02ec633dbb80274af370c201d2fe6fe9b1ee1fbbdbfaa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:58:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 82139f26335f87e45d45c08d5208817a.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
182
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
EVriIKa-0XTk6pmpLZhaVz_XQVo7_XSwIlFrIcnHWM2Nkt8YpjKS1A==
expires
Thu, 01 Jan 1970 00:00:00 GMT
354
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		189 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/354?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=be399aa0-132e-4391-a831-8e5d0bef06ab&overruleReferrer=&time=2023-06-20T19%3A58%3A18%2B00%3A00&ts=1687291098612
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
8f5f1bdf5f885e2067bfadab47400a17837840c9752225204c8005eb1bb441ab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:58:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 82139f26335f87e45d45c08d5208817a.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
169
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
71k23i7txzkLprI2tKU1ac1JWi8-V2MsweO1fqrGNzxPsqOlA9u-Wg==
expires
Thu, 01 Jan 1970 00:00:00 GMT
354
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		377 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/354?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=be399aa0-132e-4391-a831-8e5d0bef06ab&overruleReferrer=&time=2023-06-20T19%3A58%3A18%2B00%3A00&ts=1687291098613
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
eccd3e6ef939c2a2e18a7c4bc6a4f386da8b4c131ae3d4b8c1647d8c73999142
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:58:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 82139f26335f87e45d45c08d5208817a.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
179
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
Oh16CCbgRb8JbjrWMEsaLWNfAVMQZOSlPAQpq-DVa09pv6JMLmAC_g==
expires
Thu, 01 Jan 1970 00:00:00 GMT
354
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		5 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/354?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=be399aa0-132e-4391-a831-8e5d0bef06ab&overruleReferrer=&time=2023-06-20T19%3A58%3A18%2B00%3A00&ts=1687291098614
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
9acbf281eb40cf5cfe6f99004de5947dde55323b73244206ef2003aa7114380f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:58:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 82139f26335f87e45d45c08d5208817a.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
2531
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
QrzJ8DO_Qupy4FOgmsvBQGKOA9_6tlLiEXo3KpkFhBEYXEgARrpSLQ==
expires
Thu, 01 Jan 1970 00:00:00 GMT
354
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		189 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/354?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=be399aa0-132e-4391-a831-8e5d0bef06ab&overruleReferrer=&time=2023-06-20T19%3A58%3A18%2B00%3A00&ts=1687291098623
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
ce0b2808278fa694a3c6c1f14a34b316b59cc54bd6d344d5b055ebd671ae9b18
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:58:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 82139f26335f87e45d45c08d5208817a.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
169
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
slcNpjITdtqwEFx_biwe0qOluuHLNpxwGpwdYBZ-b1RyXywiTsFP3g==
expires
Thu, 01 Jan 1970 00:00:00 GMT
UnitFeedManagerDesktop.min.js
vidstat.taboola.com/lite-unit/4.0.3/ 		111 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vidstat.taboola.com/lite-unit/4.0.3/UnitFeedManagerDesktop.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5d7c5d22a81ee3d27800eb5d20b5f160efb6cf98d51dd1f0cca7485442f2c5f4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:18 GMT
via
1.1 f7a96eacae195ce7e3982601464ebc84.cloudfront.net (CloudFront), 1.1 varnish
content-encoding
gzip
x-amz-cf-pop
YUL62-C2
age
298340
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront, HIT
content-length
31102
x-served-by
cache-yul12823-YUL
last-modified
Sat, 17 Jun 2023 09:04:57 GMT
server
AmazonS3
x-timer
S1687291099.689423,VS0,VE0
etag
"435321ac6c80e1f99bad06be26443aea"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
access-control-allow-headers
*
x-amz-cf-id
DJI9H3HB2ZBtlODFjPVGyDvtMp7Sb9id-ET8zNYWgt8gkUOaHGw2dw==
x-cache-hits
38692
abtests
us-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 		0
363 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/abtests?route=US:US:V&tvi2=10443&lti=deflated&ri=ef1a9f6868acd5f81e84502a73de53bf&sd=v2_4e2b613193d39d9d4e8bc370cab467bb_cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59_1687291097_1687291097_CNawjgYQtdRXGPPii9ONMSABKAEwJjiJ6AdA6vUHSKfL2QNQ____________AVgAYABosrWxmb6uzo3eAXAB&ui=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1687291097459&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22block_clicks_init%22%2C%22type%22%3A%22block-clicks-manager%22%2C%22eventTime%22%3A1687291098709%7D&tim=19%3A58%3A18.710&id=2196&llvl=2&cv=20230620-6-RELEASE&
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:18 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
f89e1763-220d-4e09-ba69-9e040548fb7a.svg
cdn.taboola.com/static/f8/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.taboola.com/static/f8/f89e1763-220d-4e09-ba69-9e040548fb7a.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
39b076e4bb4fab9b8a142499cf6155f8c128464974691a04de7e764f71b72618

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
cMrDKn.emLmm9kiiOOF64ulDT4DRy6LK
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:58:18 GMT
x-amz-request-id
1WXHZHV9CYFTY3ST
age
6
x-cache
HIT
x-amz-replication-status
COMPLETED
content-length
1758
x-amz-id-2
bUPdSs4j+mPoZz3Ml6xJTa9yKEZ2BgGVNNlpevohzqj538r2xWRaj77or1rkPi+p3r0JnMyGX4E=
x-served-by
cache-yul12823-YUL
last-modified
Wed, 07 Feb 2018 11:15:52 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687291099.792078,VS0,VE0
etag
"b8b410e4b18d45aa2f3d9bc09cd335fb"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/svg+xml
access-control-allow-origin
*
abp
93
cache-control
private,max-age=31536000
accept-ranges
bytes
access-control-allow-headers
*
x-cache-hits
6
d0d92425-1292-41f3-8a81-ae3f20cb29a4
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/d0d92425-1292-41f3-8a81-ae3f20cb29a4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/?random=1687291097548&cv=11&fst=1687291097548&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&hn=www.googleadservices.com&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&us_privacy=1---&auid=337517794.1687291097&uamb=0&uaw=0&data=event%3Daudio_article_loaded%3Bevent_category%3DAudio%20Article%3Bevent_label%3DAudio%20Article%20Player&rfmt=3&fmt=4
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
95b1a4f10a67530bf1dcc8d046add868fdca02845b8fd809997a0373a6dc6d02
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:18 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1471
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D279 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:18 GMT
expires
Wed, 19 Jun 2024 19:58:18 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
container.html
7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 0637 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:18 GMT
expires
Wed, 19 Jun 2024 19:58:18 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
view
securepubads.g.doubleclick.net/pcs/ Frame 71C7 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssJyWnsuurZc2LqaR14z6wA776WoZNDybCMfVInAu6rBRrx_ENRVG8VPeavLbwe3acWBp-pJYztT62njSpQHHyFYZvVdy4G7i8gQr-roOiuY5fzuAqyrX17_i0DUS1kF91vf2BqyzFLwQtiELbjrmkjJJubkraGdz-HBzuKEtezjSHQtvmcFU0LUbBS-VKlo6Hx_NH4uK8mu0-oAP10q9Sb9Cp_VKa-yTJBY1Seg5Ki8ldtxIZeCU2TWak_ivyDU55PxGj00LzySgLVLvYywUk9zjiZ5yp9bdMgwZ2-D6QffjUTbhPmIIc6BDwH2EpqHr8Lcf7JVDC1DJl9-S6nByPeZAZnhSRQ7pLwooJnqrbzfgPzxEleRuqQoNa_qEVLEpD-NlUW&sai=AMfl-YTiGc4dwoRa7QMjgcEQzSkO1n8J5zTneY7xBLai9mRsc3U1I7El14RP75sSPR1UiRbt3MO0tXu-Ur9AsTbH2rRMD-2e5hci3h8BYVqQwut_qCVkEcbQmYlIDofrgQ&sig=Cg0ArKJSzN3wzjKlHSV_EAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:19 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
ttj
secure.adnxs.com/ Frame 71C7 		7 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/ttj?id=28334192
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.181.211 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
1b18243b0fdaf9606ab14ee6891cb75119a94eff82eb28aae9a99044e73c67c7
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:19 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
15b9690c-3187-4a37-a399-56a29a9a7da3
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 71C7 		178 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57029
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1686742752845198"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:58:19 GMT
moatad.js
js.moatads.com/bangdfp107159576598/ Frame 71C7 		0
442 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js.moatads.com/bangdfp107159576598/moatad.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.44.133.37 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-44-133-37.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Unused62
8096267
Date
Tue, 20 Jun 2023 19:58:19 GMT
Last-Modified
Mon, 14 May 2018 18:19:42 GMT
Server
AmazonS3
x-amz-request-id
5QDD9FPYKA8WKE4H
ETag
"d41d8cd98f00b204e9800998ecf8427e"
Content-Type
application/x-javascript
Cache-Control
max-age=54687
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
x-amz-id-2
bDH2EEe2x2jwNFdEqZfUhAjXWMzjIl7/1Za37ePqTI/E8v5N2qnVAsEFfvcAEZi0xHwbRpCIs44=
pixel
protected-by.clarium.io/ Frame 71C7 		68 B
244 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzMxMTE3MjA4NDM6MzAweDI1MA==&v=5&s=v31h3d65tsv&id=eyJkZnAiOnsiYWQiOjUyMzM1MDI2MzYsImMiOjEzODQxMzUyMDM1MiwibCI6NjE1OTUyMjkwMiwibyI6MzExMTcyMDg0MywiQSI6Ii84MDEzL21lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC9jdWJlMV9ycmFpbF9hdGYiLCJ5IjowLCJjbyI6MCwicyI6Imh0bGFkLTYtZ3B0In19&cb=9127937&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6TXhNVEUzTWpBNE5ETTZNekF3ZURJMU1BPT0iLCJ3ZCI6eyJvIjozMTExNzIwODQzLCJ3IjoiMzAwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.73.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-73-233.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/png
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:19 GMT
cache-control
no-store, no-cache, must-revalidate, max-age=0
server
nginx/1.18.0 (Ubuntu)
expires
Sat, 26 Jul 1997 05:00:00 GMT
j
rp4.liadm.com/
Redirect Chain
  • https://rp.liadm.com/j?dtstmp=1687291099053&aid=a-04i4&se=e30&duid=f107d3ac6b63--01h3d65x5a82x2dqp0kjyedmwh&tna=v2.7.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-m...
  • https://rp4.liadm.com/j?dtstmp=1687291099053&aid=a-04i4&se=e30&duid=f107d3ac6b63--01h3d65x5a82x2dqp0kjyedmwh&tna=v2.7.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-...
48 B
588 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://rp4.liadm.com/j?dtstmp=1687291099053&aid=a-04i4&se=e30&duid=f107d3ac6b63--01h3d65x5a82x2dqp0kjyedmwh&tna=v2.7.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&us_privacy=1---&wpn=lc-bundle&gdpr=0&c=PHRpdGxlPk1lZ2hhbiBNYXJrbGUgZWFybmVkIG1vcmUgdGhhbiBUaGUgV2Vla25kIGZvciAnMTIgaG91cnMgd29yayc6IFNwb3RpZnk8L3RpdGxlPjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJNZWdoYW4gTWFya2xlIG9ubHkgcHJvZHVjZWQgMTIgaG91cnMgb2YgcG9kY2FzdCBjb250ZW50IGluIDLCvSB5ZWFycywgeWV0IHBvc3NpYmx5IGVhcm5lZCBtb3JlIHRoYW4gVGhlIFdlZWtuZCBmb3IgaGlzIGh1Z2UgaGl0ICdCbGluZGluZyBMaWdodHMuJyI-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzA2LzIwL21lZ2hhbi1tYXJrbGUtZWFybmVkLW1vcmUtdGhhbi10aGUtd2Vla25kLWZvci1qdXN0LTEyLWhvdXJzLXdvcmstZXgtc3BvdGlmeS1leGVjLXRlbGxzLWJiYy8iPjxoMSBjbGFzcz0ic2VjdGlvbi1oZWFkZXIiPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQ8L2E-PC9oMT48aDEgY2xhc3M9ImVudHJ5LXRpdGxlIj4KCjxkaXYgY2xhc3M9ImVudHJ5LXNlY3Rpb24iPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQgfCA8L2E-PC9kaXY-CQoJCQkJPHNwYW4gY2xhc3M9ImRmbS10aXRsZSBmcmVlIj4KCQkJTWVnaGFuIE1hcmtsZSBlYXJuZWQgbW9yZSB0aGFuIFRoZSBXZWVrbmQgZm9yIGp1c3Qg4oCYMTIgaG91cnMgd29yayzigJkgZXgtU3BvdGlmeSBleGVjIHRlbGxzIEJCQwkJPC9zcGFuPgoKCQoJPC9oMT4&i6=MjYwNzo1MzAwOjYwOjc4Njc6OjY%3D&n3pc=true
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
3.233.112.95 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-233-112-95.compute-1.amazonaws.com
Software
/
Resource Hash
db1be639c6bb1d11edb8c716a629847c3e0f5492de69797d3619b34ddd34e878
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:19 GMT
x-pixel-event-id
a92e2b16-8b5a-4f54-be7a-9697a7dbe6d6
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
strict-transport-security
max-age=31536000; includeSubDomains
x-frame-options
DENY
vary
Origin
content-type
application/json
request-time
0
access-control-allow-origin
null
access-control-allow-credentials
true
trace-id
d976df3c15b73dcc
content-length
48
x-xss-protection
1; mode=block

Redirect headers

date
Tue, 20 Jun 2023 19:58:19 GMT
strict-transport-security
max-age=31536000; includeSubDomains
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
x-frame-options
DENY
vary
Origin
location
https://rp4.liadm.com/j?dtstmp=1687291099053&aid=a-04i4&se=e30&duid=f107d3ac6b63--01h3d65x5a82x2dqp0kjyedmwh&tna=v2.7.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&us_privacy=1---&wpn=lc-bundle&gdpr=0&c=PHRpdGxlPk1lZ2hhbiBNYXJrbGUgZWFybmVkIG1vcmUgdGhhbiBUaGUgV2Vla25kIGZvciAnMTIgaG91cnMgd29yayc6IFNwb3RpZnk8L3RpdGxlPjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJNZWdoYW4gTWFya2xlIG9ubHkgcHJvZHVjZWQgMTIgaG91cnMgb2YgcG9kY2FzdCBjb250ZW50IGluIDLCvSB5ZWFycywgeWV0IHBvc3NpYmx5IGVhcm5lZCBtb3JlIHRoYW4gVGhlIFdlZWtuZCBmb3IgaGlzIGh1Z2UgaGl0ICdCbGluZGluZyBMaWdodHMuJyI-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzA2LzIwL21lZ2hhbi1tYXJrbGUtZWFybmVkLW1vcmUtdGhhbi10aGUtd2Vla25kLWZvci1qdXN0LTEyLWhvdXJzLXdvcmstZXgtc3BvdGlmeS1leGVjLXRlbGxzLWJiYy8iPjxoMSBjbGFzcz0ic2VjdGlvbi1oZWFkZXIiPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQ8L2E-PC9oMT48aDEgY2xhc3M9ImVudHJ5LXRpdGxlIj4KCjxkaXYgY2xhc3M9ImVudHJ5LXNlY3Rpb24iPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQgfCA8L2E-PC9kaXY-CQoJCQkJPHNwYW4gY2xhc3M9ImRmbS10aXRsZSBmcmVlIj4KCQkJTWVnaGFuIE1hcmtsZSBlYXJuZWQgbW9yZSB0aGFuIFRoZSBXZWVrbmQgZm9yIGp1c3Qg4oCYMTIgaG91cnMgd29yayzigJkgZXgtU3BvdGlmeSBleGVjIHRlbGxzIEJCQwkJPC9zcGFuPgoKCQoJPC9oMT4&i6=MjYwNzo1MzAwOjYwOjc4Njc6OjY%3D&n3pc=true
access-control-allow-origin
https://www.mercurynews.com
request-time
0
access-control-allow-credentials
true
trace-id
b0d9b083e80e1db7
content-length
0
x-xss-protection
1; mode=block
linkid.js
www.google-analytics.com/plugins/ua/ 		2 KB
722 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:59:38 GMT
content-encoding
br
x-content-type-options
nosniff
age
3521
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
697
x-xss-protection
0
last-modified
Wed, 14 Jun 2023 09:18:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Tue, 20 Jun 2023 19:59:38 GMT
social
us-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 		0
362 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/social?route=US:US:V&tvi2=10443&lti=deflated&ri=ef1a9f6868acd5f81e84502a73de53bf&sd=v2_4e2b613193d39d9d4e8bc370cab467bb_cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59_1687291097_1687291097_CNawjgYQtdRXGPPii9ONMSABKAEwJjiJ6AdA6vUHSKfL2QNQ____________AVgAYABosrWxmb6uzo3eAXAB&ui=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1687291097459&st=social-available&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22ctx%22%2C%22ism%22%3Afalse%2C%22srx%22%3A1600%2C%22sry%22%3A1200%2C%22pd%22%3Anull%2C%22tpl%22%3A%22%22%2C%22url%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%22%2C%22rref%22%3A%22%22%2C%22sref%22%3A%22_sessionPending_%22%2C%22hdl%22%3A%22Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20just%20%E2%80%9812%20hours%20work%2C%E2%80%99%20ex-Spotify%20exec%20tells%20BBC%22%2C%22sec%22%3A%22Entertainment%22%2C%22aut%22%3A%5B%22Martha%20Ross%22%5D%2C%22img%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2Fwp-content%2Fuploads%2F2023%2F03%2FBritain_Royals_03732-1.jpg%3Fw%3D1024%22%2C%22v%22%3A15%2C%22pw%22%3Afalse%7D%5D%7D&tim=19%3A58%3A19.063&id=7425&llvl=2&cv=20230620-6-RELEASE&
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:19 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
bbd3ea2a3deb46e5998cba5a80cf3182.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bbd3ea2a3deb46e5998cba5a80cf3182.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
12f6b13444fa341ce86121f27aae27f4e5cc214a6d55117c5669114cce37af75

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:58:19 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bbd3ea2a3deb46e5998cba5a80cf3182.jpg
age
1119361
edge-cache-tag
434270000850537930009311514879257789769,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
434270000850537930009311514879257789769,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time
75
expiration
expiry-date="Sun, 25 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.cbsnews.com/
content-length
6882
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb804
x-served-by
cache-iad-kiad7000066-IAD, cache-iad-kiad7000085-IAD, cache-chi-klot8100156-CHI, cache-iad-kiad7000024-IAD, cache-yul12823-YUL
last-modified
Thu, 25 May 2023 13:13:24 GMT
server
nginx
x-timer
S1687291099.094218,VS0,VE0
etag
"bfeb60616945c4cfea57051d0c382962"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 0, 1816, 2
1791c9fa81a2a54a4641becd20be4b3e.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1791c9fa81a2a54a4641becd20be4b3e.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
8ef928fdfb8f3eeb4227af511515120e98219ce1326c45212eaecdad5cc8ae7a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:58:19 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1791c9fa81a2a54a4641becd20be4b3e.jpg
age
640686
edge-cache-tag
402188373656136331886263197554274643949,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
402188373656136331886263197554274643949,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, MISS, MISS, HIT
x-envoy-upstream-service-time
158
expiration
expiry-date="Fri, 23 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.iflscience.com/
content-length
6940
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb802
x-served-by
cache-iad-kcgs7200130-IAD, cache-iad-kcgs7200160-IAD, cache-lga21954-LGA, cache-iad-kjyo7100167-IAD, cache-yul12823-YUL
last-modified
Tue, 23 May 2023 14:06:11 GMT
server
nginx
x-timer
S1687291099.094051,VS0,VE0
etag
"2e9f1731206ede56933eed232641c73e"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 0, 709
354
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		11 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/354?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=be399aa0-132e-4391-a831-8e5d0bef06ab&overruleReferrer=&time=2023-06-20T19%3A58%3A19%2B00%3A00&ts=1687291099086
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
0e964e7f290a0bc0a3e2e463b0b157fa3dc58f1d5d9cca75dedbc790ad8d42aa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:58:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 82139f26335f87e45d45c08d5208817a.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
2649
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
bdeEGIp_NNwT-EDuBKMwpPgNtRuu_8swdIOZ4mhxPSFTffxaTUobsg==
expires
Thu, 01 Jan 1970 00:00:00 GMT
a90899e84e5b40721594b8ba7517e0cd.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		17 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a90899e84e5b40721594b8ba7517e0cd.jpeg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
83ae7ba0370974e803fb70ffffd92deb797d08198ed6310e207ba7d75b72029e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:58:19 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a90899e84e5b40721594b8ba7517e0cd.jpeg
age
2443241
edge-cache-tag
485668035201530982018547323808119286028,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
485668035201530982018547323808119286028,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
HIT, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time
107
req-referer
https://www.harpersbazaar.com/
content-length
17756
x-request-id
42dbadf70dd009b0df5585bf132a5dd7
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb804
x-served-by
cache-iad-kiad7000102-IAD, cache-iad-kcgs7200112-IAD, cache-chi-klot8100091-CHI, cache-iad-kiad7000063-IAD, cache-yul12823-YUL
last-modified
Fri, 05 May 2023 19:50:25 GMT
server
nginx
x-timer
S1687291099.094423,VS0,VE0
etag
"6ff1e84f0dafe001ea5f5047e2457782"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1, 0, 234, 64
bd1077109a793004d789267b56de3e3b.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		52 KB
52 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bd1077109a793004d789267b56de3e3b.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
b626c96f7181810eea07b9923387a2180b444b4c11afd95e97727990d1eb62f0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:58:19 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bd1077109a793004d789267b56de3e3b.jpg
age
1326850
edge-cache-tag
529596858949551976325957996360154879293,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
529596858949551976325957996360154879293,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
257
expiration
expiry-date="Sun, 11 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.theoaklandpress.com/
content-length
52856
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb202
x-served-by
cache-iad-kcgs7200040-IAD, cache-iad-kcgs7200074-IAD, cache-sna10730-LGB, cache-iad-kcgs7200021-IAD, cache-yul12823-YUL
last-modified
Thu, 11 May 2023 17:42:07 GMT
server
nginx
x-timer
S1687291099.108661,VS0,VE0
etag
"19597f87bac9928ba50cbffc9244fb3d"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 1, 7342, 2
9cc7eaf84d81d0a5a57cf79b8cf401f1.jpeg
images.taboola.com/taboola/image/fetch/h_323,w_580,c_fill,g_xy_center,x_720,y_557/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		24 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/h_323,w_580,c_fill,g_xy_center,x_720,y_557/http%3A//cdn.taboola.com/libtrc/static/thumbnails/9cc7eaf84d81d0a5a57cf79b8cf401f1.jpeg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
146ce9984266770e5e96199e4e59ca1fb5fede14f70758bcbf87654dac300667

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:58:19 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/h_323,w_580,c_fill,g_xy_center,x_720,y_557/http%3A//cdn.taboola.com/libtrc/static/thumbnails/9cc7eaf84d81d0a5a57cf79b8cf401f1.jpeg
age
1001044
edge-cache-tag
423741170203452711613019170260913585729,371972016300049567560374894438402955629,29ecf9b93bbf306179626feeda1fab70
cache-tag
423741170203452711613019170260913585729,371972016300049567560374894438402955629,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
50
expiration
expiry-date="Tue, 13 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.space.com/
content-length
24982
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb202
x-served-by
cache-iad-kcgs7200143-IAD, cache-iad-kiad7000149-IAD, cache-sna10728-LGB, cache-iad-kjyo7100155-IAD, cache-yul12823-YUL
last-modified
Sat, 13 May 2023 04:37:21 GMT
server
nginx
x-timer
S1687291099.111408,VS0,VE0
etag
"a9100cb9e9459aa85ec807d59901a495"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 17185, 26
20ca3920796705f4e953bd5014720ea9.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/20ca3920796705f4e953bd5014720ea9.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
df3ac0dbcf2d632d347eedf170353a58fe7d9b6076fea9394ad9858a38b49bd9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:58:19 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/20ca3920796705f4e953bd5014720ea9.jpg
age
853718
edge-cache-tag
302935950058188571201508857327343714482,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
302935950058188571201508857327343714482,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time
147
req-referer
https://www.ynet.co.il/
content-length
18244
x-request-id
fe470abf889f8da8ecedf262e1fb1905
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb801
x-served-by
cache-iad-kcgs7200101-IAD, cache-iad-kjyo7100138-IAD, cache-lga21957-LGA, cache-iad-kiad7000071-IAD, cache-yul12823-YUL
last-modified
Tue, 06 Jun 2023 21:19:10 GMT
server
nginx
x-timer
S1687291099.111416,VS0,VE0
etag
"fcb423af1dac8b131c33181f489d7a22"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 0, 9546, 132
3b9c1aff23312afd0d184e0f54179765.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/3b9c1aff23312afd0d184e0f54179765.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
8685554b355858b7ad6e0bc503213f89d6612b378719637bd032bf3912d1e79f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:58:19 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/3b9c1aff23312afd0d184e0f54179765.jpg
age
2617393
edge-cache-tag
472722463543017882621331439693518864511,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
472722463543017882621331439693518864511,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
96
expiration
expiry-date="Sun, 11 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.eastbaytimes.com/
content-length
10628
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb803
x-served-by
cache-iad-kiad7000027-IAD, cache-iad-kiad7000102-IAD, cache-lga21945-LGA, cache-iad-kcgs7200106-IAD, cache-yul12823-YUL
last-modified
Thu, 11 May 2023 18:13:25 GMT
server
nginx
x-timer
S1687291099.111665,VS0,VE0
etag
"151e9055f4c3189ca9ba53642e685f1c"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 1327, 33
0263a1d40250628a2493d13f9c265d9a.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/0263a1d40250628a2493d13f9c265d9a.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
375e907fa992d07dba30677afb1ddb2649f19b69945754a4edc524acd6630da2

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:58:19 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/0263a1d40250628a2493d13f9c265d9a.jpg
age
5793322
edge-cache-tag
551532414564430238316648636153268095294,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
551532414564430238316648636153268095294,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
66
expiration
expiry-date="Sat, 29 Apr 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.journal-news.com/
content-length
12060
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb803
x-served-by
cache-iad-kcgs7200110-IAD, cache-iad-kcgs7200141-IAD, cache-chi-kigq8000067-CHI, cache-iad-kiad7000164-IAD, cache-yul12823-YUL
last-modified
Wed, 29 Mar 2023 14:03:25 GMT
server
nginx
x-timer
S1687291099.111675,VS0,VE0
etag
"6d3f5da4b6fe2402a40b6d82608bacca"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 4, 1, 430, 3
d8d9fe042eb35785ca820adce0d4504c.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		11 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d8d9fe042eb35785ca820adce0d4504c.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
86b06208bcdc285fff5c59efc35df7900ba8690e816c54bd21d178ff70661d52

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:58:19 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d8d9fe042eb35785ca820adce0d4504c.jpg
age
1357054
edge-cache-tag
372912748934979544711820844785966957671,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
372912748934979544711820844785966957671,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
85
req-referer
https://ww2.saviezvouscela.fr/
content-length
11450
x-request-id
2ea637384a9fbc70b2a4c8578f15482e
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb201
x-served-by
cache-iad-kjyo7100091-IAD, cache-iad-kjyo7100057-IAD, cache-sna10734-LGB, cache-iad-kiad7000021-IAD, cache-yul12823-YUL
last-modified
Mon, 05 Jun 2023 03:00:46 GMT
server
nginx
x-timer
S1687291099.115657,VS0,VE0
etag
"d243c450ca5e0f67c63ce8cfdcce02b8"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 485, 2
c6239d26c1081015da8050230fbf269b.jpg
images.taboola.com/taboola/image/fetch/h_323,w_580,c_fill,g_xy_center,x_362,y_230/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		46 KB
46 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/h_323,w_580,c_fill,g_xy_center,x_362,y_230/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c6239d26c1081015da8050230fbf269b.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ae7035fc79c92988ad3abf6bbcd7fffb307e0e5c76c140efe0b899bd4380bfb7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:58:19 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/h_323,w_580,c_fill,g_xy_center,x_362,y_230/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c6239d26c1081015da8050230fbf269b.jpg
age
3664388
edge-cache-tag
587356268005097457686237049894664356422,593926418681870691671074173605565287936,29ecf9b93bbf306179626feeda1fab70
cache-tag
587356268005097457686237049894664356422,593926418681870691671074173605565287936,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
314
expiration
expiry-date="Fri, 02 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.lowellsun.com/
content-length
46942
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb202
x-served-by
cache-iad-kcgs7200153-IAD, cache-iad-kjyo7100124-IAD, cache-lax10631-LGB, cache-iad-kcgs7200149-IAD, cache-yul12823-YUL
last-modified
Tue, 02 May 2023 10:53:40 GMT
server
nginx
x-timer
S1687291099.143851,VS0,VE0
etag
"010062a068dabb08a700500d96dc19d0"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 1757, 1133
1043266802__OueLhze2.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/SKP/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/SKP/1043266802__OueLhze2.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ad06738da02c7ce4be4eb368611d30a80b63bccb7c5d5c382bf4951a40aa7eeb

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:58:19 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/SKP/1043266802__OueLhze2.jpg
age
1063042
edge-cache-tag
469570300027794231975039569860978569601,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
469570300027794231975039569860978569601,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache
HIT, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
57
expiration
expiry-date="Sat, 10 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.tipranks.com/
content-length
5172
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb802
x-served-by
cache-iad-kiad7000093-IAD, cache-iad-kjyo7100027-IAD, cache-lga21975-LGA, cache-iad-kiad7000071-IAD, cache-yul12823-YUL
last-modified
Wed, 10 May 2023 06:45:46 GMT
server
nginx
x-timer
S1687291099.144371,VS0,VE0
etag
"86d0a7b664ceb2da616cf20386b2c383"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 0, 0, 102, 3
960f9b928d7d068f84e487ef6145960a.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/960f9b928d7d068f84e487ef6145960a.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
b0d0d8d4d905ad8cf5c26b2f074de1b2ad84074a222065a512f51b3298494371

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:58:19 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/960f9b928d7d068f84e487ef6145960a.jpg
age
375463
edge-cache-tag
430444656904844161219105173073324637324,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
430444656904844161219105173073324637324,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
153
expiration
expiry-date="Wed, 21 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.semana.com/
content-length
9128
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb801
x-served-by
cache-iad-kcgs7200052-IAD, cache-iad-kiad7000118-IAD, cache-chi-klot8100038-CHI, cache-iad-kiad7000120-IAD, cache-yul12823-YUL
last-modified
Sun, 21 May 2023 00:50:34 GMT
server
nginx
x-timer
S1687291099.144357,VS0,VE0
etag
"30bf1d1f5bce1e27966db97d1d475ff8"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 2966, 7
8a9da04b-be0c-4337-a566-86c8700189c6
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/8a9da04b-be0c-4337-a566-86c8700189c6
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
9209641a-aacf-4e16-a2e5-4646bd8f7c45
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/9209641a-aacf-4e16-a2e5-4646bd8f7c45
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
bc2cde8a-f51a-4fe8-a329-5ed328499c62
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/bc2cde8a-f51a-4fe8-a329-5ed328499c62
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
c7ae94f4-2a09-49f7-ad27-e3c2551601fa
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/c7ae94f4-2a09-49f7-ad27-e3c2551601fa
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
41706383c04e2d2707bba90e13cbfe8c.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		13 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/41706383c04e2d2707bba90e13cbfe8c.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
74c0349fc386a4f27375a8f7f98c7867ce1f72ba65b9f040993a2bc8c6229ed0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:58:19 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/41706383c04e2d2707bba90e13cbfe8c.jpg
age
620449
edge-cache-tag
319057017648119700857710964196482850322,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
319057017648119700857710964196482850322,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
220
expiration
expiry-date="Thu, 15 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.cnbctv18.com/
content-length
13770
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb803
x-served-by
cache-iad-kjyo7100055-IAD, cache-iad-kiad7000054-IAD, cache-lga21923-LGA, cache-iad-kjyo7100147-IAD, cache-yul12823-YUL
last-modified
Mon, 15 May 2023 12:15:39 GMT
server
nginx
x-timer
S1687291099.144351,VS0,VE0
etag
"6716af523c1693593f40d03b019d2f61"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 11, 3
/
www.google.com/pagead/1p-user-list/11039244145/ 		42 B
455 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/11039244145/?random=1687291097069&cv=11&fst=1687287600000&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1665603053&rmt_tld=0&ipr=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:19 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.ca/pagead/1p-user-list/11039244145/ 		42 B
455 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/pagead/1p-user-list/11039244145/?random=1687291097069&cv=11&fst=1687287600000&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1665603053&rmt_tld=1&ipr=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:822::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:19 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
geo.privacymanager.io/ 		30 B
607 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://geo.privacymanager.io/
Requested by
Host: launchpad.privacymanager.io
URL: https://launchpad.privacymanager.io/1/launchpad.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-61.ewr53.r.cloudfront.net
Software
/
Resource Hash
70fd869f92915eb3c9f85d2d2b5a473ba45239ae463b35267642335337c46f06

Request headers

Accept
application/json
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 20 Jun 2023 08:46:27 GMT
via
1.1 50f5f6b4e0025748bb74dce1db44c750.cloudfront.net (CloudFront), 1.1 19e58616339f974c22a3a07f8f637718.cloudfront.net (CloudFront)
x-amz-cf-pop
IAD89-C1, EWR53-P1
age
40312
x-amzn-requestid
dd44a638-d8a8-484c-abc5-1c3c4352137c
x-amzn-trace-id
Root=1-64916763-3fa25a584427deb858fb8853;Sampled=0;lineage=06620786:0
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
content-type
application/json
access-control-allow-origin
*
x-cache
Hit from cloudfront
x-amz-apigw-id
Gz0XiGa7joEF2eQ=
content-length
30
x-amz-cf-id
asYEOw9S2a-ekV2h_CLqmfpdRJgva1lqsaFaFuSGYZM9GF9-Lerw1A==
access-control-allow-headers
Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token
/
geo.privacymanager.io/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://geo.privacymanager.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-61.ewr53.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin
*
content-length
0
content-type
application/json
date
Tue, 20 Jun 2023 19:58:19 GMT
via
1.1 d9d5880faa1278f1716f3a60dd93de56.cloudfront.net (CloudFront), 1.1 19e58616339f974c22a3a07f8f637718.cloudfront.net (CloudFront)
x-amz-apigw-id
G1WyUGZMDoEF7Sg=
x-amz-cf-id
5N2ETghqZaNhDOf63bRMtFGjDVDJP43ZJed6-MNS8lLU0SEWMkJO_g==
x-amz-cf-pop
JFK51-C1 EWR53-P1
x-amzn-requestid
c4a06bc0-8ed4-435a-b675-5d5792359217
x-cache
Miss from cloudfront
pr
s.amazon-adsystem.com/v3/ Frame 7230 		4 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
d06f7ba64204195da21d80f059716697760715dbf3156c0d712407369204bea0
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Referer
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
4110
Content-Type
text/html;charset=ISO-8859-1
Date
Tue, 20 Jun 2023 19:58:19 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
x-amz-rid
M8J2A21ZSS4R6RAT9924
bat.js
bat.bing.com/ 		40 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Tue, 20 Jun 2023 19:58:18 GMT
last-modified
Thu, 11 May 2023 18:08:27 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: ECCE29CD55CA4B15A84140B323D2CE66 Ref B: YMQ01EDGE0409 Ref C: 2023-06-20T19:58:19Z
etag
"80df77953384d91:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
12183
jfy5yp77cohy74fsw5uk.mp4
cdn.taboola.com/libtrc/static/video//h_400,c_scale/v1675413952/ 		67 KB
67 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video//h_400,c_scale/v1675413952/jfy5yp77cohy74fsw5uk.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5af7f54e4682da1be1484f658f9b15a84537085a4081cef229704a6d8e4ceb71

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
JhpPlUz7nZ57ILPZKofZM6pneMKKR0I4
date
Tue, 20 Jun 2023 19:58:19 GMT
via
1.1 varnish
x-amz-request-id
D3FA3P6X7SQ7DC27
age
64
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-68339/68340
x-amz-replication-status
COMPLETED
Content-Length
68340
x-amz-id-2
eJPfgBRMRFaaYjnMKEy2osdHu6mWqmpQFIXTxUgQkkLIfK6wRnJnYXH1qN43RrKSoemeezPPN9w=
x-served-by
cache-yul12823-YUL
last-modified
Fri, 03 Feb 2023 08:45:58 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687291099.278355,VS0,VE1
etag
"12d66db772be5305a2eda235f0b44b99"
content-type
video/mp4;codecs=avc1
abp
9
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
ae0ue1jbcjqu5byivgsm.mp4
cdn.taboola.com/libtrc/static/video/v1682562179/ 		463 KB
463 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/v1682562179/ae0ue1jbcjqu5byivgsm.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
03d9c6282533912a324c1d6f7c0c06583bed3f2c3a4a2331a6c36df3602faf52

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
1kIG7nplrGZPIHeqvx4bs.wW29YRS385
date
Tue, 20 Jun 2023 19:58:19 GMT
via
1.1 varnish
x-amz-request-id
DA2E1JF243MYTFAP
age
86
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-474042/474043
x-amz-replication-status
COMPLETED
Content-Length
474043
x-amz-id-2
tDZ397Boo/58rYdcxjTgy7+Sezl//JOwq9xnMDPTZaYRZL7sCEeg9NuBgxAeK+DC4jQRlMZulr8=
x-served-by
cache-yul12823-YUL
last-modified
Thu, 27 Apr 2023 02:23:05 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687291099.297086,VS0,VE0
etag
"f3a359ea66d151486ab4c08935a18108"
content-type
video/mp4;codecs=avc1
abp
47
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
5
cktcnyyudrurusyfjouk.mp4
cdn.taboola.com/libtrc/static/video/v1685950230/ 		1 MB
1 MB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/v1685950230/cktcnyyudrurusyfjouk.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7a6e593f715545a4262c0d9a90d157b6b18ae0900ca6ddf3c6d568134310fc2f

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
d6ueGktFcB2EwN7zocuabc2gAAuw1YPA
date
Tue, 20 Jun 2023 19:58:19 GMT
via
1.1 varnish
x-amz-request-id
QF7J1Y53HJS926GS
age
17
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-1248084/1248085
x-amz-replication-status
COMPLETED
Content-Length
1248085
x-amz-id-2
AdisWrdtRQdFmzLV3/61Tb4gSYFRPu6s+oI+p/lCbUUx3WIbXNg316yBk1w8PkwZILDvBb78qKU=
x-served-by
cache-yul12823-YUL
last-modified
Mon, 05 Jun 2023 07:30:39 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687291099.296999,VS0,VE1
etag
"e73e901218df8f12f0d31914663c3397"
content-type
video/mp4;codecs=avc1
abp
28
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
gtm.js
www.googletagmanager.com/ 		225 KB
71 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NFD2QGD&l=MG2DL
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:820::2008 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
dace6cab302ff281cc680642030b526bdddbe24130e1bdd495997bf632fdae7d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:19 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
72871
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 20 Jun 2023 19:58:19 GMT
trk.gif
jadserve.postrelease.com/ 		43 B
624 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_at=394&ntv_usid=1332120&ntv_pl=1028524
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.228.62.117 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-228-62-117.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:19 GMT
server
nginx/1.12.2
content-type
image/gif
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
trk.gif
jadserve.postrelease.com/ 		43 B
624 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_ui=f766f109-48d6-47e2-9141-ea2f0a63e3eb&ntv_fl=DOoEcgB0BB04DrHgiFrFsFF-lFdjD84Is_FOo9090IVUxII_D3Cj6ACXU9GQTCOJT9DRoCK65iH-PjvK-3eajYCBa0NoJhl4eOb6y2IwdvaTrWOCNcvyKHDWfEKdbzi9ddrx0I5hR6s63kDdISSfebtmyeLkZGC1aEh3EZmLklZYwpt3N1hbt6vBunf0cA0zPBSrJzLHXQpj2G4jwxpA-nL7cgLGJPwB4luP7kwofftDJxr9S21Xogn9mvxuLyxYfcTFpzI6R0F4WPphycd_KZqLxVuFw2XXMEnIBrn4r-vMRgZfV2pctR5qbrWDgHyGXva0UAOi8Gy-aixP8J9xIbgb0aEJUQ3cdfyh1p5iddxGx7kawar5phaCIGJde7LTyAJjCaydikUDBDs2x5MTPEK7YAUDga-FG4BYj8N7L9_KYuaYT1nD7dPTK9CMkD0z&ntv_ht=2gSSZAA&ntv_at=303,302&ntv_a=AAAAAAAAAAjRcRA&ord=1687291099593&ntv_it
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.228.62.117 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-228-62-117.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:19 GMT
server
nginx/1.12.2
content-type
image/gif
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
trk.gif
jadserve.postrelease.com/ 		43 B
624 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_ui=26b80ca7-2dd9-4751-be10-6f45540989b4&ntv_fl=w17_ozdxaJTnNoCtXGccc1C64zbwUBVS35TS0mkW_DnCA5mrN-dSNKXELM6tlYqT5AAy10HQFRSm9vS7H-gJ4TAZMRcp8wzPvhnSqzGrSiiTLRfnjVvewDL1z9BpTNzed7j7iqDrwpXuwXPLrGW-Te6IrY5a764OH5nffsNbhQOWc7ZfnzODCUpfRp3kLrtq_ng87aTYETemN3fXmdSj2qmn_KwEuKhsr-thb6LDWFJ1gI0zg9kJrECGuDkG8fv8VRDqJ7muBSL3EF7XoW8BM9bDW_iAeP6wqKdX1egD6C8zBCQN2f38ART5SdI1CZG87reY32JJgy_KYKeJqFHHB4XhZO2EYKtHYAvYlC3ecSkHKEz7Qfy2ezXZdH8cISszyO7ZNjHA30HiU_MxbWbNmFkSI084qYoj_sGUQKMBumJZZ36ZoKWab74DjWR38i6y&ntv_ht=2gSSZAA&ntv_at=303&ntv_a=AAAAAAAAAArLEPA&ord=1687291099599&ntv_it
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.228.62.117 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-228-62-117.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:19 GMT
server
nginx/1.12.2
content-type
image/gif
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame 7230
Redirect Chain
  • https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E&gdpr=0
  • https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3302926991455551000V10
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3302926991455551000V10
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
V363NDA77J5A1ZNPH0HS
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:19 GMT
Server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3302926991455551000V10
Content-Type
text/html
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
154
x-mnet-hl2
E
Expires
Tue, 20 Jun 2023 19:58:19 GMT
ecm3
s.amazon-adsystem.com/ Frame 7230
Redirect Chain
  • https://s.ad.smaato.net/c/?adExInit=aps&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsmaato.com%26id%3D%24UID
  • https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=d854fcfc
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=d854fcfc
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
TN3XPQ3T0CRS4EASYHQN
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date
Tue, 20 Jun 2023 19:58:19 GMT
via
1.1 6f9ef5ae165c9835aa6935d9fb7e2072.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
EWR53-P1
x-cache
FunctionGeneratedResponse from cloudfront
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=d854fcfc
cache-control
no-cache, must-revalidate
content-length
0
x-amz-cf-id
2p0e8c1WxcA7gpQxsWbTD3qh_z51etayZ1udQNnHXm8a9YffFLE4uA==
log
protected-by.clarium.io/ Frame D279 		0
0
log
protected-by.clarium.io/ Frame D279 		0
222 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.73.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-73-233.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:58:19 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame D279 		0
0
log
protected-by.clarium.io/ Frame 0637 		0
0
log
protected-by.clarium.io/ Frame 0637 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.73.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-73-233.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:58:19 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 0637 		0
0
sync
gum.criteo.com/ Frame 71C7 		51 B
292 B 		Script
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:19 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=3600
server-processing-duration-in-ticks
407228
expires
60
ttj
secure.adnxs.com/ Frame 71C7 		5 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/ttj?ttjb=1&bdc=1687291099&bdh=z4m1rltwoOMoXjaNV_aFPfE_7Mk.&&bdref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F,https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&&id=28334192
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.181.211 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
0722c4b986cba2d0469918ef6c01e21bc9c1ec2f6f9c956034c661b66194f06b
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:20 GMT
Content-Encoding
gzip
X-Creative-ID
398539822
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
73f19034-dc65-45e6-8380-6fa84ca13e25
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cs
digitalfirstmedia.blueconic.net/DG/DEFAULT/ 		66 B
867 B 		Script
General
Check archive.org
Download Go to
Full URL
https://digitalfirstmedia.blueconic.net/DG/DEFAULT/cs?bcsessionid=a1e1be2f-9252-4dd3-870b-4b39b351cd8a&&callback=bc_json358
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.200.130.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-200-130-143.compute-1.amazonaws.com
Software
- /
Resource Hash
564f6c7148cc692048ab0045cf24addc4a0db126afd08a5099dedbc2198b3793
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-permitted-cross-domain-policies
master-only
content-type
text/javascript; charset=utf-8
p3p
policyref="", CP="DSP"
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
content-length
86
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
sync-container.js
b-code.liadm.com/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://b-code.liadm.com/sync-container.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:23cb:4200:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
58a07739b05fec4d319e4d5c6b1fa4ac79e2a625e08ab3f303929b77fde5bdf4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 11:53:52 GMT
x-amz-version-id
WIo1DFPCLgnYZuB8yv1dFIDWe1bYBj2G
content-encoding
gzip
last-modified
Tue, 10 May 2022 11:48:07 GMT
server
AmazonS3
via
1.1 aea539314dea6e591d10d79d61e42090.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P1
etag
W/"ae5e94de938b0387eda6df8f20da811a"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
public, max-age=2592000
age
1238668
x-amz-cf-id
YBuUixkhLjtpyZsQRlXy42bfy8LXo4MlAeF9XU5VpIeSogk9rr81Jg==
amzns2s
rtb.gumgum.com/usync/ Frame CCB0 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.1.59.237 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-1-59-237.compute-1.amazonaws.com
Software
nginx /
Resource Hash
c479ded7110d7875b380d38d7ce1c4a621dd98454ee982c7b93e7e028e8f504e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-encoding
gzip
content-type
text/html;charset=UTF-8
date
Tue, 20 Jun 2023 19:58:20 GMT
etag
W/"031cb2ea50247a99d69cec17e4f3baa92"
server
nginx
timing-allow-origin
*
usermatch
ssum-sec.casalemedia.com/ Frame 9B3A
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
7c459e92c840c50324355d1abc3515f9d88783fa297a5a32ec321faae98bcc11

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
no-cache
Connection
Keep-Alive
Content-Length
1725
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:20 GMT
Expires
0
Keep-Alive
timeout=1, max=499
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma
no-cache
Server
Apache

Redirect headers

Cache-Control
no-cache
Connection
Keep-Alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:20 GMT
Expires
0
Keep-Alive
timeout=1, max=500
Location
/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma
no-cache
Server
Apache
ecm3
s.amazon-adsystem.com/ Frame CC72
Redirect Chain
  • https://ssbsync-us.smartadserver.com/api/sync?callerId=2&gdpr=0
  • https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=8231229510999469573&gdpr=0&gdpr_consent=
43 B
479 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=8231229510999469573&gdpr=0&gdpr_consent=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:20 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
x-amz-rid
W0D8KB04FHBKDNFR6SB4

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:58:19 GMT
location
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=8231229510999469573&gdpr=0&gdpr_consent=
ecm3
s.amazon-adsystem.com/ Frame BD74
Redirect Chain
  • https://amazon-tam-match.dotomi.com/match/bounce/current?networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D&gdpr=0
  • https://amazon-tam-match.dotomi.com/match/bounce/current?DotomiTest=5b0c14d254f505ef&is_secure=true&networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D&...
  • https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAHwrPka_OISwNtL3lEAAAAAAA&expiration=1687377500&is_secure=true&gdpr=0
43 B
479 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAHwrPka_OISwNtL3lEAAAAAAA&expiration=1687377500&is_secure=true&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:20 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
x-amz-rid
RMDEZ9105GNSR1RPSBH3

Redirect headers

cache-control
no-cache, private, max-age=0, no-store
content-length
0
date
Tue, 20 Jun 2023 19:58:20 GMT
expires
0
location
https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAHwrPka_OISwNtL3lEAAAAAAA&expiration=1687377500&is_secure=true&gdpr=0
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
pragma
no-cache
server
nginx
/
match.sharethrough.com/jwumXNuB/v1/ Frame 380C 		427 B
943 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.217.98.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-217-98-147.compute-1.amazonaws.com
Software
/
Resource Hash
cce6681da3f7d009656fff2e5519d4114821d0ca4d46bff322e363185a0644e2

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-length
427
date
Tue, 20 Jun 2023 19:58:20 GMT
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 1E1A 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.173.8 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-173-8.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165152
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:58:20 GMT
expires
Thu, 22 Jun 2023 17:50:52 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
baker
sli.mercurynews.com/ 		19 B
368 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sli.mercurynews.com/baker?dtstmp=1687291100133
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.47.144.133 Hillsboro, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-47-144-133.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2d199b9d8dc7886837cbfd12c9e8ddae7e28f5c375d564b31bf732a320921435

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
Tue, 20 Jun 2023 19:58:20 GMT
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
19
Content-Type
image/gif
syncframe
gum.criteo.com/ Frame E87C 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:19 GMT
server
Kestrel
server-processing-duration-in-ticks
344172
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
recommendations
a869.mercurynews.com/rest/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/rest/recommendations?storeId=0595003b-1825-43bc-89bd-9877ca21042f&profileId=a1e1be2f-9252-4dd3-870b-4b39b351cd8a&frequencyCap=8&itemId=9968021&request=%5B%7B%22id%22%3A1561661563872%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-06-18T19%3A58%3A20.234Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22SAME_CATEGORY%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%2C%7B%22value%22%3A3%2C%22algorithm%22%3A%22RECENT_VIEW%22%7D%5D%2C%22count%22%3A2%7D%2C%7B%22id%22%3A1561661593537%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-06-18T19%3A58%3A20.234Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22LOOK_ALIKE%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%5D%2C%22count%22%3A2%7D%2C%7B%22id%22%3A1561661645802%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-06-18T19%3A58%3A20.234Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22COLLABORATIVE_FILTERING%22%2C%22rampUp%22%3A%22INSTANT%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%5D%2C%22count%22%3A3%7D%2C%7B%22id%22%3A1561661684113%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-06-18T19%3A58%3A20.234Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22RECENT_CTR%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%5D%2C%22count%22%3A3%7D%2C%7B%22id%22%3A%22default%22%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-06-18T19%3A58%3A20.234Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22RECENT_VIEW%22%7D%5D%2C%22count%22%3Anull%7D%5D&&callback=bc_json359
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
ebe1af001ddd00d6acfa7e96e0fd29c8f5ba7de6edc2f50705c348b92cb95fd6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 82139f26335f87e45d45c08d5208817a.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
4382
x-xss-protection
1; mode=block
pragma
no-cache
server
-
content-type
text/javascript;charset=utf-8
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
x-amz-cf-id
Of4Dtmdnx4EyciJsLigm7-HJAMNTpb7L-NL48dEkS-4WwibCDN4aAQ==
expires
Thu, 01 Jan 1970 00:00:00 GMT
1060502780777063
connect.facebook.net/signals/config/ 		376 KB
108 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/1060502780777063?v=2.9.107&r=stable
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
7c46d9a954829d09583e3af58d09df0ab2773f37dc1e3ad593d382c2234fed47
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Tue, 20 Jun 2023 19:58:20 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
109917
x-xss-protection
0
pragma
public
x-fb-debug
+yPEHLflweBehMfwe9KuJ991GWsGbpV0z9kdqQAiznOlJQ7ECEGrpg2//ONwTwkxGa/lHe04RcnTac1VJporSw==
x-fb-trip-id
1679558926
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
feed-card-placeholder.20230620-6-RELEASE.es6.js
cdn.taboola.com/libtrc/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/feed-card-placeholder.20230620-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
24999918b7aa7fd5adeca29162085186c3e7cdee5914709c9a927b46b48f05b9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
oTtQuzux.d8yESyUrbo6rF4NhK8d4BsH
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:58:20 GMT
x-amz-request-id
6FY0XPPCYNMW0Y4H
age
34469
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
1262
x-amz-id-2
FSp6kQSw4Jlxoay6c/S87AScTkrlKEkitg/IAWXC/8gtXUeCMtjOFbGiK69zVN1e4TZzL02t2hA=
x-served-by
cache-yul12823-YUL
last-modified
Tue, 20 Jun 2023 10:23:52 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687291100.305204,VS0,VE0
etag
"b47e6d8318effa2404d0ccb9a7394d61"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
68
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
44157
article-detection.20230620-6-RELEASE.es6.js
cdn.taboola.com/libtrc/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/article-detection.20230620-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
31c86114d8c9683bade57e627634f040284e99a601deb292b961108e5d831415

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
4H3kMWXEvjq2NgzTAQGAVlKPfHF0V_uV
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:58:20 GMT
x-amz-request-id
DA5VRVW3KJBWBEKQ
age
34481
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
1235
x-amz-id-2
IKqEiJ/YCl6zPyY75Oves1yUfyvS73PlTztlin0EHM+Yd9CVZqlXsTnLg+TfDhkthl5Pd1+XKm4=
x-served-by
cache-yul12823-YUL
last-modified
Tue, 20 Jun 2023 10:23:40 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687291100.307473,VS0,VE0
etag
"1f20295bd8365ddf48f735c926ff0cc2"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
53
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
61737
distance-from-article.20230620-6-RELEASE.es6.js
cdn.taboola.com/libtrc/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/distance-from-article.20230620-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
136a576886a9ae3b5d55278a3e69a1fcc0a2189dfbf77ec41787742f260e5526

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
tiKXD9R.iV6EIW70tY.NUChNLGxA7YrV
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:58:20 GMT
x-amz-request-id
KWZN76QKBRF85VSN
age
34474
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
1134
x-amz-id-2
sy3oqpQqFY+GGz8bBPSkYe3u8cUU1Dp1qCFDLkqy5aUNGQc1ZCPvcLQqpqdubqhqa1agVQ2AjI8=
x-served-by
cache-yul12823-YUL
last-modified
Tue, 20 Jun 2023 10:23:47 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687291100.308502,VS0,VE0
etag
"fbfd48aada1c3f9df380e1a033c23ef4"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
26
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
61753
userx.20230620-6-RELEASE.es6.js
cdn.taboola.com/libtrc/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/userx.20230620-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ef13b0253a986d36b9de961b9d657b6735fc409299b451d1e9a1454f66ce2fec

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
yQwZyXEurRH1ow5V_7vo0gyZObwynie6
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:58:20 GMT
x-amz-request-id
3ZG5WV90GBNJ8J6X
age
34442
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
5397
x-amz-id-2
thmnhzLkUogLSdHuUYOzPDvbs+jeo8Sb3ZVYXOYPLNQH+klPA3aPTclOIh+AVsU4Xq/6t3CW7Ms=
x-served-by
cache-yul12823-YUL
last-modified
Tue, 20 Jun 2023 10:24:18 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687291100.312423,VS0,VE0
etag
"b7cdca876844e9766f1112d8bd36fb5d"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
59
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
21054
bulk
trc.taboola.com/medianewsgroup-mercurynews/log/3/ 		0
439 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/medianewsgroup-mercurynews/log/3/bulk?tvi2=10443&route=US%3AUS%3AV&lti=deflated&bulkSize=5
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

x-vcl-time-ms
15
date
Tue, 20 Jun 2023 19:58:20 GMT
via
1.1 varnish
x-fastly-to-nlb-rtt
10350
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version
v2
x-served-by
cache-yul12823-YUL
pragma
no-cache
server
nginx
x-timer
S1687291100.355606,VS0,VE15
content-type
image/gif
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
b9fa2886-b3e0-467f-bd86-189839bade1d
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/b9fa2886-b3e0-467f-bd86-189839bade1d
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
tamptsync
sync-amz.ads.yieldmo.com/ Frame 7CD6 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.208.104.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-208-104-226.compute-1.amazonaws.com
Software
/
Resource Hash
f2c1ab05d66fb469c9cc80f596c91b0bf30b021f24cfe463935a093fb1c6c467

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-headers
Cache-Control, Pragma, *
access-control-allow-methods
POST, GET, OPTIONS
access-control-allow-origin
*
content-encoding
gzip
content-type
text/html;charset=utf-8
date
Tue, 20 Jun 2023 19:58:20 GMT
pragma
no-cache
vary
accept-encoding
usync.html
eus.rubiconproject.com/ Frame 01C9 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:58:20 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
visitormatch
bh.contextweb.com/ Frame 2533
Redirect Chain
  • https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint
  • https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
828 B
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
198.148.27.140 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(10.0.14) /
Resource Hash
6a0b02c47df560d2d8a1c0b7f30caf6efcae920125e396d4e7d6960d68a4284c
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control
private, max-age=0, no-cache, no-store
content-language
en-CA
content-length
828
content-type
text/html;charset=iso-8859-1
cw-server
bh-deployment-6d945594b4-rfn2r
expires
-1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server
Jetty(10.0.14)
strict-transport-security
max-age=15768000

Redirect headers

accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control
private, max-age=0, no-cache, no-store
content-language
en-CA
cw-server
bh-deployment-6d945594b4-rfn2r
expires
-1
location
/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server
Jetty(10.0.14)
strict-transport-security
max-age=15768000
dinitsync
crb.kargo.com/api/v1/ Frame A369 		0
435 B 		Document
General
Check archive.org
Download Go to
Full URL
https://crb.kargo.com/api/v1/dinitsync?partners=A9
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.209.177.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-209-177-129.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
no-cache, no-store, must-revalidate, private, max-age=0
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:20 GMT
Expires
Thu, 01 Jan 1970 00:00:00 UTC
Pragma
no-cache
Vary
Origin
X-Accel-Expires
0
ecm3
s.amazon-adsystem.com/ Frame 2625
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid=%24UID&ex=appnexus.com&gdpr=0
  • https://s.amazon-adsystem.com/ecm3?id=3958812064475458525&ex=appnexus.com&gdpr=0
43 B
479 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?id=3958812064475458525&ex=appnexus.com&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:20 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
x-amz-rid
V0XHW0DW7WX41E4MXT2T

Redirect headers

AN-X-Request-Uuid
f16c61f0-707d-489a-a712-f3379f551535
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
Content-Type
text/html; charset=utf-8
Date
Tue, 20 Jun 2023 19:58:20 GMT
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Location
https://s.amazon-adsystem.com/ecm3?id=3958812064475458525&ex=appnexus.com&gdpr=0
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma
no-cache
Server
nginx/1.21.3
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
amazon
ce.lijit.com/beacon/ Frame 18A2
Redirect Chain
  • https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0
  • https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0
  • https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.92.190.74 Houston, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
/
Resource Hash
3bfc649225cbc08df009bc048827f361f7dd9c718c575c9dcf3257c6639d3717

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Encoding
gzip
Content-Length
427
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:20 GMT
Expires
Fri, 20 Mar 2009 00:00:00 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Pragma
no-cache
Vary
Accept-Encoding, User-Agent
X-Sovrn-Pod
ad_ap4ewr1

Redirect headers

Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:20 GMT
Expires
Fri, 20 Mar 2009 00:00:00 GMT
Location
https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
P3P
CP="CUR ADM OUR NOR STA NID"
Pragma
no-cache
X-Sovrn-Pod
ad_ap4ewr1
sync-iframe
cs-server-s2s.yellowblue.io/ Frame 682F 		2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
4a214c63879acd030f5a7ca1de923bda71c3f122fd8903171ac921971faa1b1c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin
cs-server-s2s.yellowblue.io
content-type
text/html
date
Tue, 20 Jun 2023 19:58:20 GMT
server
istio-envoy
x-envoy-upstream-service-time
4
ecm3
s.amazon-adsystem.com/ Frame 6FB6
Redirect Chain
  • https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID&gdpr=0
  • https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
  • https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=3075899752081279888305
43 B
479 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=3075899752081279888305
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:20 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
x-amz-rid
9Q92SW6JQWVTSNY2HFWT

Redirect headers

cache-control
no-cache, no-store, must-revalidate
content-length
0
date
Tue, 20 Jun 2023 19:58:20 GMT
location
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=3075899752081279888305
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
integrator.js
adservice.google.com/adsid/ 		107 B
165 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.mercurynews.com
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80b::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		31 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3467493086232492&correlator=150287383684228&eid=31073560%2C31075027%2C31075065%2C31074793%2C31070232&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Csponsorship_1&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=300x50%7C320x50&ifi=6&adks=1140109686&didk=1622125026&sfv=1-0-40&ris=2&rcs=1&prev_scp=pos%3DSponsorship_1%26htl_refresh%3D1%26confiant_refresh%3Dtrue&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D425393090679%26rurl%3D%26articleid%3D9968021&sc=1&cookie=ID%3D66c307501df181c9%3AT%3D1687291098%3ART%3D1687291098%3AS%3DALNI_MYS3ohfCtceNj71Z5MuHLNX5CSDAg&gpic=UID%3D00000c52becd70b0%3AT%3D1687291098%3ART%3D1687291098%3AS%3DALNI_MYOkaUD_dpLztX6KsaO9yHoBXDPyw&abxe=1&dt=1687291100373&lmt=1687291100&dlt=1687291095117&idt=2133&adxs=3085&adys=79&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=300x50&msz=300x50&fws=3076&ohw=1254&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvjmCi7W3v6coGzmBboppo-0CB1wp50riqFtURiV_Y2b4Lv9VIXqle5s38h4AYN4TyiSeVVgx_Ue4bR0ytTMWdrqPMep6S4y&ga_vid=1182837468.1687291098&ga_sid=1687291098&ga_hid=1727863478&ga_fc=true&a3p=EhkKCnVpZGFwaS5jb20Y_eGL040xSABSAghkEhsKDGlkNS1zeW5jLmNvbRjw7YvTjTFIAFICCGoSGQoKcHViY2lkLm9yZxiT5ovTjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y_eGL040xSABSAghk&dblt=testdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdata
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9b011aa3ebe78455e2384c17b0bd9abbd8b603582d0be286af5d497ebb8715d7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:20 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13222
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/11039244145/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/11039244145/?random=1687291097548&cv=11&fst=1687287600000&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Daudio_article_loaded%3Bevent_category%3DAudio%20Article%3Bevent_label%3DAudio%20Article%20Player&fmt=3&is_vtc=1&random=3647141748&rmt_tld=0&ipr=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.ca/pagead/1p-user-list/11039244145/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/pagead/1p-user-list/11039244145/?random=1687291097548&cv=11&fst=1687287600000&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Daudio_article_loaded%3Bevent_category%3DAudio%20Article%3Bevent_label%3DAudio%20Article%20Player&fmt=3&is_vtc=1&random=3647141748&rmt_tld=1&ipr=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:822::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/ 		4 B
24 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j100&a=1727863478&t=pageview&_s=1&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&dr=&dp=%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ul=en-us&de=UTF-8&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBACEAjBAAAACgFK~&jid=1888724706&gjid=682110536&cid=1182837468.1687291098&tid=UA-61435456-5&_gid=2078750920.1687291098&_r=1&_slc=1&gtm=45He36e0n71TLFP4R&cd2=mercurynews.com&cd3=mercurynews.com&cd4=&cd5=2023-06-20T11%3A12%3A40-07%3A00&cd6=2023-06-20T11%3A12%3A40-07%3A00&cd7=2023-06-20T11%3A52%3A17-07%3A00&cd9=no&cd10=Entertainment&cd11=6.2.2&cd12=&cd13=WP&cd14=Entertainment&cd15=Entertainment&cd16=Things%20To%20Do&cd17=&cd18=&cd19=&cd20=&cd21=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&cd22=meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&cd23=9968021&cd24=article&cd25=BANG&cd26=Martha%20Ross&cd27=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20just%20%E2%80%9812%20hours%20work%2C%27%20ex-Spotify%20exec%20tells%20BBC&cd28=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&cd29=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20just%20%E2%80%9812%20hours%20work%2C%27%20ex-Spotify%20exec%20tells%20BBC&cd30=&cd32=p-4ctCQwtnNBNs2&cd33=BayAreaNewsGroup&cd34=true&cd35=&cd36=5021&cd37=801&cd38=Martha%20Ross&cd42=Not%20Set&cd49=false&cd50=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.133%20Safari%2F537.36&cd51=&cd54=no_email&cd55=Bay%20Area%20News%20Group&cd61=Not%20Set&cd62=free&cd63=Not%20Set&cd64=Entertainment%2CThings%20To%20Do&cd65=The%20Mercury%20News&cd53=1182837468.1687291098&z=64033741
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
usersync
usersync.gumgum.com/ Frame CCB0
Redirect Chain
  • https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
  • https://usersync.gumgum.com/usersync?b=apn&i=3958812064475458525
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=apn&i=3958812064475458525
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

Date
Tue, 20 Jun 2023 19:58:20 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
6233e562-ab2c-461d-8143-590ce84e9183
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://usersync.gumgum.com/usersync?b=apn&i=3958812064475458525
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usersync
usersync.gumgum.com/ Frame CCB0
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_5f8a27c9-52a9-4f51-af59-852beb0ad309&gdpr=0&gdpr_consent=&us_privacy=
  • https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=u_5f8a27c9-52a9-4f51-af59-852beb0ad309&gdpr=0&gdpr_consent=&us_privacy=
  • https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=gumgum2
  • https://c1.adform.net/serving/cookie/match/?CC=1&party=24&bidswitch_ssp_id=gumgum2
  • https://x.bidswitch.net/sync?dsp_id=70&user_id=5407894714181040436&ssp=gumgum2
  • https://usersync.gumgum.com/usersync?b=bsw&i=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=&gdpr_consent=&us_privacy=
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=bsw&i=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=&gdpr_consent=&us_privacy=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:22 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

Location
//usersync.gumgum.com/usersync?b=bsw&i=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=&gdpr_consent=&us_privacy=
Date
Tue, 20 Jun 2023 19:58:21 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
usersync
usersync.gumgum.com/ Frame CCB0
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
  • https://usersync.gumgum.com/usersync?b=sta&i=0-aee3e84a-9648-5082-7b18-bc1b6a6da401$ip$149.56.153.187
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=sta&i=0-aee3e84a-9648-5082-7b18-bc1b6a6da401$ip$149.56.153.187
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

Location
https://usersync.gumgum.com/usersync?b=sta&i=0-aee3e84a-9648-5082-7b18-bc1b6a6da401$ip$149.56.153.187
Date
Tue, 20 Jun 2023 19:58:20 GMT
Connection
keep-alive
Content-Length
128
Content-Type
text/html; charset=utf-8
usersync
usersync.gumgum.com/ Frame CCB0
Redirect Chain
  • https://b1sync.zemanta.com/usersync/gumgum/?puid=u_5f8a27c9-52a9-4f51-af59-852beb0ad309&gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
  • https://stags.bluekai.com/site/23178?id=enfOlcX9S9Dq6ua2mBcD&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LO...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2ZLOMZHWYY2YHFJTSRDRGZ2WCMTNIJRUI
  • https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=enfOlcX9S9Dq6ua2mBcD
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=enfOlcX9S9Dq6ua2mBcD
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:21 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:21 GMT
Content-Type
text/html; charset=utf-8
Location
https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=enfOlcX9S9Dq6ua2mBcD
P3p
CP="We do not support P3P header."
Cache-Control
no-cache, no-store, must-revalidate
Content-Length
103
Expires
Thu, 01 Dec 1994 16:00:00 GMT
usersync
usersync.gumgum.com/ Frame CCB0
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
  • https://usersync.gumgum.com/usersync?b=pln&i=sk2jAnLigg03&ev=1&pid=558355
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=pln&i=sk2jAnLigg03&ev=1&pid=558355
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

strict-transport-security
max-age=15768000
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server
Jetty(10.0.14)
content-language
en-CA
location
https://usersync.gumgum.com/usersync?b=pln&i=sk2jAnLigg03&ev=1&pid=558355
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-6d945594b4-rfn2r
expires
-1
cookie-sync
sync.outbrain.com/ Frame CCB0
Redirect Chain
  • https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobR...
  • https://usersync.gumgum.com/usersync?b=obn&i=ENC%286ul5yVUFDR0AFuRLLroJFAQ-_uzJjch8RttS1ms8m_CpS8R4PYdI1nGgZ7Jos-AJ%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%...
  • https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_5f8a27c9-52a9-4f51-af59-852beb0ad309&obuid=ENC(6ul5yVUFDR0AFuRLLroJFAQ-_uzJjch8RttS1ms8m_CpS8R4PYdI1nGgZ7Jos-AJ...
  • https://sync.outbrain.com/syncPlatform?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0
  • https://ice.360yield.com/server_match?partner_id=1863&r=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dimprove_digital%26uid%3D%7BPUB_USER_ID%7D%26obUid%3D6ul5yVUFDR0AFuRLLroJFAQ-_uzJjch8RttS1...
  • https://sync.outbrain.com/cookie-sync?p=improve_digital&uid=cf5fb249-43c2-4293-b0ec-8acb4f767842&obUid=6ul5yVUFDR0AFuRLLroJFAQ-_uzJjch8RttS1ms8m_CpS8R4PYdI1nGgZ7Jos-AJ&gdpr=0&gdpr_consent=$CONSNT_S...
0
145 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.outbrain.com/cookie-sync?p=improve_digital&uid=cf5fb249-43c2-4293-b0ec-8acb4f767842&obUid=6ul5yVUFDR0AFuRLLroJFAQ-_uzJjch8RttS1ms8m_CpS8R4PYdI1nGgZ7Jos-AJ&gdpr=0&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA&initiator=platform
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
70.42.32.159 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:22 GMT
Cache-Control
no-cache
X-TraceId
b84dee4df5ade15af89c85ddceb5468a
Content-Length
0

Redirect headers

location
https://sync.outbrain.com/cookie-sync?p=improve_digital&uid=cf5fb249-43c2-4293-b0ec-8acb4f767842&obUid=6ul5yVUFDR0AFuRLLroJFAQ-_uzJjch8RttS1ms8m_CpS8R4PYdI1nGgZ7Jos-AJ&gdpr=0&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA&initiator=platform
access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:58:21 GMT
content-type
text/plain
content-length
0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
usersync
usersync.gumgum.com/ Frame CCB0
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
  • https://us-u.openx.net/w/1.0/cm?cc=1&_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
  • https://usersync.gumgum.com/usersync?b=opx&i=b1d1f1b4-7f84-4c15-b187-b81bffd95c6d
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=opx&i=b1d1f1b4-7f84-4c15-b187-b81bffd95c6d
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:21 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

date
Tue, 20 Jun 2023 19:58:20 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://usersync.gumgum.com/usersync?b=opx&i=b1d1f1b4-7f84-4c15-b187-b81bffd95c6d
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
usersync
usersync.gumgum.com/ Frame CCB0
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
  • https://usersync.gumgum.com/usersync?b=oth&i=y-k8SBXOFE2pfQp.rR0edCRuu8R8kXbuYRJ9U4~A
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=oth&i=y-k8SBXOFE2pfQp.rR0edCRuu8R8kXbuYRJ9U4~A
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

date
Tue, 20 Jun 2023 19:58:20 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
location
https://usersync.gumgum.com/usersync?b=oth&i=y-k8SBXOFE2pfQp.rR0edCRuu8R8kXbuYRJ9U4~A
content-length
0
usersync
usersync.gumgum.com/ Frame CCB0
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync...
  • https://usersync.gumgum.com/usersync?b=vnt&i=d73a5f9f-f848-4ab7-950f-b9fc12a99154
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=vnt&i=d73a5f9f-f848-4ab7-950f-b9fc12a99154
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

Location
https://usersync.gumgum.com/usersync?b=vnt&i=d73a5f9f-f848-4ab7-950f-b9fc12a99154
Date
Tue, 20 Jun 2023 19:58:20 GMT
Connection
keep-alive
X-CI-RTID
39bf5e36-5597-4132-b357-07d30159eb4f
Content-Length
108
Content-Type
text/html; charset=utf-8
usersync
usersync.gumgum.com/ Frame CCB0
Redirect Chain
  • https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
  • https://usersync.gumgum.com/usersync?b=snc&i=16F85AA78ED646369CC5112051089037
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=snc&i=16F85AA78ED646369CC5112051089037
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

date
Tue, 20 Jun 2023 19:58:20 GMT
via
1.1 varnish
server
nginx
age
0
access-control-allow-methods
POST,GET,HEAD,OPTIONS
x-varnish
4532499
location
https://usersync.gumgum.com/usersync?b=snc&i=16F85AA78ED646369CC5112051089037
access-control-allow-origin
https://rtb.gumgum.com/
access-control-allow-credentials
true
content-length
0
142
match.deepintent.com/usersync/ Frame CCB0 		0
222 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
38.91.45.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software
b /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
date
Tue, 20 Jun 2023 19:58:20 GMT
server
b
content-length
0
p3p
policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
usersync
usersync.gumgum.com/ Frame CCB0
Redirect Chain
  • https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
  • https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
  • https://usersync.gumgum.com/usersync?b=idi&i=cf5fb249-43c2-4293-b0ec-8acb4f767842
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=idi&i=cf5fb249-43c2-4293-b0ec-8acb4f767842
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:21 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

location
https://usersync.gumgum.com/usersync?b=idi&i=cf5fb249-43c2-4293-b0ec-8acb4f767842
access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:58:21 GMT
content-type
text/plain
content-length
0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
usersync
usersync.gumgum.com/ Frame CCB0
Redirect Chain
  • https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent=
  • https://usersync.gumgum.com/usersync?b=sad&i=8231229510999469573
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=sad&i=8231229510999469573
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:21 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

location
https://usersync.gumgum.com/usersync?b=sad&i=8231229510999469573
date
Tue, 20 Jun 2023 19:58:20 GMT
content-length
0
ecm3
s.amazon-adsystem.com/ Frame CCB0 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=gg.com&id=u_5f8a27c9-52a9-4f51-af59-852beb0ad309
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
RYFBYPCG1302KFTQMM53
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame 380C 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=sharethrough.com&id=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
SJYAWVBH3XVBSDP8X2TK
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
v1
match.sharethrough.com/sync/ Frame 380C
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=
68 B
601 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
3.217.98.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-217-98-147.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
323
v1
match.sharethrough.com/sync/ Frame 380C
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=
68 B
606 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
3.217.98.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-217-98-147.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
323
v1
match.sharethrough.com/sync/ Frame 380C
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=
68 B
608 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
3.217.98.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-217-98-147.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
323
v1
match.sharethrough.com/sync/ Frame 380C
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4
  • https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=$UID
  • https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=3958812064475458525
68 B
606 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=3958812064475458525
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
3.217.98.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-217-98-147.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

Date
Tue, 20 Jun 2023 19:58:20 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
b4a1bf45-140b-4dbe-b523-bc657ef859d5
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=3958812064475458525
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usermatchredir
ssum-sec.casalemedia.com/ Frame 9B3A
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZJIE3OP2OC752A2TKDUZ_AAADoAAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEL7wJTJiAOcwSLwcNq0t7Dc&google_cver=1
43 B
766 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEL7wJTJiAOcwSLwcNq0t7Dc&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=497
Content-Length
43
Expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEL7wJTJiAOcwSLwcNq0t7Dc&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
364
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame 9B3A
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZJIE3OP2OC752A2TKDUZ-AAA
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFuZvXRzkK0e2XpOeKl2lW4&google_cver=1
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFuZvXRzkK0e2XpOeKl2lW4&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:21 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=497
Content-Length
43
Expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEFuZvXRzkK0e2XpOeKl2lW4&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
314
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 9B3A
Redirect Chain
  • https://match.adsrvr.org/track/cmf/casale
  • https://match.adsrvr.org/track/cmb/casale?
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&expiration=1689883100&gdpr=0&gdpr_consent=
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&expiration=1689883100&gdpr=0&gdpr_consent=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:21 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=496
Content-Length
43
Expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&expiration=1689883100&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
323
dcm
s.amazon-adsystem.com/ Frame 9B3A 		43 B
855 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZJIE3OP2OC752A2TKDUZ_AAADoAAAAIB&gpp=&gpp_sid=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
HD81T9HZT9NC28T94XMR
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame 9B3A
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/ie
  • https://match.prod.bidr.io/cookie-sync/ie?_bee_ppp=1
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAEJeE7JJAoAACD7r3WP1g&expiration=1688500701
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAEJeE7JJAoAACD7r3WP1g&expiration=1688500701
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:21 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=495
Content-Length
43
Expires
0

Redirect headers

location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAEJeE7JJAoAACD7r3WP1g&expiration=1688500701
Date
Tue, 20 Jun 2023 19:58:21 GMT
strict-transport-security
max-age=2592000; includeSubDomains
Server
gunicorn
Connection
keep-alive
Content-Length
0
crum
dsum-sec.casalemedia.com/ Frame 9B3A
Redirect Chain
  • https://s.company-target.com/s/ix?cm_dsp_id=18&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1703102300&external_user_id=fdc6fea8-0fb1-44f4-8faf-1c49c06a29f1
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1703102300&external_user_id=fdc6fea8-0fb1-44f4-8faf-1c49c06a29f1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:21 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=499
Content-Length
43
Expires
0

Redirect headers

date
Tue, 20 Jun 2023 19:58:20 GMT
via
1.1 google
access-control-allow-methods
GET,OPTIONS
content-type
text/html; charset=utf-8
access-control-allow-origin
*.casalemedia.com
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1703102300&external_user_id=fdc6fea8-0fb1-44f4-8faf-1c49c06a29f1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
157
tp_out
d.adroll.com/cm/index/ Frame 9B3A 		42 B
181 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d.adroll.com/cm/index/tp_out?advertisable=3GMDZMBFQREVBC75SYYKWH
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:61c0:2204:b513:b8fc:2d8f:8df9 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
nginx/1.22.1 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:20 GMT
cache-control
no-transform,public,max-age=300,s-maxage=900
server
nginx/1.22.1
content-length
42
vary
Cookie
content-type
image/gif
crum
dsum-sec.casalemedia.com/ Frame 9B3A
Redirect Chain
  • https://ssbsync.smartadserver.com/api/sync?callerId=82&gdpr=$%7bGDPR%7d&gdpr_consent=$%7bGDPR_CONSENT%7d
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=8231229510999469573&gdpr=0&gdpr_consent=
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=8231229510999469573&gdpr=0&gdpr_consent=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:21 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=498
Content-Length
43
Expires
0

Redirect headers

location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=8231229510999469573&gdpr=0&gdpr_consent=
date
Tue, 20 Jun 2023 19:58:19 GMT
content-length
0
ecm3
s.amazon-adsystem.com/ Frame 9B3A 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=index.com&id=ZJIE3OP2OC752A2TKDUZ_AAADoAAAAIB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
0BVKPRKPBEZFCCD5R42Q
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		32 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3467493086232492&correlator=2759271019191821&eid=31073560%2C31075027%2C31075065%2C31074793%2C31070232&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Ctop_leaderboard&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=728x90%7C970x90%7C970x250&ifi=7&adks=142133714&didk=303353385&sfv=1-0-40&ris=3&rcs=1&prev_scp=pos%3Dtop_leaderboard%26htl_refresh%3D1%26confiant_refresh%3Dtrue&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D425393090679%26rurl%3D%26articleid%3D9968021&sc=1&cookie=ID%3D66c307501df181c9%3AT%3D1687291098%3ART%3D1687291098%3AS%3DALNI_MYS3ohfCtceNj71Z5MuHLNX5CSDAg&gpic=UID%3D00000c52becd70b0%3AT%3D1687291098%3ART%3D1687291098%3AS%3DALNI_MYOkaUD_dpLztX6KsaO9yHoBXDPyw&abxe=1&dt=1687291100522&lmt=1687291100&dlt=1687291095117&idt=2133&adxs=1515&adys=243&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=970x250&msz=970x250&fws=1028&ohw=1280&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvjmCi7W3v6coGzmBboppo-0CB1wp50riqFtURiV_Y2b4Lv9VIXqle5s38h4AYN4TyiSeVVgx_Ue4bR0ytTMWdrqPMep6S4y&ga_vid=1182837468.1687291098&ga_sid=1687291098&ga_hid=1727863478&ga_fc=true&ga_cid=2078750920.1687291098&a3p=EhkKCnVpZGFwaS5jb20Y_eGL040xSABSAghkEhsKDGlkNS1zeW5jLmNvbRjw7YvTjTFIAFICCGoSGQoKcHViY2lkLm9yZxiT5ovTjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y_eGL040xSABSAghk&dblt=testdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdata
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e4283c0e9297a08c5f3c75005c1f15b5c640066bca050c74137c011ec0b79a5c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:20 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13262
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
sid
mug.criteo.com/ Frame E87C
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertagids&domain=mercurynews.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
  • https://mug.criteo.com/sid?cpp=0Wn6MXx3eWFOQmZ0bHYvM3RNMFBwWXl5U3hPZmdVZVhxR2FCYVdXSDFLMURManYydkVKZEZHL1dQeEJDREtSejFwMDk5dUVxeXlJZHJ6WEx0UC8wcm94Q2drMGpRYXl2S2svOUFWUSs4L0hWVS9mMnZsZlNWc0JWOGRFQm...
428 B
672 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=0Wn6MXx3eWFOQmZ0bHYvM3RNMFBwWXl5U3hPZmdVZVhxR2FCYVdXSDFLMURManYydkVKZEZHL1dQeEJDREtSejFwMDk5dUVxeXlJZHJ6WEx0UC8wcm94Q2drMGpRYXl2S2svOUFWUSs4L0hWVS9mMnZsZlNWc0JWOGRFQmYvMXRXZnNLYU13MCthRWVNSEdDcWRqNllsb0I5MEliUVJuQ1BNUll2TzNodkZ3eFhnaE5QZGxSMng0alRVMjNQQnBQNkV4dDhoMUlkand5K2lhbGN6RGROb2ZVaUNkSHpHbUpNaFpOS21iT0NWeUdMOTJvRElUSlRkK2NoYVdvZnpQcnl5NnJaQkQzK3NFbEJuNmlyY3ltVkFUdUxPdz09fA&cppv=2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
5313599a7ba29aa471cb611b901320d1c88c96a5e0524c1e92a71db0309d61eb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
2337745
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:19 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=0Wn6MXx3eWFOQmZ0bHYvM3RNMFBwWXl5U3hPZmdVZVhxR2FCYVdXSDFLMURManYydkVKZEZHL1dQeEJDREtSejFwMDk5dUVxeXlJZHJ6WEx0UC8wcm94Q2drMGpRYXl2S2svOUFWUSs4L0hWVS9mMnZsZlNWc0JWOGRFQmYvMXRXZnNLYU13MCthRWVNSEdDcWRqNllsb0I5MEliUVJuQ1BNUll2TzNodkZ3eFhnaE5QZGxSMng0alRVMjNQQnBQNkV4dDhoMUlkand5K2lhbGN6RGROb2ZVaUNkSHpHbUpNaFpOS21iT0NWeUdMOTJvRElUSlRkK2NoYVdvZnpQcnl5NnJaQkQzK3NFbEJuNmlyY3ltVkFUdUxPdz09fA&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
492442
content-length
0
expires
0
usync.js
eus.rubiconproject.com/ Frame 01C9 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:20 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 08:41:09 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=45785
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 08:41:25 GMT
cs
cs-server-s2s.yellowblue.io/ Frame 682F
Redirect Chain
  • https://ssc-cms.33across.com/ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11580%26puid%3D33XUSERID33X
  • https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212147305902640
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212147305902640
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:20 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
referrer-policy
unsafe-url
server
33XP020
x-33x-status
100000000008200000C
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212147305902640
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
cs
cs-server-s2s.yellowblue.io/ Frame 682F
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID&rdf=1
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjJFQkJGN0QtNEM3OS00RjMxLUI2N0ItOTIwNjI1Qzk4REVG&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://cs-server-s2s.yellowblue.io/cs?aid=11576&id=F2EBBF7D-4C79-4F31-B67B-920625C98DEF
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=11576&id=F2EBBF7D-4C79-4F31-B67B-920625C98DEF
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

location
https://cs-server-s2s.yellowblue.io/cs?aid=11576&id=F2EBBF7D-4C79-4F31-B67B-920625C98DEF
date
Tue, 20 Jun 2023 19:58:20 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
115
content-type
text/html; charset=utf-8
cksync.php
contextual.media.net/ Frame 682F 		61 B
458 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=25&type=ris&ovsid=%7B%7BAPID%7D%7D&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11585%26id%3D%3Cvsid%3E
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.49.100.28 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-49-100-28.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:58:20 GMT
server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
content-length
61
x-mnet-hl2
E
expires
Tue, 20 Jun 2023 19:58:20 GMT
cs
cs-server-s2s.yellowblue.io/ Frame 682F
Redirect Chain
  • https://csync.loopme.me/?pubid=11362&gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11571%26id%3D%7Bdevice_id%7D
  • https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=f66eb2fc-b468-4574-8969-c71d03ddbfc2&gdpr_consent=null&gdpr=0
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=f66eb2fc-b468-4574-8969-c71d03ddbfc2&gdpr_consent=null&gdpr=0
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
0
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

location
https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=f66eb2fc-b468-4574-8969-c71d03ddbfc2&gdpr_consent=null&gdpr=0
date
Tue, 20 Jun 2023 19:58:21 GMT
server
_
content-length
0
cs
cs.yellowblue.io/ Frame 682F
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=5926d422&gdpr=0&gdpr_consent=
  • https://cs.yellowblue.io/cs?aid=11587&uid=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44&gdpr=0
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.yellowblue.io/cs?aid=11587&uid=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44&gdpr=0
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

location
https://cs.yellowblue.io/cs?aid=11587&uid=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44&gdpr=0
date
Tue, 20 Jun 2023 19:58:20 GMT
content-length
0
cs
cs.yellowblue.io/ Frame 682F
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3663&gdpr=0&gdpr_consent=
  • https://cs.yellowblue.io/cs?aid=11601&id=dc7f10ceecad21d153e322ad1639d39a&gdpr_consent=&gdpr=0
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.yellowblue.io/cs?aid=11601&id=dc7f10ceecad21d153e322ad1639d39a&gdpr_consent=&gdpr=0
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Server
nginx
Access-Control-Allow-Origin
*
Location
https://cs.yellowblue.io/cs?aid=11601&id=dc7f10ceecad21d153e322ad1639d39a&gdpr_consent=&gdpr=0
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
x-sticky-vk
1687291100948078-125
cs
cs-server-s2s.yellowblue.io/ Frame 682F
Redirect Chain
  • https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11603%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$%7BBSW_UUID%7D
  • https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=56daf56a-28b1-40e7-a167-b6cb39d3f949
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=56daf56a-28b1-40e7-a167-b6cb39d3f949
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Location
https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=56daf56a-28b1-40e7-a167-b6cb39d3f949
Date
Tue, 20 Jun 2023 19:58:20 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
cs
cs-server-s2s.yellowblue.io/ Frame 682F
Redirect Chain
  • https://sync.go.sonobi.com/us?gdpr=0&consent_string=&loc=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D115667%26uid%3D%5BUID%5D
  • https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=7e845585-56d9-415f-9a4c-32558686bff3
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=7e845585-56d9-415f-9a4c-32558686bff3
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
5
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
go-iad-2-5-171
Content-Type
text/plain; charset=utf8
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location
https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=7e845585-56d9-415f-9a4c-32558686bff3
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Length
0
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
cs
cs-server-s2s.yellowblue.io/ Frame 682F
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=58ceaaf5-c766-4c17-869a-d76e43401714&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11563%26id%3D
  • https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=aeec4952-807e-4906-9dbb-f46416208968
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=aeec4952-807e-4906-9dbb-f46416208968
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

date
Tue, 20 Jun 2023 19:58:20 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=aeec4952-807e-4906-9dbb-f46416208968
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
cs
cs-server-s2s.yellowblue.io/ Frame 682F
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11596%26id%3D$UID&gdpr=0&gdpr_consent=
  • https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=3958812064475458525&gdpr=0&gdpr_consent=
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=3958812064475458525&gdpr=0&gdpr_consent=
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Date
Tue, 20 Jun 2023 19:58:20 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
691021ef-a82f-425a-b905-e6c31c060a8b
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=3958812064475458525&gdpr=0&gdpr_consent=
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cs
cs.yellowblue.io/ Frame 682F
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58760/sync?redir=true&gdpr=0&gdpr_consent=
  • https://cs.yellowblue.io/cs?aid=11591&id=y-Yxk.24ZE2uKUAqzaS.qWspizPfz2jnch~A&gdpr_in_effect=0
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.yellowblue.io/cs?aid=11591&id=y-Yxk.24ZE2uKUAqzaS.qWspizPfz2jnch~A&gdpr_in_effect=0
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

location
https://cs.yellowblue.io/cs?aid=11591&id=y-Yxk.24ZE2uKUAqzaS.qWspizPfz2jnch~A&gdpr_in_effect=0
date
Tue, 20 Jun 2023 19:58:20 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.57
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
ecm3
s.amazon-adsystem.com/ Frame 682F 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=rise.com&id=-r93yO6tkp_s
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
VYY1K5MFQWBXMSHZDS6G
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
common.js
maps.googleapis.com/maps-api-v3/api/js/53/7a/ 		273 KB
61 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/53/7a/common.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80a::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c38bc51d1b1c8db7f2037ae18da46d0fb6733d3e7bee635e160eb73f870d5a6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 14:45:41 GMT
content-encoding
br
x-content-type-options
nosniff
age
18759
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
61560
x-xss-protection
0
last-modified
Thu, 15 Jun 2023 00:18:47 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="maps-api-js"
vary
Accept-Encoding, Origin
report-to
{"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 14:45:41 GMT
util.js
maps.googleapis.com/maps-api-v3/api/js/53/7a/ 		164 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/53/7a/util.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80a::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5ad96953ed9f09eb237595f0947c8a02ebc9b14131cd128fecdfc16bf91297ba
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 16:37:26 GMT
content-encoding
br
x-content-type-options
nosniff
age
12054
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
52674
x-xss-protection
0
last-modified
Thu, 15 Jun 2023 00:18:47 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="maps-api-js"
vary
Accept-Encoding, Origin
report-to
{"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 16:37:26 GMT
user-sync
sync.adkernel.com/ Frame 577A 		22 B
192 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.adkernel.com/user-sync?zone=181093&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dmdp%26i%3D%5BUID%5D&gdpr=0&gdpr_consent=&ccpa=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
174.137.133.32 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software
nginx /
Resource Hash
4ca18c247df52dd22650bd7f72f71d7c98102243b0ec474f683c6a279ad3a668

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Age
0
Cache-Control
no-store
Connection
close
Content-Length
22
Date
Tue, 20 Jun 2023 19:58:20 GMT
Pragma
no-cache
Server
nginx
e9d4ff858b5e32317e843f5ed11b2659.gif
cs.iqzone.com/ Frame 9E2F 		9 B
175 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cs.iqzone.com/e9d4ff858b5e32317e843f5ed11b2659.gif?puid=u_5f8a27c9-52a9-4f51-af59-852beb0ad309&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diqz
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
8.2.111.13 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software
nginx /
Resource Hash
0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
keep-alive
Content-Type
text/plain
Date
Tue, 20 Jun 2023 19:58:31 GMT
Server
nginx
Transfer-Encoding
chunked
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 9629 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.173.8 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-173-8.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165152
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:58:20 GMT
expires
Thu, 22 Jun 2023 17:50:52 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
usersync
usersync.gumgum.com/ Frame D664
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://usersync.gumgum.com/usersync?b=ttd&i=120447a6-30d3-414b-b8f9-7a5eddeefdcd
35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=ttd&i=120447a6-30d3-414b-b8f9-7a5eddeefdcd
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:20 GMT
Expires
0
Pragma
no-cache

Redirect headers

cache-control
private,no-cache, must-revalidate
content-length
193
content-type
text/html
date
Tue, 20 Jun 2023 19:58:20 GMT
location
https://usersync.gumgum.com/usersync?b=ttd&i=120447a6-30d3-414b-b8f9-7a5eddeefdcd
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma
no-cache
x-aspnet-version
4.0.30319
usersync
usersync.gumgum.com/ Frame 92D2
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
  • https://usersync.gumgum.com/usersync?b=mmh&i=cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=mmh&i=cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:20 GMT
Expires
0
Pragma
no-cache

Redirect headers

Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:20 GMT
Expires
Tue, 20 Jun 2023 19:58:19 GMT
Keep-Alive
timeout=360
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server
MT3 1031 59fd23a master iad iad-pixel-x12 config_version:"1969"
location
https://usersync.gumgum.com/usersync?b=mmh&i=cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
usersync
usersync.gumgum.com/ Frame 0543
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
  • https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=ZJIE3AABR7XTlQAz
  • https://usersync.gumgum.com/usersync?b=atm&i=ZJIE3AABR7XTlQAz&gdpr=0&gdpr_consent=&_test=ZJIE3AABR7XTlQAz
35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=atm&i=ZJIE3AABR7XTlQAz&gdpr=0&gdpr_consent=&_test=ZJIE3AABR7XTlQAz
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:20 GMT
Expires
0
Pragma
no-cache

Redirect headers

accept-ranges
bytes
cache-control
no-cache
content-length
0
date
Tue, 20 Jun 2023 19:58:20 GMT
location
https://usersync.gumgum.com/usersync?b=atm&i=ZJIE3AABR7XTlQAz&gdpr=0&gdpr_consent=&_test=ZJIE3AABR7XTlQAz
pragma
no-cache
retry-after
0
server
Varnish
via
1.1 varnish
x-cache
HIT
x-cache-hits
0
x-served-by
cache-yyz4557-YYZ
x-timer
S1687291101.725933,VS0,VE0
pixel
cm.g.doubleclick.net/ Frame 5B49 		170 B
243 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV81ZjhhMjdjOS01MmE5LTRmNTEtYWY1OS04NTJiZWIwYWQzMDk=&gdpr=0&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.80.34 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s34-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
170
content-type
image/png
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:20 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
server
HTTP server (unknown)
x-xss-protection
0
usersync
usersync.gumgum.com/ Frame 4C68
Redirect Chain
  • https://tg.socdm.com/aux/idsync?proto=gumgum
  • https://usersync.gumgum.com/usersync?b=sus&i=ZJIE3cCo8YMAANUleFsAAAAA
35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=sus&i=ZJIE3cCo8YMAANUleFsAAAAA
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:21 GMT
Expires
0
Pragma
no-cache

Redirect headers

Cache-Control
private
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:21 GMT
Location
https://usersync.gumgum.com/usersync?b=sus&i=ZJIE3cCo8YMAANUleFsAAAAA
P3P
CP="See also http://www.scaleout.jp/privacy/"
Server
nginx
X-SO-Ads-Time
4
X-SO-Cluster-ID
0
X-SO-HostName
a-ad40313.dc2p.scaleout.jp
X-SO-IP
149.56.153.187
X-SO-Key
ZJIE3cCo8YMAANUleFsAAAAA
X-SO-LB-Data
{"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":0,"gdpr":false,"ipv4":"149.56.153.187","key":"ZJIE3cCo8YMAANUleFsAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"a-ad40313"}
X-SO-LB-Hostname
m-tgng31.dc4p.scaleout.jp
X-SO-Upstream-ID
a-ad40313
usersync
usersync.gumgum.com/ Frame CBC1
Redirect Chain
  • https://cs.admanmedia.com/sync/gumgum?puid=u_5f8a27c9-52a9-4f51-af59-852beb0ad309&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Daad%26i%3D%5BDSP_USER_ID%5D&gdpr=0&gdpr_consent=&ccpa=
  • https://usersync.gumgum.com/usersync?b=aad&i=d90855e2-a762-4191-8327-12f7f682caea
35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=aad&i=d90855e2-a762-4191-8327-12f7f682caea
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:20 GMT
Expires
0
Pragma
no-cache

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:58:20 GMT
Expires
0
Location
https://usersync.gumgum.com/usersync?b=aad&i=d90855e2-a762-4191-8327-12f7f682caea
Pragma
no-cache
Server
nginx
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Transfer-Encoding
chunked
X-Frame-Options
DENY
usermatchredir
ssum-sec.casalemedia.com/ Frame DFFC 		43 B
766 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
no-cache
Connection
Keep-Alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:20 GMT
Expires
0
Keep-Alive
timeout=1, max=498
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma
no-cache
Server
Apache
rtset
bh.contextweb.com/bh/ Frame 2533
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=LU1qSVJVMmtTOGszaGFhc2ZHWVJrUQ&gdpr=0&gdpr_consent=
  • https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEBMsIDSDWrdjerDZZjGKunc&google_cver=1
49 B
868 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEBMsIDSDWrdjerDZZjGKunc&google_cver=1
Requested by
Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
Protocol
H2
Server
198.148.27.140 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(10.0.14) /
Resource Hash
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://bh.contextweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=15768000
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server
Jetty(10.0.14)
content-language
en-CA
content-type
image/gif;charset=iso-8859-1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-6d945594b4-rfn2r
expires
-1

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEBMsIDSDWrdjerDZZjGKunc&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
335
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rtset
bh.contextweb.com/bh/ Frame 2533
Redirect Chain
  • https://pulsepoint-match.dotomi.com/match/bounce/current?networkId=14200&version=1&nuid=
  • https://pulsepoint-match.dotomi.com/match/bounce/current?DotomiTest=7d7ea8bcf09f15d8&is_secure=true&networkId=14200&version=1&nuid=
  • https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAACG66zQrJ-VQNny_ryAAAAAAA&expiration=1687377500&nuid=&is_secure=true
49 B
897 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAACG66zQrJ-VQNny_ryAAAAAAA&expiration=1687377500&nuid=&is_secure=true
Requested by
Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
Protocol
H2
Server
198.148.27.140 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(10.0.14) /
Resource Hash
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://bh.contextweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=15768000
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server
Jetty(10.0.14)
content-language
en-CA
content-type
image/gif;charset=iso-8859-1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-6d945594b4-rfn2r
expires
-1

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAACG66zQrJ-VQNny_ryAAAAAAA&expiration=1687377500&nuid=&is_secure=true
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
ecm3
s.amazon-adsystem.com/ Frame 2533 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=sk2jAnLigg03&ex=Pulsepoint
Requested by
Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://bh.contextweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
7PDDZHYMG21FGQQDN5Z9
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame 7CD6 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=ym.com&id=g7eec97c22de0d66b1bd&gdpr=0
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
G8CJ2P9WCENCQ3GWATY1
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
receive
pixel.tapad.com/idsync/ex/ Frame 7CD6
Redirect Chain
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3107&partner_device_id=g7eec97c22de0d66b1bd
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=c696eff3-e87b-4a1e-ba21-beda78dea841%252C%252C&gdpr=0&gdpr_consent=
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&ttd_puid=c696eff3-e87b-4a1e-ba21-beda78dea841%2C%2C
95 B
123 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&ttd_puid=c696eff3-e87b-4a1e-ba21-beda78dea841%2C%2C
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol
H3
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type
image/png
access-control-allow-origin
*
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=120447a6-30d3-414b-b8f9-7a5eddeefdcd&ttd_puid=c696eff3-e87b-4a1e-ba21-beda78dea841%2C%2C
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
359
sync
ads.yieldmo.com/v000/ Frame 7CD6
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=yieldmo_dbm&google_cm&pn_id=c
  • https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEH5G4iZmJxbVRw473ZzSapI&google_cver=1
43 B
471 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEH5G4iZmJxbVRw473ZzSapI&google_cver=1
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
54.164.127.24 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-164-127-24.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:21 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEH5G4iZmJxbVRw473ZzSapI&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
299
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sync
ads.yieldmo.com/v000/ Frame 7CD6
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=yieldmo&redir%3Dhttps%3A%2F%2Fads.yieldmo.com%2Fv000%2Fsync%3Fpn_id%3Dunl%26id%3D%5BRX_UUID%5D
  • https://sync.1rx.io/usersync2/rmpssp?sub=yieldmo&zcc=1&cb=1687291100973
  • https://ad.turn.com/r/cs?pid=45&rndcb=1535260460
  • https://sync.1rx.io/usersync/turn/8818067066479886686?dspret=1&gdpr=&gdpr_consent=&us_privacy=
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005?redir=https%3A%2F%2Fads.yieldmo.com%2Fv000%2Fsync%3Fpn_id%3Dunl%26id%3DRX-99a076fc-2013-49ba-8081-ddfafa3aaa...
  • https://ads.yieldmo.com/v000/sync?pn_id=unl&id=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
43 B
811 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/v000/sync?pn_id=unl&id=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
54.164.127.24 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-164-127-24.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:22 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

Location
https://ads.yieldmo.com/v000/sync?pn_id=unl&id=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Date
Tue, 20 Jun 2023 19:58:22 GMT
Content-Type
text/html
Connection
keep-alive
ETag
RX99a076fc201349ba8081ddfafa3aaa10005
Transfer-Encoding
chunked
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
sync
ads.yieldmo.com/v000/ Frame 7CD6
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=yieldmo&ttd_tpi=1&ttd_puid=g7eec97c22de0d66b1bd
  • https://ads.yieldmo.com/v000/sync?tdid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
43 B
474 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/v000/sync?tdid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
54.164.127.24 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-164-127-24.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:21 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://ads.yieldmo.com/v000/sync?tdid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
181
cs
cs-server-s2s.yellowblue.io/ Frame 7CD6
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.y...
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=N0MzQTdCREUtOUM2Mi00QTVBLTgyRkEtRjlFRkE3QzM3RTdE&gdpr=-1&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://cs-server-s2s.yellowblue.io/cs?aid=11576&id=F2EBBF7D-4C79-4F31-B67B-920625C98DEF
0
327 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=11576&id=F2EBBF7D-4C79-4F31-B67B-920625C98DEF
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://sync-amz.ads.yieldmo.com/
access-control-allow-credentials
true
x-envoy-upstream-service-time
0
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

location
https://cs-server-s2s.yellowblue.io/cs?aid=11576&id=F2EBBF7D-4C79-4F31-B67B-920625C98DEF
date
Tue, 20 Jun 2023 19:58:21 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
115
content-type
text/html; charset=utf-8
st
imprnjmp.taboola.com/ Frame 0882 		7 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imprnjmp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66361655&crid=-1&dast=V8r-ACLAZMDi_BQxivGBCYHF6ChzBeMSgAAABgYID-AEmtDMOVYbBcS0y-zVq0W5jWCtdouZYNNruZczTyrSwWIyCplWG4MgyWa4nJt1mLdgvTWuEaLdeywWY3c45GvpXFYgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxRBCcW_8dXr5SyIEakUYAQAAAKjEydw9MkknqFhU-f__77cCcAUAIABRW0xeI4vuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSC0skxsi81iuRl5liPnyLQyTjye3WDjsJhmu4nFewY1ZZu-h1EQ-4QIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYIZk3MwMq5cbuVm4nGLdpuVW-GyDNYq13IwcTlMHsPEuBa9PqaLcWJcuJZbJBiwuBfJ0yKdqGyOhXNmG86GC4_JNTMuVsbRajBZ-DYjl2szsVnEEs3JIp3ILvvSyjKxLTaL5WbkWY6cI9PKOPF4doONw2Ka7SYWf8fkHIyMK5dbuZl43KLdZuVWuCyDtcq1HExcDpPHMDGuRa-P6WKcGBeu5b4xG-4my8Vguds3ZsPdZLkYLHf7Dp3hu_qcjdLJUuwRCk2nc09ncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrhjuVgkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrH3D0CFWKvV6nZjrVYL!&cmcv=&pix=undefined&cb=1687291100660&uv=137215401&tms=1687291100660&abt=dfrc_vB!nonrv_vA!t45!ufm_vE!ul137215-401_vA&ft=0&su=6&unm=FEED_MANAGER&aure=false&agl=1&cirid=5e08e009-bd73-47a4-a549-6037f94d7ebb&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
89fd4881bd0643ba125b564e9c436e642d94fe9e485e1b94627287d952145e2c

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
content-encoding
gzip
content-type
text/html;charset=ISO-8859-1
date
Tue, 20 Jun 2023 19:58:20 GMT
server
nginx
vary
Accept-Encoding
via
1.1 varnish
x-cache
MISS
x-cache-hits
0
x-served-by
cache-yul12823-YUL
x-timer
S1687291101.670372,VS0,VE12
sync
us-match.taboola.com/ Frame EF94 		7 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://us-match.taboola.com/sync?dast=V8r-ACLAZMDi_BQxivGBCYHF6ChzBeMSgAAABgYID-AEmtDMOVYbBcS0y-zVq0W5jWCtdouZYNNruZczTyrSwWIyCplWG4MgyWa4nJt1mLdgvTWuEaLdeywWY3c45GvpXFYgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxRBCcW_8dXr5SyIEakUYAQAAAKjEydw9MkknqFhU-f__77cCcAUAIABRW0xeI4vuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSC0skxsi81iuRl5liPnyLQyTjye3WDjsJhmu4nFewY1ZZu-h1EQ-4QIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYIZk3MwMq5cbuVm4nGLdpuVW-GyDNYq13IwcTlMHsPEuBa9PqaLcWJcuJZbJBiwuBfJ0yKdqGyOhXNmG86GC4_JNTMuVsbRajBZ-DYjl2szsVnEEs3JIp3ILvvSyjKxLTaL5WbkWY6cI9PKOPF4doONw2Ka7SYWf8fkHIyMK5dbuZl43KLdZuVWuCyDtcq1HExcDpPHMDGuRa-P6WKcGBeu5b4xG-4my8Vguds3ZsPdZLkYLHf7Dp3hu_qcjdLJUuwRCk2nc09ncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrhjuVgkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrH3D0CFWKvV6nZjrVYL!&excid=22&docw=0&cijs=1&nlb=false
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
dccc8000ccab06caefaa66f54be07443950b7de66c0caead3361d719a744820d

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-type
text/html;charset=ISO-8859-1
date
Tue, 20 Jun 2023 19:58:20 GMT
machineid
3108
server
nginx
st
us-vid-events.taboola.com/ 		0
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-vid-events.taboola.com/st?cijs=convusmp&ttype=45&cisd=convusmp&cipid=66361655&crid=-1&dast=V8r-ACLAZMDi_BQxivGBCYHF6ChzBeMSgAAABgYID-AEmtDMOVYbBcS0y-zVq0W5jWCtdouZYNNruZczTyrSwWIyCplWG4MgyWa4nJt1mLdgvTWuEaLdeywWY3c45GvpXFYgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxRBCcW_8dXr5SyIEakUYAQAAAKjEydw9MkknqFhU-f__77cCcAUAIABRW0xeI4vuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSC0skxsi81iuRl5liPnyLQyTjye3WDjsJhmu4nFewY1ZZu-h1EQ-4QIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYIZk3MwMq5cbuVm4nGLdpuVW-GyDNYq13IwcTlMHsPEuBa9PqaLcWJcuJZbJBiwuBfJ0yKdqGyOhXNmG86GC4_JNTMuVsbRajBZ-DYjl2szsVnEEs3JIp3ILvvSyjKxLTaL5WbkWY6cI9PKOPF4doONw2Ka7SYWf8fkHIyMK5dbuZl43KLdZuVWuCyDtcq1HExcDpPHMDGuRa-P6WKcGBeu5b4xG-4my8Vguds3ZsPdZLkYLHf7Dp3hu_qcjdLJUuwRCk2nc09ncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrhjuVgkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrH3D0CFWKvV6nZjrVYL!&cmcv=&pix=31589837&cb=1687291100659&uv=137215401&tms=1687291100659&abt=dfrc_vB!nonrv_vA!t45!ufm_vE!ul137215-401_vA&ft=0&su=6&unm=FEED_MANAGER&debug=pn:!sqg:!torgn:1687291094811.4!ts:1687291100659&mntl=1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:20 GMT
content-length
0
server
nginx
t.js
sopalk.com/ Frame 71C7 		65 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/t.js?i=qzf6dxi5wc8fiu0hxffwm&cb=3551011687291100700
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-58.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d2cf823ebd1e2d7b0649b99673b599eda7de0e6f83e2ef0d09531576709b0ec8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
R1D2s3Kk5zdoPZnfOnKtnRrfDKgJdfzA
content-encoding
gzip
via
1.1 e5bd532dbdee524acdf00690205f3b5a.cloudfront.net (CloudFront)
date
Tue, 20 Jun 2023 16:43:22 GMT
last-modified
Mon, 29 May 2023 16:40:15 GMT
server
AmazonS3
x-amz-cf-pop
EWR53-P1
age
11700
x-amz-server-side-encryption
AES256
etag
W/"79d67edd63b460a375a4fe1a6b64d45f"
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
HuuPdTyvn8SEWhOF_jZiOCn14aFCeJBMg_niynzBisEn4rhHSAeIDQ==
async_usersync.html
acdn.adnxs.com/dmp/ Frame 123F 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1922&pub_id=2234281
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.172.245 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-172-245.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:20 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:58:22 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Unused62
8096267
Vary
Accept-Encoding
trk.js
cdn.adnxs.com/v/s/236/ Frame 71C7 		80 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
Fri, 14 Jun 2024 13:01:02 GMT
Date
Tue, 20 Jun 2023 19:58:20 GMT
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Age
457037
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
27646
X-Served-By
cache-lga21928-LGA, cache-yul12825-YUL
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
X-Timer
S1687291101.778039,VS0,VE0
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
5, 687751
it
nym1-ib.adnxs.com/ Frame 71C7 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&e=wqT_3QKzCqAzBQAAAwDWAAUBCNuJyKQGEKqf1N-t06TvGxjd19yckdOh-DYqNgkAAAECCOg_EQEHNAAA6D8ZAAAAgOtR6D8hERIAKREJADERG7Aw8LDBDTiCD0CCD0gCUK74hL4BWIaMowFgAGi488YBeNilBYABAYoBA1VTRJIFBvReAZgBrAKgAfoBqAEBsAEAuAECwAEEyAEC0AEA2AEA4AEA8AEAigIqdWYoJ2EnLCAyMTk3MjU4LCAwKTt1ZigncicsIDM5ODUzOTgyMiwgMCk7kgLxAyF1MDktTXdpbm9JSWFFSzc0aEw0QkdBQWdob3lqQVRBQU9BQkFBMGlDRDFEd3NNRU5XQUJnalFSb0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRR29BUU93QVFDNUFiN1FUTVVBQU9nX3dRRy0wRXpGQUFEb1A4a0JGeF9NM2JYaV9UX1pBUUFBQUFBQUFQQV80QUVBOVFFQUFBQUFtQUlBb0FJQXRRSUFBQUFBdlFJQUFBQUF3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJ1Z01KVGxsTk1qbzJORFl6NEFQcFE0Z0VBSkFFQUpnRUFjRUVBQUFBQUFBQUFBREpCQQ0LJEFBQTJBUUE4UVEBCwkBHElnRnZ6S3BCERMUUEFfc1FVCRwBAQhNRUYBBwkBBERKFSgMQUFBMC4oAAROay4oALBnQmZqSkJQQUY1b0dyQ2ZnRmlvNkdBWUlHQTFWVFJJZ0dBSkFHQVpnR0FLRUcBTAEBLDZELW9CZ0d5QmlRSgEQDQEAUg0IAQEAWgEFDQEAaA0IUEFBQUM0QmlnLpoCmQEhbHhBODl3aTb1ASxJYU1vd0VnQXlnQU0R6VRPZ19PZ2xPV1UweU9qWTBOak5BNlVOFXkIOEQ5HXkAQh15AEIdeQhCcEEVAQRCeBULGEFCNEFJa0IZEPQ0AUEu2ALWCeACh5wK6gKCAWh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzA2LzIwL21lZ2hhbi1tYXJrbGUtZWFybmVkLW1vcmUtdGhhbi10aGUtd2Vla25kLWZvci1qdXN0LTEyLWhvdXJzLXdvcmstZXgtc3BvdGlmeS1leGVjLXRlbGxzLWJiYy-AAwCIAwGQAwCYAxmgAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEBC90dGqYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANIEDjE5MjIjTllNMjo2NDYz2gQCCAHgBADwBK74hL4BiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAIlYaNgFAeAFAfAFAfoFBAgAEACQBgCYBgC4BgDBBgkhKPA_0AbpBtoGFgoQCREZAXQQABgA4AYB8gYCCACABwGIBwCgBwHIB9ilBdIHDQkRKAEmCNoHBgFdcBgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=e3e6cfd227fe041903887d39d0b2c3eb6268de2f
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
AN-X-Request-Uuid
4f7f7653-ab94-4265-903d-241403287ea1
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjE1OTUyMjkwMiIsImVidXkiOiIzMTExNzIwODQzIiwiZWFkdiI6IjUyMzM1MDI2MzYiLCJlY2lkIjoiMTM4NDEzNTIwMzUyIiwiZWVudiI6ImoiLCJlcGlkIjoiMjIxMzg1NDYyNDUiLCJlc2lkIjoiMjQyNTMyMTQifQ&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=70971a10-60c8-480f-a891-ae7825ee8281&pid=96430c62-9e9b-4e9e-9c51-bae8ae4a6a48&dtm=1687291100764&qnm=_matherq&visible=1&tabid=a2cbfdc5-fc55-4203-bb3e-307d8f7af5bb&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&vp=1600x1200&ds=4000x8886&tofa=1687291098&vid=1&lvidt=1687291098&duid=db7bf053-61e0-4111-899e-812311da85ef&fp=967226427&cid=ma23578&mrk=239876506
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.162.81.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-162-81-74.compute-1.amazonaws.com
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date
Tue, 20 Jun 2023 19:58:20 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
truncated
/ Frame 71C7 		211 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ca87576c6d1999cc17e5d414e32426414a2aa7d37411254b1c85e8bd6ced98f9

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
usync.html
eus.rubiconproject.com/ Frame 6922
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=rise_engage&endpoint=us-east
  • https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://cs-server-s2s.yellowblue.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:58:20 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Tue, 20 Jun 2023 19:58:20 GMT
location
https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
server
AkamaiGHost
/
onetag-sys.com/usync/ Frame A215 		2 KB
815 B 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?pubId=69f48c2160c8113&gdpr=0&gdpr_consent=
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.222.39.185 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip185.ip-51-222-39.net
Software
/
Resource Hash
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://cs-server-s2s.yellowblue.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-transform, no-cache
content-encoding
gzip
content-length
731
content-type
text/html
strict-transport-security
max-age=15552000
usersync
usersync.gumgum.com/ Frame 52D0
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=gumgum
  • https://creativecdn.com/cm-notify?pi=gumgum&tc=1
  • https://usersync.gumgum.com/usersync?b=rth&i=FOYPqMoXokSCEEaOCmV5&pi=gumgum&tc=1
35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=rth&i=FOYPqMoXokSCEEaOCmV5&pi=gumgum&tc=1
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:21 GMT
Expires
0
Pragma
no-cache

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:58:21 GMT Tue, 20 Jun 2023 19:58:21 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://usersync.gumgum.com/usersync?b=rth&i=FOYPqMoXokSCEEaOCmV5&pi=gumgum&tc=1
pragma
no-cache
usync.html
eus.rubiconproject.com/ Frame E794
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
  • https://eus.rubiconproject.com/usync.html?p=gumgum
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:58:20 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Tue, 20 Jun 2023 19:58:20 GMT
location
https://eus.rubiconproject.com/usync.html?p=gumgum
server
AkamaiGHost
ecm3
s.amazon-adsystem.com/ Frame 18A2 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=G2VucPZH9VEpuxOrQmKrKkiA&ex=sovrn.com&gdpr=0&gdpr=0&gdpr_consent=
Requested by
Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ce.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
XHB7DGGXF6GV55W0SCGM
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
merge
ce.lijit.com/ Frame 18A2
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=
  • https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=&tc=1
  • https://ce.lijit.com/merge?pid=86&3pid=FOYPqMoXokSCEEaOCmV5&pi=sovrn&gdpr=0&gdpr_consent=&tc=1
43 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=86&3pid=FOYPqMoXokSCEEaOCmV5&pi=sovrn&gdpr=0&gdpr_consent=&tc=1
Requested by
Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol
HTTP/1.1
Server
23.92.190.74 Houston, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ce.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:21 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Content-Type
image/gif
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ewr1
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location
https://ce.lijit.com/merge?pid=86&3pid=FOYPqMoXokSCEEaOCmV5&pi=sovrn&gdpr=0&gdpr_consent=&tc=1
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:21 GMT, Tue, 20 Jun 2023 19:58:21 GMT
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
merge
ce.lijit.com/ Frame 18A2
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=85&3pid=AAEJeE7JJAoAACD7r3WP1g&gdpr=0
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=85&3pid=AAEJeE7JJAoAACD7r3WP1g&gdpr=0
Requested by
Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol
HTTP/1.1
Server
23.92.190.74 Houston, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ce.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:21 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Content-Type
image/gif
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ewr1
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location
https://ce.lijit.com/merge?pid=85&3pid=AAEJeE7JJAoAACD7r3WP1g&gdpr=0
Date
Tue, 20 Jun 2023 19:58:21 GMT
strict-transport-security
max-age=2592000; includeSubDomains
Server
gunicorn
Connection
keep-alive
Content-Length
0
sovrn
tr.blismedia.com/v1/api/sync/ Frame 18A2 		0
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tr.blismedia.com/v1/api/sync/sovrn?gdpr=0&gdpr_consent=
Requested by
Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
8.105.96.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ce.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
pixel
cm.g.doubleclick.net/ Frame 18A2
Redirect Chain
  • https://ap.lijit.com/dsp/google/cookiematch/dv?gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=RzJWdWNQWkg5VkVwdXhPclFtS3JLa2lB&gdpr=0
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=RzJWdWNQWkg5VkVwdXhPclFtS3JLa2lB&gdpr=0
Requested by
Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol
H3
Server
142.250.80.34 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s34-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ce.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:21 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Tue, 20 Jun 2023 19:58:21 GMT
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Location
https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=RzJWdWNQWkg5VkVwdXhPclFtS3JLa2lB&gdpr=0
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap2dca1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Content-Length
0
merge
ce.lijit.com/ Frame 18A2
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=23&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=16&3pid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=16&3pid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=
Requested by
Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol
HTTP/1.1
Server
23.92.190.74 Houston, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ce.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:21 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Content-Type
image/gif
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ewr1
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
server
A
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://ce.lijit.com/merge?pid=16&3pid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
publishertag.prebid.135.js
static.criteo.net/js/ld/ 		89 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.135.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
20678c305b50c0988193d64cb34f41e2dcb6f2fa48353106436ea301e07ce70a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:20 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Fri, 24 Feb 2023 07:57:32 GMT
server
nginx
etag
W/"63f86dec-16386"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:58:20 GMT
jfy5yp77cohy74fsw5uk.mp4
cdn.taboola.com/libtrc/static/video//h_400,c_scale/v1675413952/ 		67 KB
67 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video//h_400,c_scale/v1675413952/jfy5yp77cohy74fsw5uk.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5af7f54e4682da1be1484f658f9b15a84537085a4081cef229704a6d8e4ceb71

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
JhpPlUz7nZ57ILPZKofZM6pneMKKR0I4
date
Tue, 20 Jun 2023 19:58:20 GMT
via
1.1 varnish
x-amz-request-id
D3FA3P6X7SQ7DC27
age
66
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-68339/68340
x-amz-replication-status
COMPLETED
Content-Length
68340
x-amz-id-2
eJPfgBRMRFaaYjnMKEy2osdHu6mWqmpQFIXTxUgQkkLIfK6wRnJnYXH1qN43RrKSoemeezPPN9w=
x-served-by
cache-yul12823-YUL
last-modified
Fri, 03 Feb 2023 08:45:58 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687291101.856530,VS0,VE1
etag
"12d66db772be5305a2eda235f0b44b99"
content-type
video/mp4;codecs=avc1
abp
1
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
ae0ue1jbcjqu5byivgsm.mp4
cdn.taboola.com/libtrc/static/video/v1682562179/ 		463 KB
464 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/v1682562179/ae0ue1jbcjqu5byivgsm.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
03d9c6282533912a324c1d6f7c0c06583bed3f2c3a4a2331a6c36df3602faf52

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
1kIG7nplrGZPIHeqvx4bs.wW29YRS385
date
Tue, 20 Jun 2023 19:58:20 GMT
via
1.1 varnish
x-amz-request-id
DA2E1JF243MYTFAP
age
87
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-474042/474043
x-amz-replication-status
COMPLETED
Content-Length
474043
x-amz-id-2
tDZ397Boo/58rYdcxjTgy7+Sezl//JOwq9xnMDPTZaYRZL7sCEeg9NuBgxAeK+DC4jQRlMZulr8=
x-served-by
cache-yul12823-YUL
last-modified
Thu, 27 Apr 2023 02:23:05 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687291101.856638,VS0,VE0
etag
"f3a359ea66d151486ab4c08935a18108"
content-type
video/mp4;codecs=avc1
abp
14
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
6
cktcnyyudrurusyfjouk.mp4
cdn.taboola.com/libtrc/static/video/v1685950230/ 		1 MB
0 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/v1685950230/cktcnyyudrurusyfjouk.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
d6ueGktFcB2EwN7zocuabc2gAAuw1YPA
date
Tue, 20 Jun 2023 19:58:20 GMT
via
1.1 varnish
x-amz-request-id
QF7J1Y53HJS926GS
age
18
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-1248084/1248085
x-amz-replication-status
COMPLETED
Content-Length
1248085
x-amz-id-2
AdisWrdtRQdFmzLV3/61Tb4gSYFRPu6s+oI+p/lCbUUx3WIbXNg316yBk1w8PkwZILDvBb78qKU=
x-served-by
cache-yul12823-YUL
last-modified
Mon, 05 Jun 2023 07:30:39 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687291101.856686,VS0,VE1
etag
"e73e901218df8f12f0d31914663c3397"
content-type
video/mp4;codecs=avc1
abp
30
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
rtb-h
sync.taboola.com/sg/supershiprtb-display-network/1/ Frame B606
Redirect Chain
  • https://tg.socdm.com/aux/idsync?proto=taboola
  • https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZJIE3cCo8YMAANUleG8AAAAA
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZJIE3cCo8YMAANUleG8AAAAA
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
31022

Redirect headers

X-SO-Cluster-ID
0
Date
Tue, 20 Jun 2023 19:58:21 GMT
X-SO-LB-Data
{"ban":false,"clean_query":"\/aux\/idsync?proto=taboola","cluster_id":0,"gdpr":false,"ipv4":"149.56.153.187","key":"ZJIE3cCo8YMAANUleG8AAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad178"}
X-SO-Key
ZJIE3cCo8YMAANUleG8AAAAA
Server
nginx
X-SO-Upstream-ID
m-ad178
P3P
CP="See also http://www.scaleout.jp/privacy/"
Location
https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZJIE3cCo8YMAANUleG8AAAAA
Cache-Control
private
X-SO-HostName
m-ad178.dc4p.scaleout.jp
Connection
keep-alive
X-SO-Ads-Time
3
Content-Length
0
X-SO-LB-Hostname
m-tgng31.dc4p.scaleout.jp
X-SO-IP
149.56.153.187
/
sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/ Frame B606
Redirect Chain
  • https://ih.adscale.de/su?gdpr=0&gdpr_consent=&tpid=22688&cburl=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fstroerrtbeur-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D__STROEER_USER_ID__
  • https://ih.adscale.de/su?gdpr=0&gdpr_consent=&tpid=22688&cburl=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fstroerrtbeur-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D__STROEER_USER_ID__&nut&uu=df6e617353214db49e...
  • https://sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/?taboola_hm=df6e617353214db49e68936a344cacdd
0
221 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/?taboola_hm=df6e617353214db49e68936a344cacdd
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
31022

Redirect headers

location
https://sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/?taboola_hm=df6e617353214db49e68936a344cacdd
date
Tue, 20 Jun 2023 19:58:21 GMT
content-length
0
sync
ssbsync.smartadserver.com/api/ Frame B606 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssbsync.smartadserver.com/api/sync?callerId=4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.5 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
/
sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/ Frame B606
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=16698
  • https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LJ4PJZ48-27-1JKH
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LJ4PJZ48-27-1JKH
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
27846

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LJ4PJZ48-27-1JKH
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
5c765cf7d1bd0738e8bf9e7ecb99ef6d
Expires
0
/
sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/ Frame B606
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/taboola/cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59?gdpr=0&gdpr_consent=&us_privacy=1---
  • https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-3grU.XJE2oTUKS_LYbwZqoC0nQuza5E44VkylA--~A
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-3grU.XJE2oTUKS_LYbwZqoC0nQuza5E44VkylA--~A
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
22182

Redirect headers

date
Tue, 20 Jun 2023 19:58:20 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
location
https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-3grU.XJE2oTUKS_LYbwZqoC0nQuza5E44VkylA--~A
content-length
0
/
sync.taboola.com/sg/baidurtb-network/1/rtb-h/ Frame B606
Redirect Chain
  • https://trace.mediago.io/ju/cs/taboola
  • https://sync.taboola.com/sg/baidurtb-network/1/rtb-h/?taboola_hm=9baf32f62846fdfc1db3baa355c22fe4
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/baidurtb-network/1/rtb-h/?taboola_hm=9baf32f62846fdfc1db3baa355c22fe4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
22182

Redirect headers

location
https://sync.taboola.com/sg/baidurtb-network/1/rtb-h/?taboola_hm=9baf32f62846fdfc1db3baa355c22fe4
date
Tue, 20 Jun 2023 19:58:20 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8
content-type
text/plain; charset=utf-8
/
trc.taboola.com/sg/google-network/1/rtb-h/ Frame B606
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm&google_sc
  • https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEJV4Q1nBqlQegGe-caNtcfg&google_cver=1
0
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEJV4Q1nBqlQegGe-caNtcfg&google_cver=1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
10
date
Tue, 20 Jun 2023 19:58:21 GMT
via
1.1 varnish
x-served-by
cache-yul12823-YUL
server
nginx
x-timer
S1687291101.121347,VS0,VE10
x-fastly-to-nlb-rtt
11115
x-cache
MISS
accept-ranges
bytes
content-length
0
x-service-version
v2
x-cache-hits
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEJV4Q1nBqlQegGe-caNtcfg&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
304
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame B606 		42 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59:$UID
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 18:08:37 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
pixel
cm.g.doubleclick.net/ Frame B606
Redirect Chain
  • https://sync.taboola.com/sg/google-network/1/rtb/?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dtaboola_dbm%26google_sc%26gdpr%3D0%26gdpr_consent%3D&orig=trc
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Server
142.250.80.34 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s34-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:21 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59
date
Tue, 20 Jun 2023 19:58:20 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
22234
/
trc.taboola.com/sg/thetradedesk-network/1/rtb-h/ Frame B606
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=054f32o&ttd_tpi=1
  • https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=120447a6-30d3-414b-b8f9-7a5eddeefdcd
0
306 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=120447a6-30d3-414b-b8f9-7a5eddeefdcd
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
10
date
Tue, 20 Jun 2023 19:58:21 GMT
via
1.1 varnish
x-served-by
cache-yul12823-YUL
server
nginx
x-timer
S1687291101.114168,VS0,VE10
x-fastly-to-nlb-rtt
10078
x-cache
MISS
accept-ranges
bytes
content-length
0
x-service-version
v2
x-cache-hits
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=120447a6-30d3-414b-b8f9-7a5eddeefdcd
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
239
merge
ce.lijit.com/ Frame B606 		43 B
887 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=42&3pid=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59&us_privacy=1---&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.92.190.74 Houston, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:20 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Content-Type
image/gif
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ewr1
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT
rtset
bh.contextweb.com/bh/ Frame B606 		49 B
840 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bh.contextweb.com/bh/rtset?do=add&pid=553204&ev=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
198.148.27.140 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(10.0.14) /
Resource Hash
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=15768000
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server
Jetty(10.0.14)
content-language
en-CA
content-type
image/gif;charset=iso-8859-1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-6d945594b4-rfn2r
expires
-1
/
rtb-csync.smartadserver.com/redir/ Frame B606 		43 B
438 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=107&partneruserid=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:19 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
/
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame B606
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=29&p=282&cp=taboolaortb&cu=1&url=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fcriteortb-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%40%40CRITEO_USERID%40%40
  • https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=33ce34a0-aa4b-4208-9ad8-c7db1317a38f
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=33ce34a0-aa4b-4208-9ad8-c7db1317a38f
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
22182

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
x-errorlevel
0
strict-transport-security
max-age=31536000; preload;
server
Kestrel
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=33ce34a0-aa4b-4208-9ad8-c7db1317a38f
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
3955412
content-length
0
expires
Tue, 20 Jun 2023 00:00:00 GMT
/
sync.taboola.com/sg/id5-network/1/rtb-h/ Frame B606
Redirect Chain
  • https://id5-sync.com/s/464/9.gif?puid=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fid5-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D...
  • https://id5-sync.com/c/464/464/7/1.gif?puid=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59&gdpr=0&gdpr_consent=&us_privacy=
  • https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F441%2F6%2F2.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
  • https://id5-sync.com/c/464/441/6/2.gif?puid=u_5f8a27c9-52a9-4f51-af59-852beb0ad309&gdpr=0&gdpr_consent=
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F429%2F5%2F3.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
  • https://id5-sync.com/c/464/429/5/3.gif?puid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://id5-sync.com/k/264.gif?puid=120447a6-30d3-414b-b8f9-7a5eddeefdcd&ttl=%%TTL%%
  • https://ib.adnxs.com/getuid?https://id5-sync.com/c/464/2/3/5.gif?puid=$UID&gdpr=0&gdpr_consent=
  • https://id5-sync.com/c/464/2/3/5.gif?puid=3958812064475458525&gdpr=0&gdpr_consent=
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F108%2F2%2F6.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
  • https://id5-sync.com/c/464/108/2/6.gif?puid=c696eff3-e87b-4a1e-ba21-beda78dea841&gdpr=0&gdpr_consent=
  • https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F434%2F1%2F7.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
  • https://id5-sync.com/c/464/434/1/7.gif?puid=7e845585-56d9-415f-9a4c-32558686bff3&gdpr=0&gdpr_consent=
  • https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F112%2F0%2F8.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
  • https://uipglob.semasio.net/id5/1/get2?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F112%2F0%2F8.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/464/112/0/8.gif?puid=711CE39FE8077C48&gdpr=0&gdpr_consent=
  • https://sync.taboola.com/sg/id5-network/1/rtb-h/?taboola_hm=ID5-148auFSVvSxCtzl9jqLduUI9OFkslL7ZyIQ64epekQ
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/id5-network/1/rtb-h/?taboola_hm=ID5-148auFSVvSxCtzl9jqLduUI9OFkslL7ZyIQ64epekQ
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:24 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
27404

Redirect headers

location
https://sync.taboola.com/sg/id5-network/1/rtb-h/?taboola_hm=ID5-148auFSVvSxCtzl9jqLduUI9OFkslL7ZyIQ64epekQ
date
Tue, 20 Jun 2023 19:58:23 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding
chunked
p3p
CP="CAO PSA OUR"
rtb-h
sync-t1.taboola.com/sg/bidswitch-network/1/ Frame B606
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=taboola&gdpr=0&gdpr_consent=&us_privacy=1---
  • https://inv-nets.admixer.net/adxcm.aspx?ssp=D41B0D84-4DB7-4D9C-81CC-3A497DB5D0A6&gdpr=0&consent=&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D354%26user_id%3D%24%24visitor_cookie%24%24%26ssp%3Dtabo...
  • https://x.bidswitch.net/sync?dsp_id=354&user_id=a03df4b2a76b43d09cb62f7d043a0456&ssp=taboola&bsw_param=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&consent=&gdpr_pd=&expires=7
  • https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
27963

Redirect headers

Location
//sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
Date
Tue, 20 Jun 2023 19:58:21 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
rtb-h
match.taboola.com/sg/mediaforcebidder-network/1/ Frame B606
Redirect Chain
  • https://rtb.mfadsrvr.com/sync?ssp=taboola
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=taboola
  • https://sync.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=1a2b4bb9-5661-4d14-97cd-37d814131325
  • https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=1a2b4bb9-5661-4d14-97cd-37d814131325&tbid=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59&query=taboola_hm%3D1a2b4bb9-5661-...
0
52 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=1a2b4bb9-5661-4d14-97cd-37d814131325&tbid=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59&query=taboola_hm%3D1a2b4bb9-5661-4d14-97cd-37d814131325&isDirect=0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-cache-hits
0
date
Tue, 20 Jun 2023 19:58:21 GMT
via
1.1 varnish
server
nginx
x-timer
S1687291102.948217,VS0,VE10
x-cache
MISS
accept-ranges
bytes
content-length
0
x-served-by
cache-yul12823-YUL

Redirect headers

location
https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=1a2b4bb9-5661-4d14-97cd-37d814131325&tbid=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59&query=taboola_hm%3D1a2b4bb9-5661-4d14-97cd-37d814131325&isDirect=0
date
Tue, 20 Jun 2023 19:58:21 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
31022
sd
u.openx.net/w/1.0/ Frame B606 		43 B
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://u.openx.net/w/1.0/sd?id=543998486&val=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:20 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT
xuid
eb2.3lift.com/ Frame B606 		37 B
354 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=7772&xuid=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59&dongle=tbla&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
date
Tue, 20 Jun 2023 19:58:20 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
rtb-h
sync.taboola.com/sg/stackadaptrtb-network/1/ Frame B606
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=140
  • https://sync.taboola.com/sg/stackadaptrtb-network/1/rtb-h?taboola_hm=ruPoSpZIUIJ7GLwbam2kAZU4mbs
0
221 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/stackadaptrtb-network/1/rtb-h?taboola_hm=ruPoSpZIUIJ7GLwbam2kAZU4mbs
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
25601

Redirect headers

Location
https://sync.taboola.com/sg/stackadaptrtb-network/1/rtb-h?taboola_hm=ruPoSpZIUIJ7GLwbam2kAZU4mbs
Date
Tue, 20 Jun 2023 19:58:20 GMT
Connection
keep-alive
Content-Length
119
Content-Type
text/html; charset=utf-8
sync
t.adx.opera.com/ Frame B606 		35 B
468 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.adx.opera.com/sync?vendor=60151&uid=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
82.145.213.8 , Norway, ASN39832 (NO-OPERA, NO),
Reverse DNS
n-sysadmin-jumpbox-03.feednews.opera.technology
Software
Tengine /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:21 GMT
server
Tengine
access-control-allow-methods
POST, GET
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
/
sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/ Frame B606
Redirect Chain
  • https://u.openx.net/w/1.0/cm?gdpr=0&gdpr_consent=&ph=295bf259-a378-4089-aae8-a2a995ba8627&id=37f45540-fa88-4005-bf73-8a7ac39467e3&r=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fopenxrtb-network%2F1%2Fr...
  • https://sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/?gdpr=0&us_privacy=1---&orig=video&taboola_hm=c1d6b6e7-bd90-4514-a452-a97096f4f99f
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/?gdpr=0&us_privacy=1---&orig=video&taboola_hm=c1d6b6e7-bd90-4514-a452-a97096f4f99f
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
32323

Redirect headers

date
Tue, 20 Jun 2023 19:58:21 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/?gdpr=0&us_privacy=1---&orig=video&taboola_hm=c1d6b6e7-bd90-4514-a452-a97096f4f99f
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
cds-pips.js
cdn.taboola.com/scripts/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/scripts/cds-pips.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3e7d49f24d56db02c7baca8ae3a17555c2e527571450e8c24c77b453407e267a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
z5FoayaLm_Bvew3pbkytkoHczFCvkPwT
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:58:20 GMT
x-amz-request-id
ZAK4FD2E2P8MSSD3
age
1118
x-cache
HIT
x-amz-replication-status
COMPLETED
content-length
1340
x-amz-id-2
V0c8gILtYp37FWXhcXdQojKeSQFpHITDXRHuVnvWCLK7rCdcoYnpLZyoXbDe/nSz/8OPQX7zNUM=
x-served-by
cache-yul12823-YUL
last-modified
Wed, 12 Oct 2022 13:57:57 GMT
server
AmazonS3
x-timer
S1687291101.879520,VS0,VE0
etag
"383fa66d2a0a09f4a6e64a9593ad43bb"
vary
Accept-Encoding
content-type
application/javascript
abp
7
access-control-allow-origin
*
cache-control
private, max-age=3600
accept-ranges
bytes
x-cache-hits
5262
fraud-detect.js
cdn.taboola.com/scripts/ 		121 B
389 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/scripts/fraud-detect.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
392c32f20b9f867852a946a6ed1c5e21476df9619083548b6585d80a3b5f9bd4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
vOXBAr_FxKHpU348.XTQhP6DWnVyKple
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:58:20 GMT
x-amz-request-id
Q3ERA9VTRD55JBY1
age
23224
x-cache
HIT
x-amz-replication-status
COMPLETED
content-length
125
x-amz-id-2
UUMJVpvIZIvyQ22D+SDZRaO7/6yI3tG7JsuWzRq09Cf8ExmuPRI8X1vhSkWaCi+MY3QYN59kQmA=
x-served-by
cache-yul12823-YUL
last-modified
Thu, 15 Dec 2022 16:50:08 GMT
server
AmazonS3
x-timer
S1687291101.879624,VS0,VE0
etag
"f7a185d92ac2162dc0bc36c5d7ef7dfe"
vary
Accept-Encoding
content-type
application/javascript
abp
42
access-control-allow-origin
*
cache-control
private,max-age=14400
accept-ranges
bytes
x-cache-hits
90981
eidf.es5.js
cdn.taboola.com/scripts/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/scripts/eidf.es5.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
12b5eaccd8a9d81a6a12512566d2b72aa7c100b4a261a08ee6aae4679a9e36b4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
3979WkHCSLO5cQCJAWoE4w7tW4Dv40AW
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:58:20 GMT
x-amz-request-id
MDF5YJ4JPHMV135K
age
22008
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
6467
x-amz-id-2
/0TARI9ylAJTtdJm2wdojYI6Jg6CZKI/p48bHg5JJJxgG8TBC90GLh4JuJBP312yN5EOCZz5/3Q=
x-served-by
cache-yul12823-YUL
last-modified
Sun, 02 Apr 2023 13:49:08 GMT
server
AmazonS3
x-timer
S1687291101.887930,VS0,VE0
etag
"2fdf3e79d5e851201a0d52a886453d8b"
vary
Accept-Encoding
content-type
application/javascript
abp
7
access-control-allow-origin
*
cache-control
private,max-age=14400
accept-ranges
bytes
x-cache-hits
116356
container.html
7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 82D8 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:18 GMT
expires
Wed, 19 Jun 2024 19:58:18 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
collect
stats.g.doubleclick.net/j/ 		4 B
352 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-61435456-5&cid=1182837468.1687291098&jid=1888724706&gjid=682110536&_gid=2078750920.1687291098&_u=aGBACEAiBAAAACgFK~&z=162848163
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Tue, 20 Jun 2023 19:58:21 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
a-04i4
i.liadm.com/s/c/ Frame 1A7C 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d65x5a82x2dqp0kjyedmwh&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.223.184.50 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-184-50.compute-1.amazonaws.com
Software
/
Resource Hash
6ffeafdd2d5299330f3309269caf27336266ee44f677c88132458a06462d623c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-cache, max-age=0
Connection
keep-alive
Content-Encoding
gzip
Content-Length
693
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:58:21 GMT
Request-Time
15
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding
PugMaster
image6.pubmatic.com/AdServer/ Frame 1E1A 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=94505794&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
7ec3afc5719abdc2b576bcc46186598c08f56c4b38e95aae295aaa9e1e436bdd

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Tue, 20 Jun 2023 19:58:20 GMT
content-length
1633
content-type
text/html; charset=UTF-8
usync.js
eus.rubiconproject.com/ Frame E794 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:21 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 08:41:09 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=45784
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 08:41:25 GMT
ImgSync
image8.pubmatic.com/AdServer/ 		0
167 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image8.pubmatic.com/AdServer/ImgSync?p=162935&us_privacy=1---
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:20 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
crum
dsum.casalemedia.com/
Redirect Chain
  • https://dsum.casalemedia.com/pbusermatch?origin=prebid&site_id=945271&p=1&i=0&gdpr=0&gdpr_consent=&us_privacy=1---
  • https://bttrack.com/pixel/cookiesync?source=67e94f23-25d6-4008-8236-375d1743c2e0&secure=1
  • https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=634c3c99-8329-4b19-9a7c-6032b037edd5
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=634c3c99-8329-4b19-9a7c-6032b037edd5
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:21 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=499
Content-Length
43
Expires
0

Redirect headers

x-servername
Track002-iad
pragma
no-cache
date
Tue, 20 Jun 2023 19:57:40 GMT
strict-transport-security
max-age=31536000;
content-type
text/html; charset=utf-8
location
https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=634c3c99-8329-4b19-9a7c-6032b037edd5
cache-control
private,no-cache
content-length
222
expires
-1
xuid
eb2.3lift.com/
Redirect Chain
  • https://eb2.3lift.com/sync?px=1&src=prebid&us_privacy=1---&
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=3658&xuid=120447a6-30d3-414b-b8f9-7a5eddeefdcd&dongle=0cfd&gdpr=0&gdpr_consent=
37 B
354 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=3658&xuid=120447a6-30d3-414b-b8f9-7a5eddeefdcd&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
date
Tue, 20 Jun 2023 19:58:21 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:21 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://eb2.3lift.com/xuid?mid=3658&xuid=120447a6-30d3-414b-b8f9-7a5eddeefdcd&dongle=0cfd&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
251
sync
ads.yieldmo.com/
Redirect Chain
  • https://ads.yieldmo.com/pbcas?us_privacy=1---&gdpr=0&gdpr_consent=&type=image
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=yieldmo
  • https://ads.yieldmo.com/sync?pn_id=rc&id=LJ4PJZ48-27-1JKH
43 B
689 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/sync?pn_id=rc&id=LJ4PJZ48-27-1JKH
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
54.164.127.24 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-164-127-24.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:21 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://ads.yieldmo.com/sync?pn_id=rc&id=LJ4PJZ48-27-1JKH
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
ab995a74221271a8dc253760ec78ee1d
Expires
0
usync.js
eus.rubiconproject.com/ Frame 6922 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:21 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 08:41:09 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=45784
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 08:41:25 GMT
abtests
us-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 		0
362 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/abtests?route=US:US:V&tvi2=10443&lti=deflated&ri=ef1a9f6868acd5f81e84502a73de53bf&sd=v2_4e2b613193d39d9d4e8bc370cab467bb_cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59_1687291097_1687291097_CNawjgYQtdRXGPPii9ONMSABKAEwJjiJ6AdA6vUHSKfL2QNQ____________AVgAYABosrWxmb6uzo3eAXAB&ui=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1687291097459&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22feed-distance-from-article-end%22%2C%22type%22%3A%22932.453125%22%2C%22eventTime%22%3A1687291101158%7D&tim=19%3A58%3A21.159&id=4958&llvl=2&cv=20230620-6-RELEASE&
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:21 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjE1OTUyMjkwMiIsImVidXkiOiIzMTExNzIwODQzIiwiZWFkdiI6IjUyMzM1MDI2MzYiLCJlY2lkIjoiMTM4NDEzNTIwMzUyIiwiZWVudiI6ImoiLCJlcGlkIjoiMjIxMzg1NDYyNDUiLCJlc2lkIjoiMjQyNTMyMTQifQ&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=e1e1fbdf-7455-47b6-9056-10943e21d6af&pid=96430c62-9e9b-4e9e-9c51-bae8ae4a6a48&dtm=1687291100776&qnm=_matherq&visible=1&tabid=a2cbfdc5-fc55-4203-bb3e-307d8f7af5bb&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&vp=1600x1200&ds=4000x8886&tofa=1687291098&vid=1&lvidt=1687291098&duid=db7bf053-61e0-4111-899e-812311da85ef&fp=967226427&cid=ma23578&mrk=239876506
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.162.81.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-162-81-74.compute-1.amazonaws.com
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date
Tue, 20 Jun 2023 19:58:21 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
container.html
7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame AC35 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
3
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:18 GMT
expires
Wed, 19 Jun 2024 19:58:18 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
28292
i6.liadm.com/s/ Frame 1A7C
Redirect Chain
  • https://d.turn.com/r/dd/id/L21rdC8xOTcxL2NpZC8xNzQ5ODczMjc1L3QvMg/url/https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=$!%7BTURN_UUID%7D&us_privacy=1---
  • https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=3617687916288987172&us_privacy=1---
  • https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@&us_privacy=1---
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-hdkX0STfTNt33RYU-jtmrVnq3RNsqMpge4bwPQ&us_privacy=1---
  • https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-hdkX0STfTNt33RYU-jtmrVnq3RNsqMpge4bwPQ&us_privacy=1---&us_privacy=1---
43 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-hdkX0STfTNt33RYU-jtmrVnq3RNsqMpge4bwPQ&us_privacy=1---&us_privacy=1---
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d65x5a82x2dqp0kjyedmwh&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
HTTP/1.1
Server
2600:1f18:ed:550e:4578:8034:184b:4f8b Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:22 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
0
Content-Type
image/gif

Redirect headers

Location
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-hdkX0STfTNt33RYU-jtmrVnq3RNsqMpge4bwPQ&us_privacy=1---&us_privacy=1---
Date
Tue, 20 Jun 2023 19:58:22 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
0
Request-Time
3
362358.gif
idsync.rlcdn.com/ Frame 1A7C
Redirect Chain
  • https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=5837ff19-efdc-41d5-968d-152ebd725d6e&us_privacy=1---
  • https://p.rfihub.com/cm?pub=39342&in=1&userid=eebba6c9-87bf-4ef6-b3de-dcca9f36a268%3A1687291101.4033356&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3Deebba6c9-87bf-4ef6-b3de-dcca9f3...
  • https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=970314640601641075&referrer={encSite}&forward=https%3A%2F%2Fidsync.rlcdn.com%2F501709.gif%3Fpartner_uid%3Deebba6c9-87bf-4ef6-b3d...
  • https://idsync.rlcdn.com/501709.gif?partner_uid=eebba6c9-87bf-4ef6-b3de-dcca9f36a268%3A1687291101.4033356&_=1687291101.407609
  • https://idsync.rlcdn.com/1000.gif?memo=CM3PHhJBCj0IARAFGjdlZWJiYTZjOS04N2JmLTRlZjYtYjNkZS1kY2NhOWYzNmEyNjg6MTY4NzI5MTEwMS40MDMzMzU2EAAaDQjeicikBhIFCOgHEABCAEoA
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESEElp2P1EbzCoQYF9L9zVJE8&google_cver=1
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEElp2P1EbzCoQYF9L9zVJE8&google_cver=1
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d65x5a82x2dqp0kjyedmwh&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
via
1.1 google
content-type
image/gif
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:22 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEElp2P1EbzCoQYF9L9zVJE8&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
289
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
52164
i.liadm.com/s/ Frame 1A7C
Redirect Chain
  • https://x.bidswitch.net/syncd?dsp_id=256&user_group=2&user_id=5837ff19-efdc-41d5-968d-152ebd725d6e&redir=//i.liadm.com/s/52176?bidder_id%3D5298%26bidder_uuid%3D$%7BBSW_UID%7D&us_privacy=1---
  • https://i.liadm.com/s/52176?bidder_id=5298&bidder_uuid=56daf56a-28b1-40e7-a167-b6cb39d3f949
  • https://x.bidswitch.net/sync?ssp=liveintent&user_id=5837ff19-efdc-41d5-968d-152ebd725d6e
  • https://sync.srv.stackadapt.com/sync?nid=50&gdpr=&gdpr_consent=&gdpr_pd=&ssp=liveintent
  • https://x.bidswitch.net/sync?dsp_id=188&user_id=ruPoSpZIUIJ7GLwbam2kAZU4mbs&user_group=1&ssp=liveintent
  • https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=56daf56a-28b1-40e7-a167-b6cb39d3f949
43 B
653 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=56daf56a-28b1-40e7-a167-b6cb39d3f949
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d65x5a82x2dqp0kjyedmwh&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
HTTP/1.1
Server
3.223.184.50 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-184-50.compute-1.amazonaws.com
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:22 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
1
Content-Type
image/gif

Redirect headers

Location
//i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=56daf56a-28b1-40e7-a167-b6cb39d3f949
Date
Tue, 20 Jun 2023 19:58:22 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
35759
i6.liadm.com/s/ Frame 1A7C
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0&us_privacy=1---
  • https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
  • https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
43 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d65x5a82x2dqp0kjyedmwh&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
HTTP/1.1
Server
2600:1f18:ed:550e:4578:8034:184b:4f8b Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:22 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
0
Content-Type
image/gif

Redirect headers

Location
https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
Date
Tue, 20 Jun 2023 19:58:21 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
0
Request-Time
1
img
sync.mathtag.com/sync/ Frame 1A7C 		43 B
443 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.mathtag.com/sync/img?mt_exid=36&5837ff19-efdc-41d5-968d-152ebd725d6e&us_privacy=1---
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d65x5a82x2dqp0kjyedmwh&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
74.121.140.211 Reston, United States, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MT3 1031 59fd23a master iad iad-pixel-x12 config_version:"1969" /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:21 GMT
Server
MT3 1031 59fd23a master iad iad-pixel-x12 config_version:"1969"
Content-Type
image/gif
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
43
Expires
Tue, 20 Jun 2023 19:58:20 GMT
live_intent_sync
x.dlx.addthis.com/e/ Frame 1A7C
Redirect Chain
  • https://x.dlx.addthis.com/e/live_intent_sync?na_exid=5837ff19-efdc-41d5-968d-152ebd725d6e&us_privacy=1---
  • https://x.dlx.addthis.com/e/live_intent_sync?na_exid=5837ff19-efdc-41d5-968d-152ebd725d6e&us_privacy=1---&rd=Y
43 B
594 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.dlx.addthis.com/e/live_intent_sync?na_exid=5837ff19-efdc-41d5-968d-152ebd725d6e&us_privacy=1---&rd=Y
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d65x5a82x2dqp0kjyedmwh&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
H2
Server
23.197.21.62 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-21-62.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=2628000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

expires
Tue, 20 Jun 2023 19:58:22 GMT
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:22 GMT
cache-control
max-age=0, no-cache, no-store
strict-transport-security
max-age=2628000
content-length
43
content-type
image/gif

Redirect headers

location
https://x.dlx.addthis.com/e/live_intent_sync?na_exid=5837ff19-efdc-41d5-968d-152ebd725d6e&us_privacy=1---&rd=Y
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:22 GMT
cache-control
max-age=0, no-cache, no-store
strict-transport-security
max-age=2628000
content-length
0
expires
Tue, 20 Jun 2023 19:58:22 GMT
35004
i.liadm.com/s/ Frame 1A7C
Redirect Chain
  • https://b1sync.zemanta.com/usersync/liveintent/?cb=//i.liadm.com/s/35004?bidder_id%3D98254%26bidder_uuid%3D__ZUID__&us_privacy=1---
  • https://stags.bluekai.com/site/23178?id=enfOlcX9S9Dq6ua2mBcD&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DF4XWSLTMNFQWI3JOMNXW2L3TF4ZTKMBQGQ7WE2LEMRSXEX3JMQ6TSOBS...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=F4XWSLTMNFQWI3JOMNXW2L3TF4ZTKMBQGQ7WE2LEMRSXEX3JMQ6TSOBSGU2CMYTJMRSGK4S7OV2WSZB5MVXGMT3MMNMDSUZZIRYTM5LBGJWUEY2EEZSXQY3IMFXGOZJ5NRUXMZLJNZ2GK...
  • https://i.liadm.com/s/35004?bidder_id=98254&bidder_uuid=enfOlcX9S9Dq6ua2mBcD&us_privacy=1---
43 B
653 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.liadm.com/s/35004?bidder_id=98254&bidder_uuid=enfOlcX9S9Dq6ua2mBcD&us_privacy=1---
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d65x5a82x2dqp0kjyedmwh&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
HTTP/1.1
Server
3.223.184.50 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-184-50.compute-1.amazonaws.com
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:22 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
2
Content-Type
image/gif

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:22 GMT
Content-Type
text/html; charset=utf-8
Location
//i.liadm.com/s/35004?bidder_id=98254&bidder_uuid=enfOlcX9S9Dq6ua2mBcD&us_privacy=1---
P3p
CP="We do not support P3P header."
Cache-Control
no-cache, no-store, must-revalidate
Content-Length
117
Expires
Thu, 01 Dec 1994 16:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame 01C9
Redirect Chain
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&gdpr=0&gdpr=0&khaos=LJ4PJZ48-27-1JKH
  • https://s.amazon-adsystem.com/ecm3?id=LJ4PJZ48-27-1JKH&ex=d-rubiconproject.com&status=ok&gdpr=0
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=LJ4PJZ48-27-1JKH&ex=d-rubiconproject.com&status=ok&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:21 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
C1ZVXZK89PT668QXG0ST
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://s.amazon-adsystem.com/ecm3?id=LJ4PJZ48-27-1JKH&ex=d-rubiconproject.com&status=ok&gdpr=0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
368ba1c92c09ff88b641150fbbf94341
Expires
0
log
protected-by.clarium.io/ Frame 82D8 		0
0
log
protected-by.clarium.io/ Frame 82D8 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.73.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-73-233.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 82D8 		0
0
qzf6dxi5wc8fiu0hxffwm.json
sopalk.com/c/ Frame 71C7 		1 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/c/qzf6dxi5wc8fiu0hxffwm.json?cb=1687291101476
Requested by
Host: sopalk.com
URL: https://sopalk.com/t.js?i=qzf6dxi5wc8fiu0hxffwm&cb=3551011687291100700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-58.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e561b7eb91282aba0090eb6b74465305f2dbfd9c5ff885d344ec2721fe6f978f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
3Iuzq4_MkubxXamFySNQopDhCIqJt6_4
date
Tue, 20 Jun 2023 11:00:58 GMT
via
1.1 34deee8ac34d726c1404a3045667664a.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR53-P1
age
32262
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
1298
last-modified
Tue, 20 Dec 2022 11:07:27 GMT
server
AmazonS3
etag
"e55d9f069a60da5619fc41a69ff8d5d7"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
*
accept-ranges
bytes
x-amz-cf-id
wZvOc84WF3Ihxd62Jhwhjxecwi8dJoYcPHVxkE2gyN99MhOm4s9DjA==
ga-audiences
www.google.com/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-61435456-5&cid=1182837468.1687291098&jid=1888724706&_u=aGBACEAiBAAAACgFK~&z=300508514
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:21 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.ca/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-61435456-5&cid=1182837468.1687291098&jid=1888724706&_u=aGBACEAiBAAAACgFK~&z=300508514
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:21 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame 01C9
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr=0
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=4xWyMjJYQcO_5hLXPrQKYw&rk=usync-na&gdpr=0
  • https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=4xWyMjJYQcO_5hLXPrQKYw&gdpr=0
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=4xWyMjJYQcO_5hLXPrQKYw&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:22 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
XZVB13B2ZBAE4FWVFBGZ
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=4xWyMjJYQcO_5hLXPrQKYw&gdpr=0
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
5c765cf7d1bd0738e8bf9e7ecb99ef6d
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
tap.php
pixel.rubiconproject.com/ Frame 01C9
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&gdpr=0
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEHuWC9X0LNcdrm6NGEM-y4g&google_cver=1
42 B
703 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEHuWC9X0LNcdrm6NGEM-y4g&google_cver=1
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
5c765cf7d1bd0738e8bf9e7ecb99ef6d
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:21 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEHuWC9X0LNcdrm6NGEM-y4g&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
337
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
tap.php
pixel.rubiconproject.com/ Frame 01C9
Redirect Chain
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=&expires=30
42 B
703 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=&expires=30
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
5c765cf7d1bd0738e8bf9e7ecb99ef6d
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:21 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=&expires=30
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
289
setuid
px.ads.linkedin.com/ Frame 01C9
Redirect Chain
  • https://token.rubiconproject.com/token?pid=36584&gdpr=0
  • https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJ4PJZ48-27-1JKH&gdpr=0
0
516 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJ4PJZ48-27-1JKH&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
H2
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 9C642F7E9C7F4C1FA7E3269D6943CA74 Ref B: YMQ01EDGE0615 Ref C: 2023-06-20T19:58:22Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
x-li-proto
http/2
content-length
0
x-li-uuid
AAX+lRLFIO7P2YpwNsulIQ==

Redirect headers

Location
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJ4PJZ48-27-1JKH&gdpr=0
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
368ba1c92c09ff88b641150fbbf94341
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
pixel
cm.g.doubleclick.net/ Frame 01C9
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2249&pt=n&gdpr=0
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=M2U4MjI4NTY5ZjQ5NjFhYzI3MWJlZDM0N2MwNzQyYWY3OTMxZWM0Ng&gdpr=0
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=M2U4MjI4NTY5ZjQ5NjFhYzI3MWJlZDM0N2MwNzQyYWY3OTMxZWM0Ng&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
H3
Server
142.250.80.34 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s34-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:22 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=M2U4MjI4NTY5ZjQ5NjFhYzI3MWJlZDM0N2MwNzQyYWY3OTMxZWM0Ng&gdpr=0
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
368ba1c92c09ff88b641150fbbf94341
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
dcm
aax-eu.amazon-adsystem.com/s/ Frame 01C9 		43 B
855 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.94.223.167 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:22 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
BJW2PTTVBNS628YB9DR1
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
tap.php
pixel.rubiconproject.com/ Frame 01C9
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&gdpr=0
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/MDM0IpdrYKW45v8h_xL498n5EUdSAgOZEtemQ7w0kco?csrc=&gdpr=0
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-Odvt869E2oIsc.OSaSQp_63GFf5WjMoHUfzrtg--~A
42 B
723 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-Odvt869E2oIsc.OSaSQp_63GFf5WjMoHUfzrtg--~A
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
5c765cf7d1bd0738e8bf9e7ecb99ef6d
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date
Tue, 20 Jun 2023 19:58:22 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
location
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-Odvt869E2oIsc.OSaSQp_63GFf5WjMoHUfzrtg--~A
content-length
0
pixel
cm.g.doubleclick.net/ Frame 01C9
Redirect Chain
  • https://token.rubiconproject.com/token?pid=25470&gdpr=0
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TEo0UEpaNDgtMjctMUpLSA==&gdpr=0
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&gdpr=0&google_gid=CAESEMgdr64zSVw6c_wWi0r3Mm8&google_cver=1
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo0UEpaNDgtMjctMUpLSA==&google_push=&gdpr=0
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo0UEpaNDgtMjctMUpLSA==&google_push=&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
H3
Server
142.250.80.34 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s34-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:22 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo0UEpaNDgtMjctMUpLSA==&google_push=&gdpr=0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
5c765cf7d1bd0738e8bf9e7ecb99ef6d
Expires
0
log
protected-by.clarium.io/ Frame AC35 		0
0
log
protected-by.clarium.io/ Frame AC35 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.73.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-73-233.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame AC35 		0
0
async_usersync
ib.adnxs.com/ Frame 123F 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=1922&pub_id=2234281&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1922&pub_id=2234281
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:21 GMT
AN-X-Request-Uuid
98d2c586-9bab-4431-aeea-82f6ae211123
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
vevent
nym1-ib.adnxs.com/ Frame 71C7 		0
959 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&e=wqT_3QKzCqAzBQAAAwDWAAUBCNuJyKQGEKqf1N-t06TvGxjd19yckdOh-DYqNgkAAAECCOg_EQEHNAAA6D8ZAAAAgOtR6D8hERIAKREJADERG7Aw8LDBDTiCD0CCD0gCUK74hL4BWIaMowFgAGi488YBeNilBYABAYoBA1VTRJIFBvReAZgBrAKgAfoBqAEBsAEAuAECwAEEyAEC0AEA2AEA4AEA8AEAigIqdWYoJ2EnLCAyMTk3MjU4LCAwKTt1ZigncicsIDM5ODUzOTgyMiwgMCk7kgLxAyF1MDktTXdpbm9JSWFFSzc0aEw0QkdBQWdob3lqQVRBQU9BQkFBMGlDRDFEd3NNRU5XQUJnalFSb0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRR29BUU93QVFDNUFiN1FUTVVBQU9nX3dRRy0wRXpGQUFEb1A4a0JGeF9NM2JYaV9UX1pBUUFBQUFBQUFQQV80QUVBOVFFQUFBQUFtQUlBb0FJQXRRSUFBQUFBdlFJQUFBQUF3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJ1Z01KVGxsTk1qbzJORFl6NEFQcFE0Z0VBSkFFQUpnRUFjRUVBQUFBQUFBQUFBREpCQQ0LJEFBQTJBUUE4UVEBCwkBHElnRnZ6S3BCERMUUEFfc1FVCRwBAQhNRUYBBwkBBERKFSgMQUFBMC4oAAROay4oALBnQmZqSkJQQUY1b0dyQ2ZnRmlvNkdBWUlHQTFWVFJJZ0dBSkFHQVpnR0FLRUcBTAEBLDZELW9CZ0d5QmlRSgEQDQEAUg0IAQEAWgEFDQEAaA0IUEFBQUM0QmlnLpoCmQEhbHhBODl3aTb1ASxJYU1vd0VnQXlnQU0R6VRPZ19PZ2xPV1UweU9qWTBOak5BNlVOFXkIOEQ5HXkAQh15AEIdeQhCcEEVAQRCeBULGEFCNEFJa0IZEPQ0AUEu2ALWCeACh5wK6gKCAWh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzA2LzIwL21lZ2hhbi1tYXJrbGUtZWFybmVkLW1vcmUtdGhhbi10aGUtd2Vla25kLWZvci1qdXN0LTEyLWhvdXJzLXdvcmstZXgtc3BvdGlmeS1leGVjLXRlbGxzLWJiYy-AAwCIAwGQAwCYAxmgAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEBC90dGqYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANIEDjE5MjIjTllNMjo2NDYz2gQCCAHgBADwBK74hL4BiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAIlYaNgFAeAFAfAFAfoFBAgAEACQBgCYBgC4BgDBBgkhKPA_0AbpBtoGFgoQCREZAXQQABgA4AYB8gYCCACABwGIBwCgBwHIB9ilBdIHDQkRKAEmCNoHBgFdcBgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=e3e6cfd227fe041903887d39d0b2c3eb6268de2f&type=nv&nvt=5&jm=1003&px=2337&py=874&bw=300&bh=250&sid=8437067851529308017&vd=ct~0|rr~0&sv=236&tv=view7-1js&ua=chrome52&pl=win&x=v&tag_id=28334192&sw=1600&sh=1200&pw=4000&ph=8886&ww=1600&wh=1200&ft=2
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:21 GMT
AN-X-Request-Uuid
b59e3bc1-3951-4ccd-8bf6-22ef0e5cb0a4
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.mercurynews.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
pips.taboola.com/ 		64 B
244 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://pips.taboola.com/
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
50629fbe7dd47a2baa94f1b35db2ebf4db8493a978ec9c4832a9318a945bcefe

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-served-by
cache-yyz4543-YYZ
date
Tue, 20 Jun 2023 19:58:21 GMT
via
1.1 varnish
server
Varnish
access-control-allow-methods
GET
x-cache
HIT
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-store
accept-ranges
bytes
content-length
64
retry-after
0
x-cache-hits
0
publishertag.prebid.js
static.criteo.net/js/ld/ 		94 KB
30 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.js
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
bc82310d2b82f3aa74a269e8f679359bda827c649adb41486fd1af268a026ac1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 31 May 2023 13:09:50 GMT
server
nginx
etag
W/"6477471e-176eb"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:58:21 GMT
b9pj45k4
sync-tm.everesttech.net/upi/pid/ Frame 104C 		85 B
259 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Jetty(9.4.35.v20201120) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
cache-control
no-cache
content-length
85
content-type
image/png
date
Tue, 20 Jun 2023 19:58:21 GMT
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma
no-cache
server
Jetty(9.4.35.v20201120)
via
1.1 varnish
x-cache
MISS
x-cache-hits
0
x-served-by
cache-yyz4557-YYZ
x-timer
S1687291102.924361,VS0,VE19
Pug
image2.pubmatic.com/AdServer/ Frame 6177
Redirect Chain
  • https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=970314640601641075
42 B
291 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=970314640601641075
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:58:21 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Content-Length
0
Date
Tue, 20 Jun 2023 19:58:21 GMT
Location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=970314640601641075
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server
Jetty(9.4.51.v20230217)
ecm3
s.amazon-adsystem.com/ Frame 10F0 		43 B
479 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UIDF2EBBF7D-4C79-4F31-B67B-920625C98DEF
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:21 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
x-amz-rid
C70WZWKPCM2BPWGF99V1
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 1E1A
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8uu_fUx5TzG2e5IGJcmN7w%3D%3D&gdpr=0&gdpr_consent=
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
23.77.173.8 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-173-8.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
content-encoding
gzip
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
server
Apache
vary
Accept-Encoding
content-type
text/html
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
max-age=165150
accept-ranges
bytes
content-length
5554
expires
Thu, 22 Jun 2023 17:50:52 GMT

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:21 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
301
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
receive
pixel.tapad.com/idsync/ex/ Frame 1E1A
Redirect Chain
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=F2EBBF7D-4C79-4F31-B67B-920625C98DEF
  • https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3Dc696eff3-e87b-4a1e-ba21-beda78dea841%252C%252C
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=3958812064475458525&pt=c696eff3-e87b-4a1e-ba21-beda78dea841%2C%2C
95 B
123 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=3958812064475458525&pt=c696eff3-e87b-4a1e-ba21-beda78dea841%2C%2C
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H3
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type
image/png
access-control-allow-origin
*
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95

Redirect headers

Date
Tue, 20 Jun 2023 19:58:22 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
8caac21e-1431-478d-9a73-8fd9a799fe5f
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=3958812064475458525&pt=c696eff3-e87b-4a1e-ba21-beda78dea841%2C%2C
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
xuid
eb2.3lift.com/ Frame 1E1A 		37 B
354 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=7976&xuid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&dongle=u6nf&gdpr=0&gdpr_consent=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
date
Tue, 20 Jun 2023 19:58:21 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
insync
thrtle.com/ Frame 1E1A
Redirect Chain
  • https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
  • https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&vxii_pid=12&vxii_pid1=10067&vxii_rcid=9f771fae-b7c1-4809-974b-0f87094c864b
43 B
294 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&vxii_pid=12&vxii_pid1=10067&vxii_rcid=9f771fae-b7c1-4809-974b-0f87094c864b
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
52.6.79.203 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-6-79-203.compute-1.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
CP="NOI OUR BUS UNI COM NAV"
date
Tue, 20 Jun 2023 19:58:22 GMT
content-length
43
content-type
image/gif

Redirect headers

location
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&vxii_pid=12&vxii_pid1=10067&vxii_rcid=9f771fae-b7c1-4809-974b-0f87094c864b
date
Tue, 20 Jun 2023 19:58:21 GMT
content-type
text/html; charset=utf-8
content-length
211
p3p
CP="NOI OUR BUS UNI COM NAV"
Pug
image2.pubmatic.com/AdServer/ Frame 1E1A
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEHV_B9BYoUzouEElUHMVC7Y&google_cver=1
42 B
380 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEHV_B9BYoUzouEElUHMVC7Y&google_cver=1
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:58:22 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:21 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEHV_B9BYoUzouEElUHMVC7Y&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
379
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame 1E1A
Redirect Chain
  • https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:28F7D4B9C0A54A32B1BE3A0226AC86D4
42 B
247 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:28F7D4B9C0A54A32B1BE3A0226AC86D4
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:58:22 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date
Tue, 20 Jun 2023 19:58:22 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:28F7D4B9C0A54A32B1BE3A0226AC86D4
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Mon, 19 Jun 2023 19:58:22 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 1E1A
Redirect Chain
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8818067066479886686&gdpr=0&gdpr_consent=&us_privacy=
1 B
274 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8818067066479886686&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:58:21 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8818067066479886686&gdpr=0&gdpr_consent=&us_privacy=
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:21 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Pug
simage2.pubmatic.com/AdServer/ Frame 1E1A
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=
42 B
394 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 18:08:38 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:21 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
355
integrator.js
adservice.google.com/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.mercurynews.com
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		32 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3467493086232492&correlator=4255088494712239&eid=31073560%2C31075027%2C31075065%2C31074793%2C31070232&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Csponsorship_1&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=300x50%7C320x50&ifi=8&adks=1140109686&didk=1622125026&sfv=1-0-40&ris=2&rcs=2&prev_scp=pos%3DSponsorship_1%26htl_refresh%3D2%26confiant_refresh%3Dtrue&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D425393090679%26rurl%3D%26articleid%3D9968021&sc=1&cookie=ID%3D66c307501df181c9%3AT%3D1687291098%3ART%3D1687291098%3AS%3DALNI_MYS3ohfCtceNj71Z5MuHLNX5CSDAg&gpic=UID%3D00000c52becd70b0%3AT%3D1687291098%3ART%3D1687291098%3AS%3DALNI_MYOkaUD_dpLztX6KsaO9yHoBXDPyw&abxe=1&dt=1687291101964&lmt=1687291101&dlt=1687291095117&idt=2133&adxs=3085&adys=79&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=300x50&msz=300x50&fws=3076&ohw=1254&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvjmCi7W3v6coGzmBboppo-0CB1wp50riqFtURiV_Y2b4Lv9VIXqle5s38h4AYN4TyiSeVVgx_Ue4bR0ytTMWdrqPMep6S4y&ga_vid=1182837468.1687291098&ga_sid=1687291098&ga_hid=1727863478&ga_fc=true&ga_cid=2078750920.1687291098&a3p=EhkKCnVpZGFwaS5jb20Y_eGL040xSABSAghkEhsKDGlkNS1zeW5jLmNvbRjw7YvTjTFIAFICCGoSGQoKcHViY2lkLm9yZxiT5ovTjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y_eGL040xSABSAghk&dblt=testdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdata
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9bd6d9c253dccd4b71b6081a9464bc0a05bf0bc494b5ba5bcb248cffa690233a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13475
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 71C7 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssnxjkYQllkWQP7Kqda6YX_ZItbcWWDy8SKhWsaBqZ-RCufs2qJNzm6W5xgGmzYM5AU2RMsghV3tGPai_30bae3MHd4hd10e723UNE4ecsQoZQsOTk_seCJuhV9YpAvosFvUemRs93R4pbSBB-FSRaKRrVNamZy2Ec452vYBIdJfIlfFcTiPuk7S9LikI_hUII-2RWGRc-wZTLEib4cMVz7eRRZgAHTUa5SzeaEHxpxPAba3aag4l5ZtVk67y-TP_ro4Mus6fyXk_OiuMgpNnY-FZZh3XrdJ7ggAIipoeDnbNfbtyqXfhIJKPExAhMdT1KLHMmCEMd1gW4Z4VaoZ_aZ6zU4wrpIdJ8P3yVECB3AFlQTB1_YCok20WnFTd1rbbswbJzpfM0&sai=AMfl-YTTe7rBPq7XI9W4vgi4GU9hPgE9MMfdpxRNlA-OyZvW6n_beiboMNLQlMGhPRIrTR_hJBBSmCF9r6rBwHzPBFF_C2n7dRILapVhE2y_EJe5zheo6CbKIsGIv7VycQ&sig=Cg0ArKJSzGYv2UCE9BomEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:58:22 GMT
usersync
usersync.gumgum.com/ Frame E794
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&gdpr_consent=undefined&gdpr=0&khaos=LJ4PJZ48-27-1JKH
  • https://usersync.gumgum.com/usersync?b=mag&i=LJ4PJZ48-27-1JKH&gdpr=0&gdpr_consent=undefined
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=mag&i=LJ4PJZ48-27-1JKH&gdpr=0&gdpr_consent=undefined
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol
HTTP/1.1
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:22 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://usersync.gumgum.com/usersync?b=mag&i=LJ4PJZ48-27-1JKH&gdpr=0&gdpr_consent=undefined
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
5c765cf7d1bd0738e8bf9e7ecb99ef6d
Expires
0
cs
cs.yellowblue.io/ Frame 6922
Redirect Chain
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=rise_engage&gdpr_consent=undefined&gdpr=0&khaos=LJ4PJZ48-27-1JKH
  • https://cs.yellowblue.io/cs?aid=11590&id=LJ4PJZ48-27-1JKH&gdpr=0&gdpr_consent=undefined
0
325 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.yellowblue.io/cs?aid=11590&id=LJ4PJZ48-27-1JKH&gdpr=0&gdpr_consent=undefined
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://eus.rubiconproject.com/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://cs.yellowblue.io/cs?aid=11590&id=LJ4PJZ48-27-1JKH&gdpr=0&gdpr_consent=undefined
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
ab995a74221271a8dc253760ec78ee1d
Expires
0
/
cds.taboola.com/ 		0
82 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cds.taboola.com/?uid=cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59&uad=7909ac26c94c9592b7f3d0ce6d28b3921556d78b8bf9c72e91c35f410333685b&mbl=ZmFsc2U=
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.32 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:58:22 GMT
cache-control
no-store
server
nginx
gpt.js
securepubads.g.doubleclick.net/tag/js/ Frame ACDA 		78 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
58e49f6c07c16c606b5def937eb4634c21a1d0ddc13343e5654b9e0c9395035d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
26482
x-xss-protection
0
server
cafe
etag
658 / 19528 / m202306140101 / config-hash: 15645185001691524896
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:58:22 GMT
prebid7.19.0.js
hb.adpone.com/ Frame ACDA 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:49e4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
4279
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=evKcatIE8nkbp50wKp%2F7IiAGnv4%2BYtS9NXioux8wV0tpHWkaGBEs%2F48iL8j7mIm1sl3zKr%2FGAUtYKUMrG%2BlexHj991joHtDbeXwHiQd27PsaBL0ouScds9%2F5EwR4pHGJnFJE%2FSYH1EezjcI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6960c6c680f67-EWR
p.html
sopalk.com/r/ Frame 97F8 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=eqxddgiid&e=1095001190858
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-58.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
45850
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 e5bd532dbdee524acdf00690205f3b5a.cloudfront.net (CloudFront)
x-amz-cf-id
u9K6ilCUyrhPBaiEsofvBBgs47RdAFAiKk4wYMwbifAGCZH7ikCR7g==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
p.html
sopalk.com/r/ Frame 37D1 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=udynfi&e=1095001190858
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-58.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
45850
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 e5bd532dbdee524acdf00690205f3b5a.cloudfront.net (CloudFront)
x-amz-cf-id
Ybld_duZRN0bTxWkgGvqgeu-4zmqix0Z2rfjxFSo-1aSQd8hQmVIjw==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
p.html
sopalk.com/r/ Frame BC0F 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=tmpnmjnvld&e=1095001190858
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-58.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
45850
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 e5bd532dbdee524acdf00690205f3b5a.cloudfront.net (CloudFront)
x-amz-cf-id
kjWpqB80wx3ZPxgY9t80T7m7xHUddWkql5R0erQ1ODDRy_gEHMlrpQ==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
p.html
sopalk.com/r/ Frame 8FB1 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=ibehklirob&e=1095001190858
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-58.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
45850
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 e5bd532dbdee524acdf00690205f3b5a.cloudfront.net (CloudFront)
x-amz-cf-id
Yo3ck870Q3o1IGyy67-XvDIUf-Ol_oz4MppeAz5GnZ0o-05eV0f_Lw==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
p.html
sopalk.com/r/ Frame 2938 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=fumtwxvuy&e=1095001190858
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-58.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
45850
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 e5bd532dbdee524acdf00690205f3b5a.cloudfront.net (CloudFront)
x-amz-cf-id
OGSwO1TNe4bWeqZxyy39EXlIIMAFK0j3gquKofDVEWN_X5KgZAVv7g==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
p.html
sopalk.com/r/ Frame F8C7 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=qcbdufqvuq&e=1095001190858
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-58.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
45850
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 e5bd532dbdee524acdf00690205f3b5a.cloudfront.net (CloudFront)
x-amz-cf-id
4N8dPe92ljJvNJ7X79F5HrVjeLjaNKbVXrkcsf3oAJ5T26c5UCB0jQ==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
p.html
sopalk.com/r/ Frame 3348 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=rubwwfuc&e=1095001190858
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-58.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
45850
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 e5bd532dbdee524acdf00690205f3b5a.cloudfront.net (CloudFront)
x-amz-cf-id
UMHZydUFIyh3VRUEfcKM8EstwDBEjqnoTMsIhZzW3CQZr7Vyn_xWug==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
ads
securepubads.g.doubleclick.net/gampad/ 		35 KB
14 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3467493086232492&correlator=2771046354205909&eid=31073560%2C31075027%2C31075065%2C31074793%2C31070232&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Ctop_leaderboard&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=728x90%7C970x90%7C970x250&ifi=9&adks=142133714&didk=303353385&sfv=1-0-40&ris=2&rcs=2&prev_scp=pos%3Dtop_leaderboard%26htl_refresh%3D2%26confiant_refresh%3Dtrue&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D425393090679%26rurl%3D%26articleid%3D9968021&sc=1&cookie=ID%3D66c307501df181c9%3AT%3D1687291098%3ART%3D1687291098%3AS%3DALNI_MYS3ohfCtceNj71Z5MuHLNX5CSDAg&gpic=UID%3D00000c52becd70b0%3AT%3D1687291098%3ART%3D1687291098%3AS%3DALNI_MYOkaUD_dpLztX6KsaO9yHoBXDPyw&abxe=1&dt=1687291102219&lmt=1687291102&dlt=1687291095117&idt=2133&adxs=1515&adys=323&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=970x90&msz=970x90&fws=1028&ohw=1280&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvjmCi7W3v6coGzmBboppo-0CB1wp50riqFtURiV_Y2b4Lv9VIXqle5s38h4AYN4TyiSeVVgx_Ue4bR0ytTMWdrqPMep6S4y&ga_vid=1182837468.1687291098&ga_sid=1687291098&ga_hid=1727863478&ga_fc=true&ga_cid=2078750920.1687291098&a3p=EhkKCnVpZGFwaS5jb20Y_eGL040xSABSAghkEhsKDGlkNS1zeW5jLmNvbRjw7YvTjTFIAFICCGoSGQoKcHViY2lkLm9yZxiT5ovTjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y_eGL040xSABSAghk&dblt=testdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdata
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a28efcd4ff69a326484b26ac0e2fa77215c8ed8f2d1e80763bf5c506f6980126
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14571
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/ 		254 B
690 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
date
Tue, 20 Jun 2023 19:58:22 GMT
via
1.1 varnish
x-amz-request-id
JFXX7NJ7M2FJYZ6M
age
12343
x-cache
HIT
x-amz-replication-status
COMPLETED
content-length
254
x-amz-id-2
VNuE79zGkuG1WkYkook/LzjO6m8khshs44k88xUnWQ3oapFOdrvCIvii4035AZYl3g9EnhgUwco=
x-served-by
cache-yul12823-YUL
last-modified
Wed, 24 Jun 2015 07:14:11 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
x-timer
S1687291102.245955,VS0,VE0
etag
"dfa7b52c86e56bd67fa4002f6ed19854"
content-type
image/png
abp
99
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
7791
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/ Frame ACDA 		408 KB
126 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/pubads_impl.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5b70d8eb19ca32d244e29e759e816c343be893232978532c9d5943f838e60e0b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 06:48:24 GMT
content-encoding
br
x-content-type-options
nosniff
age
47398
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
129045
x-xss-protection
0
server
cafe
etag
16806126990728334555
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
expires
Wed, 19 Jun 2024 06:48:24 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/ Frame ACDA 		616 B
320 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.mercurynews.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ac888a811086e5e08352c3dc0d0b704206641c37f78b1932c3ca956367aed497
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:58:22 GMT
container.html
7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 5308 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
4
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:18 GMT
expires
Wed, 19 Jun 2024 19:58:18 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
prebid7.19.0.js
hb.adpone.com/ Frame 97F8 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=eqxddgiid&e=1095001190858
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:49e4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
4279
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kjrxBkFKKfbtuZpvW1dph3J7Bn3UPYdP4Te6M2qAdjbJWfH2GY1%2B1wjLFtu277IrBToE9LP52CX5V4eGVQ9aKMVbTZnMRH7G%2FFzgrLLPnRDA%2FQszb4XTvM2P8OtIPlYtxYZ2DhGOliRcgP8%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6960dee7d0f67-EWR
prebid7.19.0.js
hb.adpone.com/ Frame 37D1 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=udynfi&e=1095001190858
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:49e4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
4279
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YnOSTf9iVoOhJSbWLSYaGR%2BaDhE2MOqjaMigv%2BTxHcPxQ15UHnLAVCCOLxDPNYo8nov1GPWJxMqF6BimgKY%2B7k%2FZ3UkiYLncnF1YijTuz7t3EcNj5nk%2B0%2BhZn0Wsp99jkvhO2Tv4QmuNl0M%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6960dee920f67-EWR
prebid7.19.0.js
hb.adpone.com/ Frame BC0F 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=tmpnmjnvld&e=1095001190858
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:49e4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
4279
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yA3dLQs6YFYuF1hZKQSn5P1VNB%2ByRJsQyhAlgpVWM%2BMvrkaFoDIymOtZb8fSN6eQMsIzbz9V62qRVNTZX66ULfcWw%2FiR0gWsh60fuwmv%2BvBwb4Wugj2vc3bXIC1LSTOKjS9BWextEH6pVRk%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6960e0ef10f67-EWR
prebid7.19.0.js
hb.adpone.com/ Frame 8FB1 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=ibehklirob&e=1095001190858
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:49e4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
4279
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x0CTW8aNJoiHCfNQGNhTAnPdO%2FjK7x7I%2B3fYTZEEnM4CE3ytOAvoYdMXeIlRyOcphPkFN1NmOX5PohXsLrG2EvlZGMLAEC93TBxZQeN%2B4%2BLkh1c0OL12q5EVBQr6p3ofa9s%2FRulm94pd9fo%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6960e0ef70f67-EWR
v1
prg.smartadserver.com/prebid/ Frame ACDA 		1 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.0 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
94e650b60acf6e50be7e802f67da8498ab9045196885d191095e5e255ed49c3b

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:22 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame ACDA 		480 B
538 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=%2F21671350435%2C208595991%2F300x250-mercurynews.com&tk_flint=pbjs_lite_v7.19.0&x_source.tid=6a4d68bf-0696-4a73-a80c-76f3e63a5529&l_pb_bid_id=4b9c519ddfc9bb&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.29883055816495707
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:300::99 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
a48d87c0b7d5650d51384f76278057edda56531367bd8258baaa9c944f5a65c2

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:22 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.mercurynews.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
480
expires
Wed, 17 Sep 1975 21:32:10 GMT
cdb
bidder.criteo.com/ Frame ACDA 		0
197 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=4911925014&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:58:21 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
/
prebid.smilewanted.com/ Frame ACDA 		0
312 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da6960eca682c07-ORD
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
translator
hbopenbid.pubmatic.com/ Frame ACDA 		0
63 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:58:21 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
prebid
ib.adnxs.com/ut/v3/ Frame ACDA 		13 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
6996ebcbbdb6064d3bc98f0822f185efe1fc4a2b771c7a3d0ab7e29a14e4177c
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:58:22 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
42bcf75a-cccb-4227-b18e-091c207da824
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.mercurynews.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
openrtb
adx.adform.net/adx/ Frame ACDA 		0
627 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.84 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:22 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
prebid7.19.0.js
hb.adpone.com/ Frame 2938 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=fumtwxvuy&e=1095001190858
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:49e4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
4279
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P4q%2Buu7f%2BTfmTfFxZYLf4mY4piNTdZVqSVdmuJjgo4xWEmGyynL70VeunwsnHoAHQ4uEKk5ECCIVKNyehSxlV5Cu33c3DqfSu3RnJJ6c2X1WQQ4QeyGRd1ziG6iFLEZcU4VUWbLnCRI1JSQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6960e3f420f67-EWR
prebid7.19.0.js
hb.adpone.com/ Frame F8C7 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=qcbdufqvuq&e=1095001190858
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:49e4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
4279
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XF7nYgWl1QTv7SPH7QHzZL8ZyYJOuL%2FQm8rYDMB%2BWe8MUp%2Ffnu22wSsnFAV74I%2FJWdOPxaBSLLsvtFqq%2B4oHDfxYsdzBpHv4eEgFGWVE07bQVnFCvXI15SS2CL2uqYRTb9rcS0mv5zn9VBU%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6960e3f530f67-EWR
prebid7.19.0.js
hb.adpone.com/ Frame 3348 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=rubwwfuc&e=1095001190858
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:49e4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
4279
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XchTq7EpzWhPY2XQn%2BRUI7X5d6L5YyuWqaj2hkNswEBM1OG4OZ%2FCf8gP8lE%2BySGzhNeDFpLynYSKScprmiri6xO51zN9PxUkjXLupkEhBUZIM4eThA4kFSzKQpqYAMKlwWgwFUXxLRFUKms%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6960e3f580f67-EWR
log
protected-by.clarium.io/ Frame 5308 		0
0
log
protected-by.clarium.io/ Frame 5308 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.73.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-73-233.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 5308 		0
0
container.html
7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 8073 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
4
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:18 GMT
expires
Wed, 19 Jun 2024 19:58:18 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
event-stream
k.p-n.io/ 		0
126 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://k.p-n.io/event-stream
Requested by
Host: cdn.p-n.io
URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=kxKkF9MK5Eh8oIGD7DDm6lvkHUj6DuIrCOQh&ver=6.2.2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.6.180.113 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-6-180-113.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
content-type
text/plain

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:58:22 GMT
access-control-allow-headers
*
access-control-max-age
600
access-control-allow-methods
*
index.js
cdn.pranmcpkx.com/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.pranmcpkx.com/index.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/7991) /
Resource Hash
6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:58:22 GMT
content-encoding
gzip
content-md5
nynBpfvYghYqzIzsvfssRw==
age
207324
x-cache
HIT
content-length
2382
x-ms-lease-status
unlocked
last-modified
Fri, 17 Jun 2022 17:08:13 GMT
server
ECAcc (nya/7991)
etag
0x8DA5083F65AD9E0
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
x-ms-request-id
771178af-101e-005f-22ce-a14382000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
event-stream
k.p-n.io/ 		0
125 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://k.p-n.io/event-stream
Requested by
Host: cdn.p-n.io
URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=kxKkF9MK5Eh8oIGD7DDm6lvkHUj6DuIrCOQh&ver=6.2.2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.6.180.113 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-6-180-113.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
content-type
text/plain

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:58:22 GMT
access-control-allow-headers
*
access-control-max-age
600
access-control-allow-methods
*
log
protected-by.clarium.io/ Frame 8073 		0
0
log
protected-by.clarium.io/ Frame 8073 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.73.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-73-233.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:58:22 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 8073 		0
0
/
prebid.smilewanted.com/ Frame 97F8 		0
73 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da696123df62c07-ORD
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
v1
prg.smartadserver.com/prebid/ Frame 97F8 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.0 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
50be14a91ffbdf3c61032b2928cf5428487d098c95a77b05a4a7e4e968e257e5

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:22 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 97F8 		346 B
418 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687291102368&tk_flint=pbjs_lite_v7.19.0&x_source.tid=326bfe57-d8c5-45d7-bc37-19c947f18d25&l_pb_bid_id=635a7bcea2f2f2&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.0671602258033801
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:300::99 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
b4d8b4da9350b936073ac3daf82910803670c88f6a5c25887d771f1423baf771

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://sopalk.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
346
expires
Wed, 17 Sep 1975 21:32:10 GMT
cdb
bidder.criteo.com/ Frame 97F8 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=76187624339&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:58:22 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
translator
hbopenbid.pubmatic.com/ Frame 97F8 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:58:22 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
prebid
ib.adnxs.com/ut/v3/ Frame 97F8 		15 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
2c2c784f3e7e2763223d246c1d7b3a2e2b98bd5c005c5f585042da5c2b7259fe
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:58:23 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
4b4908a2-65ec-45c5-8a8f-50b9da312c21
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
openrtb
adx.adform.net/adx/ Frame 97F8 		0
619 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.84 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
openrtb
adx.adform.net/adx/ Frame 37D1 		0
619 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.84 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
v1
prg.smartadserver.com/prebid/ Frame 37D1 		994 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.0 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
a66d49bc3e3826c00383689d422a6ba78dc03d534fd1bc96bc50027b97f78c47

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:22 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
/
prebid.smilewanted.com/ Frame 37D1 		0
36 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da696125e122c07-ORD
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 37D1 		346 B
381 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687291102376&tk_flint=pbjs_lite_v7.19.0&x_source.tid=5cd96d37-e42b-4f1f-a10d-43520ee8e00c&l_pb_bid_id=86fec0d684e539&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.07778292650362983
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:300::99 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
9f2692b4c971b6a04ef943de0878ddeeca750e7f009fc85b7eaa646bccbb5290

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://sopalk.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
346
expires
Wed, 17 Sep 1975 21:32:10 GMT
cdb
bidder.criteo.com/ Frame 37D1 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=7834232055&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:58:22 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
prebid
ib.adnxs.com/ut/v3/ Frame 37D1 		13 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4639393dcd0ab58ce405486125e2696f793b0ce54c16b4f7a9831cc3a4c1cd6f
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:58:23 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
186b94ac-d3a3-471c-bfa2-3fb44eec1e0a
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
translator
hbopenbid.pubmatic.com/ Frame 37D1 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:58:21 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
integrator.js
adservice.google.com/adsid/ Frame ACDA 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.mercurynews.com
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ Frame ACDA 		35 KB
14 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2482955454090949&correlator=834630116909039&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=21671350435%3A208595991%2C300x250-mercurynews.com&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=1&adks=187146907&didk=1653906094&sfv=1-0-40&prev_scp=hb_format_appnexus%3Dbanner%26hb_size_appnexus%3D300x250%26hb_pb_appnexus%3D0.00%26hb_adid_appnexus%3D158fc4426cf8a83%26hb_bidder_appnexus%3Dappnexus%26hb_format%3Dbanner%26hb_size%3D300x250%26hb_pb%3D0.00%26hb_adid%3D158fc4426cf8a83%26hb_bidder%3Dappnexus&eri=1&sc=1&cookie=ID%3D66c307501df181c9%3AT%3D1687291098%3ART%3D1687291098%3AS%3DALNI_MYS3ohfCtceNj71Z5MuHLNX5CSDAg&gpic=UID%3D00000c52becd70b0%3AT%3D1687291098%3ART%3D1687291098%3AS%3DALNI_MYOkaUD_dpLztX6KsaO9yHoBXDPyw&abxe=1&dt=1687291103085&lmt=1687291103&dlt=1687291102044&idt=413&adxs=2338&adys=874&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=7b2coamm2tqu&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=2&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&top=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=23&vis=1&psz=300x250&msz=300x0&fws=256&ohw=0&ea=0&ga_vid=2078750920.1687291098&ga_sid=1687291103&ga_hid=2081834584&ga_fc=true&a3p=EhkKCnVpZGFwaS5jb20Y_eGL040xSABSAghkEhsKDGlkNS1zeW5jLmNvbRjw7YvTjTFIAFICCGoSGQoKcHViY2lkLm9yZxiT5ovTjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y_eGL040xSABSAghk
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9c90f89738ccfabcf8efe982431cb34af8b0799ffc773b917a9030c4c15b3008
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14699
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/getconfig/ Frame ACDA 		15 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202306140101&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e985202d7b74f3bee4ed6174b6fd0d49dc03f51a8d0b36c0c4a2b8fe32364310
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11232
x-xss-protection
0
container.html
cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame A64B 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:23 GMT
expires
Wed, 19 Jun 2024 19:58:23 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
/
prebid.smilewanted.com/ Frame BC0F 		0
36 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da696129e682c07-ORD
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
cdb
bidder.criteo.com/ Frame BC0F 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=46282229821&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:58:22 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
openrtb
adx.adform.net/adx/ Frame BC0F 		0
619 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.84 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
translator
hbopenbid.pubmatic.com/ Frame BC0F 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:58:22 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame BC0F 		346 B
381 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687291102390&tk_flint=pbjs_lite_v7.19.0&x_source.tid=4b5de880-a86c-48ee-8337-65e6df0ceef9&l_pb_bid_id=10dc714be0cb0b5&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.8372029459168755
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:300::99 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
e70ff8ef92586d3efeec1e4e340a94e9e51263be5056883e3ed0777054b9c78d

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://sopalk.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
346
expires
Wed, 17 Sep 1975 21:32:10 GMT
prebid
ib.adnxs.com/ut/v3/ Frame BC0F 		17 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
84b393cf7797232dc29d4fc9fc4c40fd9599a9dca8b42d3dfc44b565aabdc152
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:58:23 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
80a856b3-ab72-4bb9-9417-f69870adb9e3
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
v1
prg.smartadserver.com/prebid/ Frame BC0F 		989 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.0 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
c5cf2d8a000a59f5ca421f8cbe9cc0d82a45ba2f8d995fa16621c0f354eae1f7

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:22 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
/
prebid.smilewanted.com/ Frame 8FB1 		0
36 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da69612ae822c07-ORD
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
translator
hbopenbid.pubmatic.com/ Frame 8FB1 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:58:23 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 8FB1 		346 B
381 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687291102395&tk_flint=pbjs_lite_v7.19.0&x_source.tid=ca19ec38-b673-45f0-872d-3c20b3aff8c6&l_pb_bid_id=6c46b668c5c4f1&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.7399515240610162
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:300::99 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
276faeaf9d33ceb5423b609ba36b6d9652353977c61458b8e9130d059870f7b6

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://sopalk.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
346
expires
Wed, 17 Sep 1975 21:32:10 GMT
prebid
ib.adnxs.com/ut/v3/ Frame 8FB1 		17 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
19cf62598d79a5aefd372b5a0d49e5d8707bf9466b18582822fb1d00206c4ca3
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:58:23 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
9b2d07a3-ef0f-4026-ba03-7e4ddf46e780
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
openrtb
adx.adform.net/adx/ Frame 8FB1 		0
619 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.84 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
cdb
bidder.criteo.com/ Frame 8FB1 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=59281059340&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:58:22 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
v1
prg.smartadserver.com/prebid/ Frame 8FB1 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.0 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
d1919bf0d2b3e6b6515a0859dfb9966d76ca96e9ff27ddbfb6c3c8f252223012

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:22 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
v1
prg.smartadserver.com/prebid/ Frame 2938 		1001 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.0 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
ddade1a46b9718110f9f2da49a59af2692a32689553f8e9a1ace3fe5c426b2b7

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:22 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
cdb
bidder.criteo.com/ Frame 2938 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=82744256238&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:58:23 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
prebid
ib.adnxs.com/ut/v3/ Frame 2938 		15 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
0df040d8905696581aef6d13820ef1247a4bc3dd834c8d018717f9b7ca8da9c9
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:58:23 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
3ce5ef01-c942-42f6-bca3-aa4d35d84e73
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
prebid.smilewanted.com/ Frame 2938 		0
36 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da69612bea82c07-ORD
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
translator
hbopenbid.pubmatic.com/ Frame 2938 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:58:23 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 2938 		346 B
381 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687291102417&tk_flint=pbjs_lite_v7.19.0&x_source.tid=f1e2d1b0-b89c-4767-b1f2-71ea04286fe9&l_pb_bid_id=12a5538f8614b52&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.20860868555750822
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:300::99 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
0920d1b752bb81c97a4c069e057baba5e374276e3e083c76480493f594379c07

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://sopalk.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
346
expires
Wed, 17 Sep 1975 21:32:10 GMT
openrtb
adx.adform.net/adx/ Frame 2938 		0
619 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.84 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
openrtb
adx.adform.net/adx/ Frame 3348 		0
619 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.84 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
translator
hbopenbid.pubmatic.com/ Frame 3348 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:58:22 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
/
prebid.smilewanted.com/ Frame 3348 		0
36 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da69612ded22c07-ORD
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
prebid
ib.adnxs.com/ut/v3/ Frame 3348 		13 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
abe6d535e85eb415042aa3dcaac597d0e3d77ca7a5f7f7b2c59330f592305927
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:58:23 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
0f9eaa00-4710-4c81-87a3-72e3adcc2326
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cdb
bidder.criteo.com/ Frame 3348 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=71986813515&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:58:22 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 3348 		346 B
381 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687291102424&tk_flint=pbjs_lite_v7.19.0&x_source.tid=e86dc66b-c209-4444-bf8f-269c6fe75e6c&l_pb_bid_id=125989d9194a2d4&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.9663003133366008
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:300::99 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
968e70b795f2e2dbddb5a2f72ecb21dea793e8e83fff6bbdb7596a81904212c2

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://sopalk.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
346
expires
Wed, 17 Sep 1975 21:32:10 GMT
v1
prg.smartadserver.com/prebid/ Frame 3348 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.0 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
c39f52b470f03d5420edf48b5920e0b572de669ef780e8aa5b763761a29318f3

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:22 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
/
prebid.smilewanted.com/ Frame F8C7 		0
36 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da69612eee02c07-ORD
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
cdb
bidder.criteo.com/ Frame F8C7 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=72233898874&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:58:22 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
openrtb
adx.adform.net/adx/ Frame F8C7 		0
619 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.84 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
prebid
ib.adnxs.com/ut/v3/ Frame F8C7 		144 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
458c6aaf0d95748b153f982ffc22b9422a7628a3f1b488d0738ddc5419c6d7b0
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:23 GMT
AN-X-Request-Uuid
2e74bcc1-e930-46ff-b592-58509b355502
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
application/json; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
144
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame F8C7 		346 B
381 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687291102420&tk_flint=pbjs_lite_v7.19.0&x_source.tid=4c9a7698-c449-4cb4-bf35-58948ab58a9d&l_pb_bid_id=1065c3aa01139ea&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.6117481088300072
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:300::99 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
2ba9f6db8197931985739a30b9452a0f226ccfc1d2661912f84bc2aedbc4c74c

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://sopalk.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
346
expires
Wed, 17 Sep 1975 21:32:10 GMT
v1
prg.smartadserver.com/prebid/ Frame F8C7 		890 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.0 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
20c6f265ea521fc93792a5a13c5ab229fb6cc9d4aabf69eef36227e1a412880e

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:22 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
translator
hbopenbid.pubmatic.com/ Frame F8C7 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:58:23 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
sodar2.js
tpc.googlesyndication.com/sodar/ Frame ACDA 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 20 Jun 2023 19:58:23 GMT
dcmads.js
www.googletagservices.com/dcm/ Frame C7FE 		16 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:46:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
726
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6830
x-xss-protection
0
last-modified
Wed, 24 May 2023 18:59:20 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Tue, 20 Jun 2023 20:46:17 GMT
trk.js
cdn.adnxs.com/v/s/236/ Frame C7FE 		80 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
Fri, 14 Jun 2024 13:01:02 GMT
Date
Tue, 20 Jun 2023 19:58:23 GMT
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Age
457040
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
27646
X-Served-By
cache-lga21928-LGA, cache-yul12825-YUL
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
X-Timer
S1687291103.439198,VS0,VE0
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
5, 687755
it
nym1-ib.adnxs.com/ Frame C7FE 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.mercurynews.com%252F&e=wqT_3QLyDfBM8gYAAAMA1gAFAQjficikBhDHiI7L-MOjnmsY3dfcnJHTofg2KjYJQoLix5i7dj8RnoMEGNhbcT8ZAAAAgML18D8hnoMEGNhbcT8pQYIJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXjIzQWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW8LCSAvkFIUpwOFpaZ2pnaC1JYUVMeVcxODBCR0FBZ3VhdVhBVEFCT0FCQUFFajFaRkR1MzhFTldBQmdqUVJvQUhBQWVBQ0FBUUNJQVFDUUFRR1lBUUdnQVFLb0FRS3dBUUM1QWZhLVNUakRESDRfd1FIaGRkNzB3c0IyUDhrQkFBQUFBTUpUN2pfWkFUWTh2VktXSWZVXzRBSDBxdm9EOVFHaThmOC1tQUlBb0FJQ3RRSUEBMwh2UUkBB9hBd0FJQXlBSUEwQUlBMkFJQTRBSUE2QUlBLUFJQWdBTUJtQU1Cb2dNT0NOU2JoeXNRQWhnQ0xRATvwVUNpQXhjSXNvbkFMQkFHR0FFdGl1aTVOeklIWkdWbVlYVnNkS0lERmdqdXVzQXNFQW9ZQVMwUW5uSV9NZ1oxYm1seGRXV2lBdzRJMUp1SEt4QUxHQUl0AVpkQUxvRENVNVpUVEk2TlRZeE1PQUQ2VVBwQXcFHgUBQDhBUGZFNEFFbTRubkNvZ0VuAQi4cEFFQVpnRUJMSUVDZ2prd3BrTkVLNnp0QTI2QkJvSW5na1JLVnlQd3ZVb3pEOFoFSQkBIGc1TUtaRGNFRRkgCF9KQgkcBQEYMkFRRDhRUQUMBQHwUklJRkh3aWh5eVVRQlJnQklnTkRRVVFwTmp5OVVwWWg5VDh4UW1EbDBDTGJ5VC1JQmVvcmtBWEM5azZZQlpmYTRvY0JxUVhUcEJSMGUwbnRQN0VGBVgFAQhEQkIdazx5UVVBQUFDQW1jSFNQOUVGBSMFAQREWhUouFBBXzRBV3JCUEFGMXBpSEN2Z0ZyUDNRQW9JR0EwTkJSSWdHQkpBR0FaZ0dBS0VHBT8FASRDb0JnU3lCaVFKBQ8JAQBSCQcFAQBaBQYJAQBoCQcBATxDNEJnby6aAsUBIUhDTkhfPv0CLExtcmx3RWdBQ2dBTR3NTE9nbE9XVTB5T2pVMk1UQkE2VU5KOTUAOR15AEIdeQRCaDmZBDlwAX8JAQRCeAkIAQEUQjRBSUlCqpUBBEpBEZj0mwFQQV_YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA8xMjkxNyNOWU0yOjU2MTDaBAIIAeAEAfAEvJbXzQGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWo4Eb6BQQIABAAkAYAmAYAogYPMTAyNjQjTllNMjo2MjA1uAYAwQYAAAAAAADwP9AGnqsC2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGhwEIwvZOEoABTHhSdFZsb0FBQUFEQUFrQ0JRRUkwUEwzQnhDLTFib0NHT3lFbHdNZ0J5Z0FRTEMwdWdkSXY3VzZCMURwUTFpOU1IRUFBQUFBQUFBQUFIZ0FnUUVBQUFBIdtcQUFJZ0JBSkFCQUpvQkFnZ0FxQUVBc1FFCRwFAXguLoAHAYgHAKAHAboHCCoEMS0tLUAByAfIzQXSBw0JLrcAjNoHBggAEAAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=551b2a4bf19fbd5e898fbf32dcc409379b96df2d
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:23 GMT
AN-X-Request-Uuid
486b6545-470b-41eb-a99d-0ded4263ceee
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
dcmads.js
www.googletagservices.com/dcm/ Frame AF75 		16 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:46:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
726
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6830
x-xss-protection
0
last-modified
Wed, 24 May 2023 18:59:20 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Tue, 20 Jun 2023 20:46:17 GMT
apn
beacon.sojern.com/imp/ Frame AF75 		42 B
229 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.sojern.com/imp/apn?auc=6115578807624363956&cr=435294756&seg=&st=0&bp=0.02029&pp=0.02029&aaid=&idfa=&ord=747924248
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
119.244.178.107.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
date
Tue, 20 Jun 2023 19:58:23 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
vary
Accept-Encoding
content-type
image/gif
ca
choices.truste.com/ Frame AF75 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.truste.com/ca?pid=sojern01&aid=sojern02_d&cid=0&c=747924248&sz=300x250&js=st_dapp
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.146.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-146-97.ewr52.r.cloudfront.net
Software
nginx /
Resource Hash
3cef1864f3b4a587c446729a5ee0eb8ae906ec76154e956b797e467c653d0024
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 57a894c75d329d29ecabaa7a88eb80a4.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
EWR52-C2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
918
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
gV6ECjNwvyMNo9t8TCHwCH_LhSCKa9wXIcaJ3lXDWZsafv6Y3I8uOg==
expires
Mon, 26 Jul 1997 05:00:00 GMT
trk.js
cdn.adnxs.com/v/s/236/ Frame AF75 		80 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
Fri, 14 Jun 2024 13:01:02 GMT
Date
Tue, 20 Jun 2023 19:58:23 GMT
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Age
457040
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
27646
X-Served-By
cache-lga21928-LGA, cache-yul12825-YUL
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
X-Timer
S1687291103.454719,VS0,VE0
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
5, 687756
it
nym1-ib.adnxs.com/ Frame AF75 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.mercurynews.com%252F&e=wqT_3QKdCvBMHQUAAAMA1gAFAQjficikBhC03-3C4dC571QY3dfcnJHTofg2KjYJ2Ey-2ebGlD8RiMfMpbtijz8ZAAAAgML18D8hiMfMpbtijz8p10wJJPCaMQAAACCF67E_MO7fwQ04mFBA6j9IAlCkpMjPAVi5q5cBYABopq60AXifuwWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCU3VmKCdhJywgNzc1OTExOCwgMCk7dWYoJ2knLCA4MzI2ODg2LCAwKTt1ZignZycsIDIxMTcyNjg2LCANKfCfcicsIDQzNTI5NDc1NiwgMCk7kgKBBCE2R1JEUmdqMXFlY2FFS1NreU04QkdBQWd1YXVYQVRBQU9BQkFBRWpxUDFEdTM4RU5XQUJnalFSb0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRR29BUUd3QVFDNUFXSUFMeEZGeHBRX3dRRmlBQzhSUmNhVVA4a0JBQUFBQUFBQThEX1pBUUFBQQEPdFBBXzRBSG1uZndEOVFITnpNdzltQUlBb0FJQnRRSQEiBEF2DQjwVXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQnVnTUpUbGxOTWpvME9USXc0QVBwUTRBRTZLUHZDb2dFLWFQdkNwQUVBWmdFQWNFRUFBBWMUQUFBREpCAQcNARgyQVFBOFFRDQ5gQUFBSWdGdUNhcEJkT2tGSFI3U2UwX3NRVQEaCQEYTUVGbXBtWgECEHVUX0pCATscSURWOThrXzAuKAAITmtGCTEAQSEIsGdCZTBQOEFYT280d0stQVdPeXRrRGdnWURWVk5FaUFZQWtBWUJtQVlBb1FhYQFcOG1abTVQNmdHQkxJR0pBaxFLCEFBQh3LBEJrGRgAQx0YRExnR0NnLi6aApkBIUlCWW1nQToFAjRMbXJsd0VnQUNnQU1acQFtYFptYmtfT2dsT1dVMHlPalE1TWpCQTZVTkoRYgw4RDlSEQwMQUFCWh0MAGgdDABwHQwAeB0MDDRBSWs1ePQOAThEOC7YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA44MTcwI05ZTTI6NDkyMNoEAggB4AQB8ASkpMjPAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBYUC-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBugp2gYWChAJERkBoBAAGADgBgHyBgIIAIAHAYgHAKAHAboHCCoEMS0tLUAByAefuwXSBw0JETMBMQzaBwYIBQlo4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=f347e8de8c602f7559e751ffddbc490365f1e19f
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:23 GMT
AN-X-Request-Uuid
5b83f95d-47fa-4eac-be78-e4f0f555c4e6
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
dcmads.js
www.googletagservices.com/dcm/ Frame E9F9 		16 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:46:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
726
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6830
x-xss-protection
0
last-modified
Wed, 24 May 2023 18:59:20 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Tue, 20 Jun 2023 20:46:17 GMT
trk.js
cdn.adnxs.com/v/s/236/ Frame E9F9 		80 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
Fri, 14 Jun 2024 13:01:02 GMT
Date
Tue, 20 Jun 2023 19:58:23 GMT
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Age
457040
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
27646
X-Served-By
cache-lga21928-LGA, cache-yul12825-YUL
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
X-Timer
S1687291103.468731,VS0,VE0
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
5, 687757
it
nym1-ib.adnxs.com/ Frame E9F9 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.mercurynews.com%252F&e=wqT_3QLmF_BM5gsAAAMA1gAFAQjficikBhC4952ngO65rTsY3dfcnJHTofg2KjYJQoLix5i7dj8RnoMEGNhbcT8ZAAAAgML18D8hnoMEGNhbcT8pQYIJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlDspYrNAVi5q5cBYABopq60AXiPvAWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFjByJywgNDMwMDg0ODQ0BRbwsJIC7Q8hb0p4d2lBamdoLUlhRU95bGlzMEJHQUFndWF1WEFUQUJPQUJBQUVqMVpGRHUzOEVOV0FCZ2pRUm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUUtvQVFLd0FRQzVBZmEtU1RqRERINF93UUhoZGQ3MHdzQjJQOGtCQUFBQUFNSlQ3al9aQVRZOHZWS1dJZlVfNEFIMHF2b0Q5UUdpOGY4LW1BSUFvQUlDdFFJQQEzCHZRSQEH2EF3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJvZ01PQ05TYmh5c1FBaGdDTFEBO_BVQ2lBeGNJc29uQUxCQUdHQUV0aXVpNU56SUhaR1ZtWVhWc2RLSURGZ2p1dXNBc0VBb1lBUzBRbm5JX01nWjFibWx4ZFdXaUF3NEkxSnVIS3hBTEdBSXQBWmRBTG9EQ1U1WlRUSTZORGszT09BRDZVUHBBdwUeBQFAOEFQZkU0QUVtNG5uQ29nRW4BCDxwQUVBWmdFQktvRXN3Y0lfHQEIQVJEHQ4MOEJHUB0PCHdFZx0ODF9BU2odDwg4Qk02LAAANB0dCF9BVTZYAABTMiwABEZRMiwAAFY2WAAAWTYsAABvMiwAAFg2WAAAZTIsAAxHQUFmHS4Id0dJOhAAAFE6EAAsWUFlWVZvQUVCcUFIHTkIOEJzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQABwtQUcwQklBQx2lDF9BWWc2EAAAWjogAABaOiAAAGE6IAAAYTogAABiOiAAAGI6IAAAYzogAABjOiAAAGQ6IAAAZDogAABlOiAAAGU6IAAAZjogAABmOiAABFlBLv0BIQA2EAAAWjogAABaOiAAAGE6IAAAYTogAABiOiAAAGI6IAAAYzogAABjOiAAAGQ6IAAAZDogABBlQURBTzoUAABmOjQAAGY6IAAIWUFFOvQBNhAAAFo6IAAAWjogAABhOiAAAGE6IAAAYjogAABiOiAAAGM6IAAAYzogAABkOiAAAGQ6IAAAZTogAABlOiAAAGY6IAAAZjogAAhZQUY6AAE2EAAAWjogAABaOiAAmGJJRUNnamt3cGtORUs2enRBMjZCQm9JbmdrUktWeVB3dlVvekQ4WqU9CQEgZzVNS1pEY0VFGSAIX0pCCRwFARgyQVFEOFFRBQwFAfBSSUlGSHdpaHl5VVFCUmdCSWdORFFVUXBOank5VXBZaDlUOHhRbURsMENMYnlULUlCZklta0FYQzlrNllCWmZhNG9jQnFRWFRwQlIwZTBudFA3RUYFWAUBCERCQh1rPHlRVUFBQUNBbWNIU1A5RUYFIwUBBERaFSi4UEFfNEFXckJQQUYxcGlIQ3ZnRnJQM1FBb0lHQTBOQlJJZ0dCSkFHQVpnR0FLRUcFPwUBJENvQmdTeUJpUUoFDwkBAFIJBwUBAFoFBgkBAGgJBwEBQEM0QmdvLpoCxQEhSGlQZF9ROvEHLExtcmx3RWdBQ2dBTR3NTE9nbE9XVTB5T2pRNU56aEE2VU5KOTUAOR15AEIdeQRCaDmZBDlwAX8JAQRCeAkIAQEUQjRBSUlCqpUBBEpBEZj0mwFQQV_YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA8xMjkxNyNOWU0yOjQ5NzjaBAIIAeAEAfAE7KWKzQGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWo4Eb6BQQIABAAkAYAmAYAogYPMTAyNjQjTllNMjo1Mjc4uAYAwQYAAAAAAADwP9AGnqsC2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGhwEIwvZOEoABQ1JSNlQxb0FBQUFEQUFrQ0JRRUkwUEwzQnhDLTFib0NHT3lFbHdNZ0J5Z0FRTEMwdWdkSXY3VzZCMURwUTFpZUtYRUFBQUFBQUFBQUFIZ0FnUUVBQUFBIdtcQUFJZ0JBSkFCQUpvQkFnZ0FxQUVBc1FFCRwFAXguLoAHAYgHAKAHAboHCCoEMS0tLUAByAePvAXSBw0JLrcAjNoHBggAEAAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=e6985053eaec936706312eb92177b9567a77e069
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:23 GMT
AN-X-Request-Uuid
7d9a4ee9-9c34-42a8-ba8b-ce08fafd2351
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
dcmads.js
www.googletagservices.com/dcm/ Frame CFF2 		16 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:46:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
726
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6830
x-xss-protection
0
last-modified
Wed, 24 May 2023 18:59:20 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Tue, 20 Jun 2023 20:46:17 GMT
trk.js
cdn.adnxs.com/v/s/236/ Frame CFF2 		80 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
Fri, 14 Jun 2024 13:01:02 GMT
Date
Tue, 20 Jun 2023 19:58:23 GMT
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Age
457040
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
27646
X-Served-By
cache-lga21928-LGA, cache-yul12825-YUL
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
X-Timer
S1687291103.487457,VS0,VE0
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
5, 687758
it
nym1-ib.adnxs.com/ Frame CFF2 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.mercurynews.com%252F&e=wqT_3QLuF_BM7gsAAAMA1gAFAQjficikBhDdzrn74PvfsHMY3dfcnJHTofg2KjYJQoLix5i7dj8RnoMEGNhbcT8ZAAAAgML18D8hnoMEGNhbcT8pQYIJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlDspYrNAVi5q5cBYABopq60AXi70wOAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFjByJywgNDMwMDg0ODQ0BRbwsJIC9Q8hUUo0N19RamdoLUlhRU95bGlzMEJHQUFndWF1WEFUQUJPQUJBQUVqMVpGRHUzOEVOV0FCZ2pRUm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUUtvQVFLd0FRQzVBZmEtU1RqRERINF93UUhoZGQ3MHdzQjJQOGtCQUFBQUFNSlQ3al9aQVRZOHZWS1dJZlVfNEFIMHF2b0Q5UUdpOGY4LW1BSUFvQUlDdFFJQQEzCHZRSQEH2EF3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJvZ01PQ05TYmh5c1FBaGdDTFEBO_BVQ2lBeGNJc29uQUxCQUdHQUV0aXVpNU56SUhaR1ZtWVhWc2RLSURGZ2p1dXNBc0VBb1lBUzBRbm5JX01nWjFibWx4ZFdXaUF3NEkxSnVIS3hBTEdBSXQBWmRBTG9EQ1U1WlRUSTZOVEkyTU9BRDZVUHBBdwUeBQFAOEFQZkU0QUVtNG5uQ29nRW4BCExwQUVBWmdFQktBRUZLb0Vzd2NJXx0BCEFSRB0ODDhCR1AdDwh3RWcdDgxfQVNqHQ8IOEJNNiwAADQdHQhfQVU2WAAAUzIsAARGUTIsAABWNlgAAFk2LAAAbzIsAABYNlgAAGUyLAAMR0FBZh0uCHdHSToQAABROhAALFlBZVlWb0FFQnFBSB05CDhCczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAcLUFHMEJJQUMdpQxfQVlnNhAAAFo6IAAAWjogAABhOiAAAGE6IAAAYjogAABiOiAAAGM6IAAAYzogAABkOiAAAGQ6IAAAZTogAABlOiAAAGY6IAAAZjogAARZQS79ASEANhAAAFo6IAAAWjogAABhOiAAAGE6IAAAYjogAABiOiAAAGM6IAAAYzogAABkOiAAAGQ6IAAQZUFEQU86FAAAZjo0AABmOiAACFlBRTr0ATYQAABaOiAAAFo6IAAAYTogAABhOiAAAGI6IAAAYjogAABjOiAAAGM6IAAAZDogAABkOiAAAGU6IAAAZTogAABmOiAAAGY6IAAIWUFGOgABNhAAAFo6IAAAWjogAJhiSUVDZ2prd3BrTkVLNnp0QTI2QkJvSW5na1JLVnlQd3ZVb3pEOFqlQQkBIGc1TUtaRGNFRRkgCF9KQgkcBQEYMkFRRDhRUQUMBQHwUklJRkh3aWh5eVVRQlJnQklnTkRRVVFwTmp5OVVwWWg5VDh4UW1EbDBDTGJ5VC1JQll3cGtBWEM5azZZQlpmYTRvY0JxUVhUcEJSMGUwbnRQN0VGBVgFAQhEQkIdazx5UVVBQUFDQW1jSFNQOUVGBSMFAQREWhUouFBBXzRBV3JCUEFGMXBpSEN2Z0ZyUDNRQW9JR0EwTkJSSWdHQkpBR0FaZ0dBS0VHBT8FASRDb0JnU3lCaVFKBQ8JAQBSCQcFAQBaBQYJAQBoCQcBAVBDNEJnckFCNUFEmgLFASFEeU81OXc6-QcsTG1ybHdFZ0FDZ0FNHdFMT2dsT1dVMHlPalV5TmpCQTZVTko5OQA5HX0AQh19BEJoOZ0EOXABgwkBBEJ4CQgBARRCNEFJSUKqmQEESkERmPSbAVBBX9gCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL4ADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTg3qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDzEyOTE3I05ZTTI6NTI2MNoEAggB4AQB8ATspYrNAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBajgRvoFBAgAEACQBgCYBgCiBg8xMDI2NCNOWU0yOjQ0ODa4BgDBBgAAAAAAAPA_0AaeqwLaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gaHAQjC9k4SgAFfeFBXVGxvQUFBQURBQWtDQlFFSTBQTDNCeEMtMWJvQ0dPeUVsd01nQnlnVVFMQzB1Z2RJdjdXNkIxRHBRMWlHSTNFQUFBQUFBQUFBQUhnQWdRRUFBQUEh21xBQUlnQkFKQUJBSm9CQWdnQXFBRUFzUUUJHAUBeC4ugAcBiAcAoAcBugcIKgQxLS0tQAHIB7vTA9IHDQkutwCM2gcGCAAQABgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=1d654395f1c4930733225080ac2bf4dd75359115
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:23 GMT
AN-X-Request-Uuid
23bcb4ce-795c-4b1e-a815-60a36c7423cd
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
container.html
cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 156C 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:23 GMT
expires
Wed, 19 Jun 2024 19:58:23 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 0DC9 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
57639
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 03:57:44 GMT
expires
Wed, 19 Jun 2024 03:57:44 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame D87D 		783 B
534 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
8618b7faa3860c9994a18e59bec9c2f152b798e26b657990f466e7e9bb8594e2
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-TjuSCxpqq4-LXNen8Io-OA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-length
512
content-security-policy
script-src 'report-sample' 'nonce-TjuSCxpqq4-LXNen8Io-OA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:23 GMT
expires
Tue, 20 Jun 2023 19:58:23 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
impl_v96.js
www.googletagservices.com/dcm/ Frame C7FE 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v96.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 08:23:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
560097
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20157
x-xss-protection
0
last-modified
Mon, 22 May 2023 16:41:33 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 13 Jun 2024 08:23:26 GMT
impl_v96.js
www.googletagservices.com/dcm/ Frame AF75 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v96.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 08:23:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
560097
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20157
x-xss-protection
0
last-modified
Mon, 22 May 2023 16:41:33 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 13 Jun 2024 08:23:26 GMT
impl_v96.js
www.googletagservices.com/dcm/ Frame E9F9 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v96.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 08:23:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
560097
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20157
x-xss-protection
0
last-modified
Mon, 22 May 2023 16:41:33 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 13 Jun 2024 08:23:26 GMT
impl_v96.js
www.googletagservices.com/dcm/ Frame CFF2 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v96.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 08:23:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
560097
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20157
x-xss-protection
0
last-modified
Mon, 22 May 2023 16:41:33 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 13 Jun 2024 08:23:26 GMT
5111
8proof.com/app/rtbmarkup/ Frame E8F2 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://8proof.com/app/rtbmarkup/5111?id=515477663289&ctd=110096&crid=1178&ap=ZJIE3wACLGsKs_uOAAd70dmLTSCv8aULrQ7qBg
Requested by
Host: cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com
URL: https://cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.116.53.150 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
96.35.7434.ip4.static.sl-reverse.com
Software
nginx /
Resource Hash
15b6c9e16fbb45357885cc0c935ea6546b4ddbec62e22f432871f0019e76ccf0

Request headers

Referer
https://cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-encoding
gzip
content-type
text/html;charset=utf-8
date
Tue, 20 Jun 2023 19:58:23 GMT
server
nginx
vary
Accept-Encoding
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230615/r20110914/client/ Frame 156C 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230615/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com
URL: https://cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
30dd4d046ee0a560951014c2c3f71fb0b620af27279bd7c5ff8b4ac877214291
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:09:51 GMT
content-encoding
br
x-content-type-options
nosniff
age
6512
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8121
x-xss-protection
0
server
cafe
etag
8940155340736220798
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 04 Jul 2023 18:09:51 GMT
l
www.google.com/ads/measurement/ Frame 156C 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTwUAnWsTOXnuSBzN5Pm9yfXgoqkLBmY2ywgf5YiA0oNOvNN4_i5ZB2Qui6VTfvwxs9osenrnr-EaRPW1Al0M4bIniNvQ
Requested by
Host: cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com
URL: https://cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
ext.js
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 156C 		24 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js
Requested by
Host: cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com
URL: https://cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 03:58:00 GMT
content-encoding
br
x-content-type-options
nosniff
age
57623
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6402
x-xss-protection
0
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Wed, 19 Jun 2024 03:58:00 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 156C 		178 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com
URL: https://cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57029
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1686742752845198"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:58:23 GMT
B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=zghk5r;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P0eEY4kfj...
ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/ Frame C7FE 		65 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=zghk5r;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P0eEY4kfjjxr3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoACSb2TQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HCNH_gjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjU2MTBA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1NjEw%2Fbn%3D91848%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=109;prcl=s
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v96.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.64.70 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s30-in-f6.1e100.net
Software
cafe /
Resource Hash
c2242c272fff953716d39aa11fa0641d72c1665ad340d3a8d203a60a9a5f3fab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30082
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
script.js
acdn.adnxs-simple.com/strikeforce/ Frame 5269 		122 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs-simple.com/strikeforce/script.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.172.245 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-172-245.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
f63b683b181032b37e4b8a3fe5d001edc0b40a8df47c66b7966e2e7242f0226d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:23 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 May 2023 16:21:53 GMT
Server
nginx/1.18.0 (Ubuntu)
ETag
W/"645bc4a1-1e7fc"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Length
43711
Expires
Wed, 21 Jun 2023 19:58:25 GMT
trk.js
cdn.adnxs.com/v/s/236/ Frame 5269 		80 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
Fri, 14 Jun 2024 13:01:02 GMT
Date
Tue, 20 Jun 2023 19:58:23 GMT
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Age
457040
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
27646
X-Served-By
cache-lga21928-LGA, cache-yul12825-YUL
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
X-Timer
S1687291104.703965,VS0,VE0
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
5, 687759
it
nym1-ib.adnxs.com/ Frame 5269 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.mercurynews.com%252F&e=wqT_3QLyDfBM8gYAAAMA1gAFAQjficikBhDBmpD5n5mRiG0Y3dfcnJHTofg2KjYJQoLix5i7dj8RnoMEGNhbcT8ZAAAAgML18D8hnoMEGNhbcT8pQYIJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXi4_gWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW8LCSAvkFIU81LUVkUWpnaC1JYUVMeVcxODBCR0FBZ3VhdVhBVEFCT0FCQUFFajFaRkR1MzhFTldBQmdqUVJvQUhBQWVBQ0FBUUNJQVFDUUFRR1lBUUdnQVFLb0FRS3dBUUM1QWZhLVNUakRESDRfd1FIaGRkNzB3c0IyUDhrQkFBQUFBTUpUN2pfWkFUWTh2VktXSWZVXzRBSDBxdm9EOVFHaThmOC1tQUlBb0FJQ3RRSUEBMwh2UUkBB9hBd0FJQXlBSUEwQUlBMkFJQTRBSUE2QUlBLUFJQWdBTUJtQU1Cb2dNT0NOU2JoeXNRQWhnQ0xRATvwVUNpQXhjSXNvbkFMQkFHR0FFdGl1aTVOeklIWkdWbVlYVnNkS0lERmdqdXVzQXNFQW9ZQVMwUW5uSV9NZ1oxYm1seGRXV2lBdzRJMUp1SEt4QUxHQUl0AVpkQUxvRENVNVpUVEk2TmpJMk11QUQ2VVBwQXcFHgUBQDhBUGZFNEFFbTRubkNvZ0VuAQi4cEFFQVpnRUJMSUVDZ2prd3BrTkVLNnp0QTI2QkJvSW5na1JLVnlQd3ZVb3pEOFoFSQkBIGc1TUtaRGNFRRkgCF9KQgkcBQEYMkFRRDhRUQUMBQHwUklJRkh3aWh5eVVRQlJnQklnTkRRVVFwTmp5OVVwWWg5VDh4UW1EbDBDTGJ5VC1JQmZZd2tBWEM5azZZQlpmYTRvY0JxUVhUcEJSMGUwbnRQN0VGBVgFAQhEQkIdazx5UVVBQUFDQW1jSFNQOUVGBSMFAQREWhUouFBBXzRBV3JCUEFGMXBpSEN2Z0ZyUDNRQW9JR0EwTkJSSWdHQkpBR0FaZ0dBS0VHBT8FASRDb0JnU3lCaVFKBQ8JAQBSCQcFAQBaBQYJAQBoCQcBAUBDNEJnby6aAsUBIUlDUG5fdzr9AixMbXJsd0VnQUNnQU0dzUxPZ2xPV1UweU9qWXlOakpBNlVOSjk1ADkdeQBCHXkEQmg5mQQ5cAF_CQEEQngJCAEBFEI0QUlJQqqVAQRKQRGY9JsBUEFf2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20vgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xODeoBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQPMTI5MTcjTllNMjo2MjYy2gQCCAHgBAHwBLyW180BiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFqOBG-gUECAAQAJAGAJgGAKIGDzEwMjY0I05ZTTI6NjQzNrgGAMEGAAAAAAAA8D_QBp6rAtoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgHyBocBCML2ThKAAUdCUXlVbG9BQUFBREFBa0NCUUVJMFBMM0J4Qy0xYm9DR095RWx3TWdCeWdBUUxDMHVnZEl2N1c2QjFEcFExaWtNbkVBQUFBQUFBQUFBSGdBZ1FFQUFBQSHbXEFBSWdCQUpBQkFKb0JBZ2dBcUFFQXNRRQkcBQF4Li6ABwGIBwCgBwG6BwgqBDEtLS1AAcgHuP4F0gcNCS63AIzaBwYIABAAGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=3de7662d0d9a5d7d1ca499caa713d1296eec2f66
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:23 GMT
AN-X-Request-Uuid
0cfbe331-0646-4f0e-9403-f1600e5732f4
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
B29664373.364307181;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;aucid=6115578807624363956;crid=435294756;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%2...
ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/ Frame AF75 		65 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B29664373.364307181;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;aucid=6115578807624363956;crid=435294756;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=3210668679;ord=5k1ecx;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F2Ey-2ebGlD-Ix8ylu2KPPwAAAIDC9fA_iMfMpbtijz_XTL7Z5saUP7RvWxiG5t5U3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAA6h8AAAIAAAAkEvIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAoCu1owAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IBYmgAj1qecaEKSkyM8BGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjQ5MjBA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjQ5MjA%3D%2Fbn%3D89503%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=131;prcl=s
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v96.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.64.70 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s30-in-f6.1e100.net
Software
cafe /
Resource Hash
69a53fcf3211dade6aa649c3997d535142fe9eeee467952fa52ce847cea7605d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29765
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dcmads.js
www.googletagservices.com/dcm/ Frame ED8E 		16 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:46:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
726
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6830
x-xss-protection
0
last-modified
Wed, 24 May 2023 18:59:20 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Tue, 20 Jun 2023 20:46:17 GMT
apn
beacon.sojern.com/imp/ Frame ED8E 		42 B
101 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.sojern.com/imp/apn?auc=8797412763273810965&cr=435294756&seg=&st=0&bp=0.02029&pp=0.02029&aaid=&idfa=&ord=11181583
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
119.244.178.107.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
date
Tue, 20 Jun 2023 19:58:23 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
vary
Accept-Encoding
content-type
image/gif
ca
choices.truste.com/ Frame ED8E 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.truste.com/ca?pid=sojern01&aid=sojern02_d&cid=0&c=11181583&sz=300x250&js=st_dapp
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.146.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-146-97.ewr52.r.cloudfront.net
Software
nginx /
Resource Hash
3cef1864f3b4a587c446729a5ee0eb8ae906ec76154e956b797e467c653d0024
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 57a894c75d329d29ecabaa7a88eb80a4.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
EWR52-C2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
918
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
F1FIin1fM_8dpUrVws-YdJreJUziIvSocU51jH9y06E4bebM78cy6Q==
expires
Mon, 26 Jul 1997 05:00:00 GMT
trk.js
cdn.adnxs.com/v/s/236/ Frame ED8E 		80 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
Fri, 14 Jun 2024 13:01:02 GMT
Date
Tue, 20 Jun 2023 19:58:23 GMT
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Age
457040
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
27646
X-Served-By
cache-lga21928-LGA, cache-yul12825-YUL
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
X-Timer
S1687291104.720536,VS0,VE0
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
5, 687760
it
nym1-ib.adnxs.com/ Frame ED8E 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.mercurynews.com%252F&e=wqT_3QKhCvBMIQUAAAMA1gAFAQjficikBhCVqLHLwomsi3oY3dfcnJHTofg2KjYJ2Ey-2ebGlD8RiMfMpbtijz8ZAAAAgML18D8hiMfMpbtijz8p10wJJPCaMQAAACCF67E_MO7fwQ04mFBA6j9IAlCkpMjPAVi5q5cBYABopq60AXjf1wOAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCU3VmKCdhJywgNzc1OTExOCwgMCk7dWYoJ2knLCA4MzI2ODg2LCAwKTt1ZignZycsIDIxMTcyNjg2LCANKfCfcicsIDQzNTI5NDc1NiwgMCk7kgKFBCFsMldqZUFqMXFlY2FFS1NreU04QkdBQWd1YXVYQVRBQU9BQkFBRWpxUDFEdTM4RU5XQUJnalFSb0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRR29BUUd3QVFDNUFXSUFMeEZGeHBRX3dRRmlBQzhSUmNhVVA4a0JBQUFBQUFBQThEX1pBUUFBQQEPdFBBXzRBSG1uZndEOVFITnpNdzltQUlBb0FJQnRRSQEiBEF2DQjwWHdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQnVnTUpUbGxOTWpvMU1UWTA0QVBwUTRBRTZLUHZDb2dFLWFQdkNwQUVBWmdFQWFBRUZNRUVBBWYBAQhESkIBBw0BGDJBUUE4UVENDmBBQUFJZ0ZyQ2lwQmRPa0ZIUjdTZTBfc1FVARoJARhNRUZtcG1aAQIQdVRfSkIBOxxJRFY5OGtfMC4oAAhOa0YJMQBBIQywZ0JlMFA4QVhPbzR3Sy1BV095dGtEZ2dZRFZWTkVpQVlBa0FZQm1BWUFvUWFhAVw4bVptNVA2Z0dCTElHSkFrEUsMQUFCRR0MAGsZDABDHRhETGdHQ2cuLpoCmQEhSVJaamdBOgkCNExtcmx3RWdBQ2dBTVpxAW1gWm1ia19PZ2xPV1UweU9qVXhOalJBNlVOShFiDDhEOVIRDAxBQUJaHQwAaB0MAHAdDAB4HQwMNEFJazV49A4BOEQ4LtgCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL4ADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTg3qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDjgxNzAjTllNMjo1MTY02gQCCAHgBAHwBKSkyM8BiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFhQL6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AG6CnaBhYKEAkRGQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBugcIKgQxLS0tQAHIB9_XA9IHDQkRMwExDNoHBggFCWjgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=efbe8ab91cf2e4c8d8cd22cb7084cb99632b21b0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:23 GMT
AN-X-Request-Uuid
bacb0f23-90ad-43bf-9a1b-3c1451627e1e
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
B29652998.363876445;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;dc_adk=3062143102;ord=fhkvmd;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9Bg...
ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/ Frame E9F9 		65 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29652998.363876445;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;dc_adk=3062143102;ord=fhkvmd;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P7h75wRw51o73SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAADskqIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAbCfotgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HiPd_Qjgh-IaEOylis0BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjQ5NzhA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo0OTc4%2Fbn%3D89615%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=144;prcl=s
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v96.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.64.70 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s30-in-f6.1e100.net
Software
cafe /
Resource Hash
8a3814b54ebad0a60fe9e422bbfeb58847ea0fafc34984e232118c453de8ed15
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29822
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
B29652998.363876445;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;dc_adk=2878691012;ord=kj0n7c;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9Bg...
ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/ Frame CFF2 		65 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29652998.363876445;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;dc_adk=2878691012;ord=kj0n7c;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P11nbg_ef2Fz3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAADskqIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoA1CYrggAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521DyO59wjgh-IaEOylis0BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjUyNjBA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1MjYw%2Fbn%3D59835%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=166;prcl=s
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v96.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.64.70 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s30-in-f6.1e100.net
Software
cafe /
Resource Hash
cfa0f62e6945357df2151c78ce2c2f6083267f272f1f3e50256df685024e13af
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29885
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame D87D 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202306140101&jk=2482955454090949&rc=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
truncated
/ Frame 156C 		212 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
81cf69699c0d25e95029c3c986dda4e5e40dcf7983247704cc7b59178d5488fd

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
montserrat-v25-latin-800.woff2
cdn.8proof.com/ads/assets/fonts/ Frame E8F2 		0
0
montserrat-v25-latin-600.woff2
cdn.8proof.com/ads/assets/fonts/ Frame E8F2 		0
0
F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
pagead2.googlesyndication.com/bg/ Frame 0DC9 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:35:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
1357
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14698
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:35:46 GMT
impl_v96.js
www.googletagservices.com/dcm/ Frame ED8E 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v96.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 08:23:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
560097
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20157
x-xss-protection
0
last-modified
Mon, 22 May 2023 16:41:33 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 13 Jun 2024 08:23:26 GMT
1a
i.clean.gg/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://i.clean.gg/1a
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.95.69.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
49.69.95.34.bc.googleusercontent.com
Software
nginx/1.21.6 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://sopalk.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
access-control-max-age
1728000
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/plain; charset=utf-8
date
Tue, 20 Jun 2023 19:58:23 GMT
server
nginx/1.21.6
via
1.1 google
1a
i.clean.gg/ Frame 5269 		0
104 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://i.clean.gg/1a
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.95.69.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
49.69.95.34.bc.googleusercontent.com
Software
nginx/1.21.6 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
via
1.1 google
server
nginx/1.21.6
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Range
access-control-allow-headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
dcmads.js
www.googletagservices.com/dcm/ Frame 5269 		16 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:46:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
726
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6830
x-xss-protection
0
last-modified
Wed, 24 May 2023 18:59:20 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Tue, 20 Jun 2023 20:46:17 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame AF75 		178 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B29664373.364307181;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;aucid=6115578807624363956;crid=435294756;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=3210668679;ord=5k1ecx;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F2Ey-2ebGlD-Ix8ylu2KPPwAAAIDC9fA_iMfMpbtijz_XTL7Z5saUP7RvWxiG5t5U3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAA6h8AAAIAAAAkEvIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAoCu1owAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IBYmgAj1qecaEKSkyM8BGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjQ5MjBA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjQ5MjA%3D%2Fbn%3D89503%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=131;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57029
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1686742752845198"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:58:23 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/ Frame AF75 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/omrhp.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B29664373.364307181;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;aucid=6115578807624363956;crid=435294756;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=3210668679;ord=5k1ecx;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F2Ey-2ebGlD-Ix8ylu2KPPwAAAIDC9fA_iMfMpbtijz_XTL7Z5saUP7RvWxiG5t5U3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAA6h8AAAIAAAAkEvIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAoCu1owAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IBYmgAj1qecaEKSkyM8BGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjQ5MjBA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjQ5MjA%3D%2Fbn%3D89503%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=131;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:09:52 GMT
content-encoding
br
x-content-type-options
nosniff
age
6511
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4172
x-xss-protection
0
server
cafe
etag
5499578052516643378
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 04 Jul 2023 18:09:52 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame AF75 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuLQ6DqxsMVUpAvhE-jjlU2GYnajTfADB5bJ27HmO58d-CIaNkWjrynuR2Tvc16bYiu_5vdqBpqUamHn6d9I27Y-Dr1_rKYvg6JKsCEwkp2Cd0r0XDoNXzZ81eeKuEA-1SJOBw7ADsc3XcuexlwyL3emDFqxXc0VqpqFwyhHVPw&sai=AMfl-YSu4MFX7TOeyfRFFYSH5tLgFkOTcmQyfnfnuZEruWi2Vt7qUbe-ZBshboDRaTqYm0zDLHy0CBJcWfvOwuSyTnaXnMWUzvnMPsJkYQ&sig=Cg0ArKJSzGGmzW0J8vGYEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20230615.28243&arae=0&ftch=1&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B29664373.364307181;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;aucid=6115578807624363956;crid=435294756;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=3210668679;ord=5k1ecx;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F2Ey-2ebGlD-Ix8ylu2KPPwAAAIDC9fA_iMfMpbtijz_XTL7Z5saUP7RvWxiG5t5U3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAA6h8AAAIAAAAkEvIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAoCu1owAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IBYmgAj1qecaEKSkyM8BGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjQ5MjBA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjQ5MjA%3D%2Fbn%3D89503%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=131;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:58:23 GMT
ca
choices.truste.com/ Frame AF75 		28 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=29664373&js=st0
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B29664373.364307181;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;aucid=6115578807624363956;crid=435294756;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=3210668679;ord=5k1ecx;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F2Ey-2ebGlD-Ix8ylu2KPPwAAAIDC9fA_iMfMpbtijz_XTL7Z5saUP7RvWxiG5t5U3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAA6h8AAAIAAAAkEvIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAoCu1owAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IBYmgAj1qecaEKSkyM8BGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjQ5MjBA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjQ5MjA%3D%2Fbn%3D89503%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=131;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.146.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-146-97.ewr52.r.cloudfront.net
Software
nginx /
Resource Hash
7d36e30ddc7fac7fea357014c5e349ea9b553f85bda1a56d84d78bd1cc3e5667
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 57a894c75d329d29ecabaa7a88eb80a4.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
EWR52-C2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
8034
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
Gukuc-PMfoTNx_LNGIXixkBZZ2yGEFpdSfJVvjvYnfHz0r6ZQ-BqTQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame AF75 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B29664373.364307181;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;aucid=6115578807624363956;crid=435294756;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=3210668679;ord=5k1ecx;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F2Ey-2ebGlD-Ix8ylu2KPPwAAAIDC9fA_iMfMpbtijz_XTL7Z5saUP7RvWxiG5t5U3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAA6h8AAAIAAAAkEvIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAoCu1owAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IBYmgAj1qecaEKSkyM8BGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjQ5MjBA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjQ5MjA%3D%2Fbn%3D89503%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=131;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:09:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6512
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Jun 2024 18:09:51 GMT
15113160214351814612
s0.2mdn.net/simgad/ Frame AF75 		66 KB
67 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/simgad/15113160214351814612
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=udynfi&e=1095001190858
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2006 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
72fd07e085058fb4525cae979b256d00a8a5daa16ea4732d38915d183e573b25
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 11:11:39 GMT
x-content-type-options
nosniff
age
550004
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
67760
x-xss-protection
0
last-modified
Tue, 04 Apr 2023 21:46:05 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 13 Jun 2024 11:11:39 GMT
dcm
beacon.sojern.com/imp/ Frame AF75 		42 B
56 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.sojern.com/imp/dcm?auc=6115578807624363956&io=${INSERTION_ORDER_ID}&li=${CAMPAIGN_ID}&cr=435294756&io=${INSERTION_ORDER_ID}&seg=${PIXEL_ID_COMMA}&src=${SOURCE_URL}&ord=%c
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=udynfi&e=1095001190858
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
119.244.178.107.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
date
Tue, 20 Jun 2023 19:58:23 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
vary
Accept-Encoding
content-type
image/gif
px
secure.adnxs.com/ Frame AF75
Redirect Chain
  • https://pixel.sojern.com/pixel/img/291730?p_v=1&f_v=v3_image&vid=hot
  • https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=tQADXm_ozub1-yT97yixrQ&google_nid=sojern__adx_open_bidder_seat&sjrn_id=ZNScVm_8HzJKfQzLZEqQCojagGvKxO8iZGmAhGfwwPJ1B3mbN7w1PXkF57m1bpkS&s...
  • https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=ZNScVm_8HzJKfQzLZEqQCojagGvKxO8iZGmAhGfwwPJ1B3mbN7w1PXkF57m1bpkS&sjrn_r=aHR0cHM6Ly9zZWN1cmUuYWRueHMuY29tL3B4P2lkPTE1Mjg5NjEmdD0x&sjrn_...
  • https://secure.adnxs.com/px?id=1528961&t=1
0
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.adnxs.com/px?id=1528961&t=1
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=udynfi&e=1095001190858
Protocol
HTTP/1.1
Server
68.67.181.211 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:24 GMT
AN-X-Request-Uuid
7b62617a-7e72-419d-9461-f6723597c383
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
application/javascript; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

date
Tue, 20 Jun 2023 19:58:24 GMT
via
1.1 google
vary
Accept-Encoding
content-type
image/gif
location
https://secure.adnxs.com/px?id=1528961&t=1
p3p
policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
ca
choices.trustarc.com/ Frame AF75 		27 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?sz=300x250&c=747924248&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0
Requested by
Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02_d&cid=0&c=747924248&sz=300x250&js=st_dapp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
25cfa100e98d444ccd37bdc5481f7af9ec68876226f8b718fe8c75d20675b1e0
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
sIWnYino1bFEc76CE1TjpKUKyUqkh-1NWliRY3OaU766RjwrSN9row==
expires
Mon, 26 Jul 1997 05:00:00 GMT
B29664373.364307181;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;aucid=8797412763273810965;crid=435294756;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_C...
ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/ Frame ED8E 		65 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B29664373.364307181;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;aucid=8797412763273810965;crid=435294756;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=730607261;ord=lulog8;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F2Ey-2ebGlD-Ix8ylu2KPPwAAAIDC9fA_iMfMpbtijz_XTL7Z5saUPxVUbClMsBZ63SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAA6h8AAAIAAAAkEvIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoA9imnFgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IRZjgAj1qecaEKSkyM8BGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjUxNjRA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjUxNjQ%3D%2Fbn%3D60383%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=67;prcl=s
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v96.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.64.70 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s30-in-f6.1e100.net
Software
cafe /
Resource Hash
c624e866cbaa055c978d2fe5ea4b50c49f3ee600553ada6d8dc76b9020c36911
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:23 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29850
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame E9F9 		178 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29652998.363876445;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;dc_adk=3062143102;ord=fhkvmd;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P7h75wRw51o73SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAADskqIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAbCfotgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HiPd_Qjgh-IaEOylis0BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjQ5NzhA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo0OTc4%2Fbn%3D89615%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=144;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57029
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1686742752845198"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:58:23 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/ Frame E9F9 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/omrhp.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29652998.363876445;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;dc_adk=3062143102;ord=fhkvmd;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P7h75wRw51o73SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAADskqIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAbCfotgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HiPd_Qjgh-IaEOylis0BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjQ5NzhA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo0OTc4%2Fbn%3D89615%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=144;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:09:52 GMT
content-encoding
br
x-content-type-options
nosniff
age
6511
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4172
x-xss-protection
0
server
cafe
etag
5499578052516643378
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 04 Jul 2023 18:09:52 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame E9F9 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssqYZFtjlJm7eiHdaj_O-WXSwKKrWcVGRXYpftN-m8lba6SEjhv7tnDzdDd6S8njT48xw1cnZZ0Wdfi92hQ_nZ1BvhjjRskqKKpr7gTvL_TUCsLguUe6_aldyqjuJ5YKVzYHWLy6PlET5IyM5Fp6BAQlJjfU2J1Hm-iWktGDgnk2nE&sai=AMfl-YRfMgGQTTFCScX92RSa4lwpImEK4zMAcGkgH3syMObJsyWwsj84WDcoAFdAyXWx9CYCi3GyweY73nyjqUcPypAuocLPnlNnWJmrBQ&sig=Cg0ArKJSzOAnDfE_euZFEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20230615.93298&arae=0&ftch=1&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29652998.363876445;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;dc_adk=3062143102;ord=fhkvmd;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P7h75wRw51o73SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAADskqIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAbCfotgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HiPd_Qjgh-IaEOylis0BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjQ5NzhA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo0OTc4%2Fbn%3D89615%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=144;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:58:23 GMT
dvtp_src.js
cdn.doubleverify.com/ Frame E9F9 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dvtp_src.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29652998.363876445;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;dc_adk=3062143102;ord=fhkvmd;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P7h75wRw51o73SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAADskqIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAbCfotgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HiPd_Qjgh-IaEOylis0BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjQ5NzhA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo0OTc4%2Fbn%3D89615%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=144;prcl=s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:9000::6875:b612 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
UploadServer /
Resource Hash
856ed99804bf5b83c5c70314917f7b561f06bfb50cc10ed5430a8fca2c40f246

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:24 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Jun 2023 14:39:49 GMT
Server
UploadServer
ETag
"6bbda2156609c9b24e1e0e365f01b513"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
*
Cache-Control
max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3374
Expires
Sun, 18 Jun 2023 14:55:16 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame E9F9 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29652998.363876445;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;dc_adk=3062143102;ord=fhkvmd;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P7h75wRw51o73SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAADskqIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAbCfotgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HiPd_Qjgh-IaEOylis0BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjQ5NzhA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo0OTc4%2Fbn%3D89615%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=144;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:09:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6512
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Jun 2024 18:09:51 GMT
13481351336222288159
s0.2mdn.net/simgad/ Frame E9F9 		37 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/simgad/13481351336222288159
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=ibehklirob&e=1095001190858
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2006 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e5477888a979c7b864fafa6a3de860371886602af3e9d0be3f838e7c10dd5500
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 09:11:47 GMT
x-content-type-options
nosniff
age
557196
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37802
x-xss-protection
0
last-modified
Wed, 07 Jun 2023 19:19:20 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 13 Jun 2024 09:11:47 GMT
async_usersync.html
acdn.adnxs.com/dmp/ Frame 2B47 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=ibehklirob&e=1095001190858
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.172.245 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-172-245.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:23 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:58:25 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Unused62
8096267
Vary
Accept-Encoding
rd_log
nym1-ib.adnxs.com/ Frame E9F9 		0
933 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QL9GfBM_QwAAAMA1gAFAQjficikBhC4952ngO65rTsY3dfcnJHTofg2KjYJQoLix5i7dj8RnoMEGNhbcT8ZAAAAgML18D8hnoMEGNhbcT8pQYIJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlDspYrNAVi5q5cBYABopq60AXiPvAWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFjByJywgNDMwMDg0ODQ0BRbwsJIC7Q8hb0p4d2lBamdoLUlhRU95bGlzMEJHQUFndWF1WEFUQUJPQUJBQUVqMVpGRHUzOEVOV0FCZ2pRUm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUUtvQVFLd0FRQzVBZmEtU1RqRERINF93UUhoZGQ3MHdzQjJQOGtCQUFBQUFNSlQ3al9aQVRZOHZWS1dJZlVfNEFIMHF2b0Q5UUdpOGY4LW1BSUFvQUlDdFFJQQEzCHZRSQEH2EF3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJvZ01PQ05TYmh5c1FBaGdDTFEBO_BVQ2lBeGNJc29uQUxCQUdHQUV0aXVpNU56SUhaR1ZtWVhWc2RLSURGZ2p1dXNBc0VBb1lBUzBRbm5JX01nWjFibWx4ZFdXaUF3NEkxSnVIS3hBTEdBSXQBWmRBTG9EQ1U1WlRUSTZORGszT09BRDZVUHBBdwUeBQFAOEFQZkU0QUVtNG5uQ29nRW4BCDxwQUVBWmdFQktvRXN3Y0lfHQEIQVJEHQ4MOEJHUB0PCHdFZx0ODF9BU2odDwg4Qk02LAAANB0dCF9BVTZYAABTMiwABEZRMiwAAFY2WAAAWTYsAABvMiwAAFg2WAAAZTIsAAxHQUFmHS4Id0dJOhAAAFE6EAAsWUFlWVZvQUVCcUFIHTkIOEJzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQABwtQUcwQklBQx2lDF9BWWc2EAAAWjogAABaOiAAAGE6IAAAYTogAABiOiAAAGI6IAAAYzogAABjOiAAAGQ6IAAAZDogAABlOiAAAGU6IAAAZjogAABmOiAABFlBLv0BIQA2EAAAWjogAABaOiAAAGE6IAAAYTogAABiOiAAAGI6IAAAYzogAABjOiAAAGQ6IAAAZDogABBlQURBTzoUAABmOjQAAGY6IAAIWUFFOvQBNhAAAFo6IAAAWjogAABhOiAAAGE6IAAAYjogAABiOiAAAGM6IAAAYzogAABkOiAAAGQ6IAAAZTogAABlOiAAAGY6IAAAZjogAAhZQUY6AAE2EAAAWjogAABaOiAAmGJJRUNnamt3cGtORUs2enRBMjZCQm9JbmdrUktWeVB3dlVvekQ4WqU9CQEgZzVNS1pEY0VFGSAIX0pCCRwFARgyQVFEOFFRBQwFAfBSSUlGSHdpaHl5VVFCUmdCSWdORFFVUXBOank5VXBZaDlUOHhRbURsMENMYnlULUlCZklta0FYQzlrNllCWmZhNG9jQnFRWFRwQlIwZTBudFA3RUYFWAUBCERCQh1rPHlRVUFBQUNBbWNIU1A5RUYFIwUBBERaFSi4UEFfNEFXckJQQUYxcGlIQ3ZnRnJQM1FBb0lHQTBOQlJJZ0dCSkFHQVpnR0FLRUcFPwUBJENvQmdTeUJpUUoFDwkBAFIJBwUBAFoFBgkBAGgJBwEBQEM0QmdvLpoCxQEhSGlQZF9ROvEHLExtcmx3RWdBQ2dBTR3NTE9nbE9XVTB5T2pRNU56aEE2VU5KOTUAOR15AEIdeQRCaDmZBDlwAX8JAQRCeAkIAQEUQjRBSUlCqpUBBEpBEZjwXlBBX9gCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL_ICEQoGQURWX0lEEgc1NTIxMDY48gISCgZDUEdfSUQSCDIxMDg5MzY28gISCgVDUF9JRBIJIjoJEPICDQoIAT4YRlJFURIBMAUQHFJFTV9VU0VSBRAADAkgGENPREUSAPIBDwhDUEcVDxALCgdDUBUOFBAKBUlPXwGJADgWxAkA8gEhBElPFSE4EwoPQ1VTVE9NX01PREVMASsUAPICGgoWMhYAHExFQUZfTkFNBXEIHgoaNh0ACEFTVAE-EElGSUVEAT4cFQoIU1BMSVQBTQAJFdnwsIADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTg3qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDzEyOTE3I05ZTTI6NDk3ONoEAggB4AQB8ATspYrNAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAUMwAAA2AUB4AUB8AWo4Eb6BQQIABAAkAYAmAYAogYPMTAyNjQjTllNMjo1Mjc4uAYAwQYJNizwP9AGnqsC2gYWChAJEhkBYBAAGADgBgHyBocBCML2ThKAAUNSUjZUMW9BouBEQUFrQ0JRRUkwUEwzQnhDLTFib0NHT3lFbHdNZ0J5Z0FRTEMwdWdkSXY3VzZCMURwUTFpZUtYRUEBPQUBEEhnQWdRHRBMSWdCQUpBQkFKb0JBZ2dBcUFFQXMuIAB8QS4ugAcBiAcAoAcBugcIKgQxLS0tQAHIB4-8BdIHDQkRuQG3CNoHBiEBcBgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=e793af7a05eb78685aede19f9876a91acb16bc77&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dibehklirob%26e%3D1095001190858,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dibehklirob%26e%3D1095001190858&
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=ibehklirob&e=1095001190858
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:23 GMT
AN-X-Request-Uuid
2567884f-8af9-4e2e-8100-1323985662b3
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame 156C 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CDm593wSSZOvYCI73zwXR951g2piJh2vPqabvjg7AjbcBEAEgAGD96KKB8AOCARdjYS1wdWItMjEyODc1NzE2NzgxMjY2M8gBCeACAKgDAaoE8QJP0I3868bgx7x1Z_NOYyLcET6y82OJ0Wm9fDAo5QwUgIPhrzOt_Pq0TsBoQPxCSTYxuwIFVbOvNVo1xNnZcgIqTFgmrRAKYGHPnXE3XMs_Py-ME2CaFHkDt9rudXGVkjHmuwRUTM3ci2N5cMh8uGmjYjLP5d721o6Iq1Pqifi31y2Skj0CHAg9EygbFK8PhlJMPIOwXUiN4YgSjg2m6vRl4bmOJ4e_XEOFJbi33tKMFngswNclkCnBvrm3ifbWn0XuZo4iE5tvqMMyGCV7Rmt3xrziH0ao7159LdSGJoC8QZutKHQHvtkjburq3pxrVryI2ZyCqiaABeBw28cZuFMuLE_2YcZMbwKRw9Uaw7c8e4hsep3ixw3c0QJbtKbaFG591CS4Cu_yzSlRLmBk6IpKXixHzJ5pelQbfKbT_jXbsiF5F5cO5XvrM0Zpsy-SxM8_WIKlRdgiWGxCjZXjdvV4fdQnj_sY8rKtCj6G0SG1wn7gBAGABvP63qSy7pTl8gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggNCIBhEAEyAooCOgKAQIAKA_oLAggBgAwB0BUBgBcBshccChoSFHB1Yi0yMTI4NzU3MTY3ODEyNjYzGNztag&sigh=uJ_RqvYTp9c&uach_m=[UACH]&cid=CAQSOwBygQiDeaKLZhB_oBAvtTuusxYoC9be30QHm2TEGNkiJQzFiMo5fjrt0XKhDdp3f_QOJmNgLUPKtLs_GAE&cbvp=2&vis=1
Requested by
Host: cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com
URL: https://cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
win
8proof.com/app/ Frame 156C 		0
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://8proof.com/app/win?id=515477663289&ap=ZJIE3wACLGsKs_uOAAd70dmLTSCv8aULrQ7qBg&t=b&cbvp=2
Requested by
Host: cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com
URL: https://cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.116.53.150 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
96.35.7434.ip4.static.sl-reverse.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
content-length
0
server
nginx
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame C7FE 		178 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=zghk5r;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P0eEY4kfjjxr3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoACSb2TQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HCNH_gjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjU2MTBA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1NjEw%2Fbn%3D91848%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=109;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57029
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1686742752845198"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:58:23 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/ Frame C7FE 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/omrhp.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=zghk5r;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P0eEY4kfjjxr3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoACSb2TQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HCNH_gjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjU2MTBA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1NjEw%2Fbn%3D91848%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=109;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:09:52 GMT
content-encoding
br
x-content-type-options
nosniff
age
6511
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4172
x-xss-protection
0
server
cafe
etag
5499578052516643378
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 04 Jul 2023 18:09:52 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame C7FE 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstl046BqO4hDdvJ1a9MR6vj15cdiM6Cx5UbnYYlcmfk09FcaXDHw47tbffNoOmwCjKHOpxw1oFMcLaTb3a1NLALYALBpwwzM-NJB4IewOawVe6Hg6kO9bYtg5mBKRdMFYBHFcodEUvBQiYKUvERf6s6-YvHAF26VmeuZL2ZhFzx_D37o5PEz4iBvATDDW8&sai=AMfl-YTu5MryTsFJFlEEb4vFztKNq-9KNQJ7sr8Cf3Sxi27_6-WiQ78oFp1NcHeA9Td4-ak3tPbO9pAtctiuxajVfyGvJsFhac76tEiDwQ&sig=Cg0ArKJSzHtc-cnHDuxtEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20230615.94537&arae=0&ftch=1&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=zghk5r;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P0eEY4kfjjxr3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoACSb2TQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HCNH_gjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjU2MTBA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1NjEw%2Fbn%3D91848%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=109;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:58:23 GMT
dvtp_src.js
cdn.doubleverify.com/ Frame C7FE 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dvtp_src.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=zghk5r;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P0eEY4kfjjxr3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoACSb2TQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HCNH_gjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjU2MTBA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1NjEw%2Fbn%3D91848%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=109;prcl=s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:9000::6875:b612 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
UploadServer /
Resource Hash
856ed99804bf5b83c5c70314917f7b561f06bfb50cc10ed5430a8fca2c40f246

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:24 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Jun 2023 14:39:49 GMT
Server
UploadServer
ETag
"6bbda2156609c9b24e1e0e365f01b513"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
*
Cache-Control
max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3374
Expires
Sun, 18 Jun 2023 14:55:16 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame C7FE 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=zghk5r;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P0eEY4kfjjxr3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoACSb2TQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HCNH_gjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjU2MTBA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1NjEw%2Fbn%3D91848%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=109;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:09:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6512
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Jun 2024 18:09:51 GMT
17632058214988633165
s0.2mdn.net/simgad/ Frame C7FE 		37 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/simgad/17632058214988633165
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=eqxddgiid&e=1095001190858
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2006 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
dead1f4e72e8cf849bdac46b95a197af4af11ed48877c2db53f38c3b7f43e545
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 08:42:29 GMT
x-content-type-options
nosniff
age
558954
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37712
x-xss-protection
0
last-modified
Wed, 07 Jun 2023 19:19:13 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 13 Jun 2024 08:42:29 GMT
async_usersync.html
acdn.adnxs.com/dmp/ Frame 0010 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=eqxddgiid&e=1095001190858
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.172.245 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-172-245.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:23 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:58:25 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Unused62
8096267
Vary
Accept-Encoding
rd_log
nym1-ib.adnxs.com/ Frame C7FE 		0
933 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKJEPBMCQgAAAMA1gAFAQjficikBhDHiI7L-MOjnmsY3dfcnJHTofg2KjYJQoLix5i7dj8RnoMEGNhbcT8ZAAAAgML18D8hnoMEGNhbcT8pQYIJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXjIzQWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW8LCSAvkFIUpwOFpaZ2pnaC1JYUVMeVcxODBCR0FBZ3VhdVhBVEFCT0FCQUFFajFaRkR1MzhFTldBQmdqUVJvQUhBQWVBQ0FBUUNJQVFDUUFRR1lBUUdnQVFLb0FRS3dBUUM1QWZhLVNUakRESDRfd1FIaGRkNzB3c0IyUDhrQkFBQUFBTUpUN2pfWkFUWTh2VktXSWZVXzRBSDBxdm9EOVFHaThmOC1tQUlBb0FJQ3RRSUEBMwh2UUkBB9hBd0FJQXlBSUEwQUlBMkFJQTRBSUE2QUlBLUFJQWdBTUJtQU1Cb2dNT0NOU2JoeXNRQWhnQ0xRATvwVUNpQXhjSXNvbkFMQkFHR0FFdGl1aTVOeklIWkdWbVlYVnNkS0lERmdqdXVzQXNFQW9ZQVMwUW5uSV9NZ1oxYm1seGRXV2lBdzRJMUp1SEt4QUxHQUl0AVpkQUxvRENVNVpUVEk2TlRZeE1PQUQ2VVBwQXcFHgUBQDhBUGZFNEFFbTRubkNvZ0VuAQi4cEFFQVpnRUJMSUVDZ2prd3BrTkVLNnp0QTI2QkJvSW5na1JLVnlQd3ZVb3pEOFoFSQkBIGc1TUtaRGNFRRkgCF9KQgkcBQEYMkFRRDhRUQUMBQHwUklJRkh3aWh5eVVRQlJnQklnTkRRVVFwTmp5OVVwWWg5VDh4UW1EbDBDTGJ5VC1JQmVvcmtBWEM5azZZQlpmYTRvY0JxUVhUcEJSMGUwbnRQN0VGBVgFAQhEQkIdazx5UVVBQUFDQW1jSFNQOUVGBSMFAQREWhUouFBBXzRBV3JCUEFGMXBpSEN2Z0ZyUDNRQW9JR0EwTkJSSWdHQkpBR0FaZ0dBS0VHBT8FASRDb0JnU3lCaVFKBQ8JAQBSCQcFAQBaBQYJAQBoCQcBATxDNEJnby6aAsUBIUhDTkhfPv0CLExtcmx3RWdBQ2dBTR3NTE9nbE9XVTB5T2pVMk1UQkE2VU5KOTUAOR15AEIdeQRCaDmZBDlwAX8JAQRCeAkIAQEUQjRBSUlCqpUBBEpBEZjwXlBBX9gCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL_ICEQoGQURWX0lEEgc1NTIxMDY48gISCgZDUEdfSUQSCDIxMDg5MzY28gISCgVDUF9JRBIJlUYQ8gINCggBPhhGUkVREgEwBRAcUkVNX1VTRVIFEAAMCSAYQ09ERRIA8gEPCENQRxUPEAsKB0NQFQ4UEAoFSU9fAYkAOInQAPIBIQRJTxUhOBMKD0NVU1RPTV9NT0RFTAErFADyAhoKFjIWABxMRUFGX05BTQVxCB4KGjYdAAhBU1QBPhBJRklFRAE-HBUKCFNQTElUAU0ACRXZ8LCAAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA8xMjkxNyNOWU0yOjU2MTDaBAIIAeAEAfAEvJbXzQGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAFDMAAANgFAeAFAfAFqOBG-gUECAAQAJAGAJgGAKIGDzEwMjY0I05ZTTI6NjIwNbgGAMEGCTYs8D_QBp6rAtoGFgoQCRIZAWAQABgA4AYB8gaHAQjC9k4SgAFMeFJ0VmxvQaLgREFBa0NCUUVJMFBMM0J4Qy0xYm9DR095RWx3TWdCeWdBUUxDMHVnZEl2N1c2QjFEcFExaTlNSEVBAT0FARBIZ0FnUR0QTElnQkFKQUJBSm9CQWdnQXFBRUFzLiAAfEEuLoAHAYgHAKAHAboHCCoEMS0tLUAByAfIzQXSBw0JEbkBtwjaBwYhAXAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=d7491fa28a44172653945664f311a0906ed86f9c&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Deqxddgiid%26e%3D1095001190858,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Deqxddgiid%26e%3D1095001190858&
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=eqxddgiid&e=1095001190858
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:23 GMT
AN-X-Request-Uuid
293dc463-65c0-416a-9772-d68752d6c431
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
13481351336222288159
s0.2mdn.net/simgad/ Frame CFF2 		37 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/simgad/13481351336222288159
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29652998.363876445;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;dc_adk=2878691012;ord=kj0n7c;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P11nbg_ef2Fz3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAADskqIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoA1CYrggAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521DyO59wjgh-IaEOylis0BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjUyNjBA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1MjYw%2Fbn%3D59835%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=166;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2006 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e5477888a979c7b864fafa6a3de860371886602af3e9d0be3f838e7c10dd5500
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 09:11:47 GMT
x-content-type-options
nosniff
age
557196
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37802
x-xss-protection
0
last-modified
Wed, 07 Jun 2023 19:19:20 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 13 Jun 2024 09:11:47 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame CFF2 		178 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29652998.363876445;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;dc_adk=2878691012;ord=kj0n7c;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P11nbg_ef2Fz3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAADskqIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoA1CYrggAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521DyO59wjgh-IaEOylis0BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjUyNjBA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1MjYw%2Fbn%3D59835%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=166;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57029
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1686742752845198"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:58:23 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/ Frame CFF2 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/omrhp.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29652998.363876445;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;dc_adk=2878691012;ord=kj0n7c;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P11nbg_ef2Fz3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAADskqIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoA1CYrggAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521DyO59wjgh-IaEOylis0BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjUyNjBA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1MjYw%2Fbn%3D59835%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=166;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:09:52 GMT
content-encoding
br
x-content-type-options
nosniff
age
6511
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4172
x-xss-protection
0
server
cafe
etag
5499578052516643378
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 04 Jul 2023 18:09:52 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame CFF2 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvvL4Nx6NMJFh56cTnFHHO4j-i2CcHKVQjfuf8gusghS2PQJVUbTZaHRMdDyMvlag4dJadCUX1qso-ja18PJt1J1cXVb1nx8ZKQ7W5XTYO8vAhQh_voPOioM2DUOw8KNykKAu4t9m7BAzPd7OEleZZ394sdUiN8Tt_7NWuiwOApzmI&sai=AMfl-YTWR1Ji00x4fQBSAKjzX8VJc9GbsaacujQ9sTpTLhkyJa_Nhy1tVKtB4wOEDXYcylzbysskEiS-LYM0WYdv3KTmV54dgX0idF7pVA&sig=Cg0ArKJSzOuMzKQKf0tEEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20230615.62296&arae=0&ftch=1&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29652998.363876445;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;dc_adk=2878691012;ord=kj0n7c;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P11nbg_ef2Fz3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAADskqIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoA1CYrggAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521DyO59wjgh-IaEOylis0BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjUyNjBA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1MjYw%2Fbn%3D59835%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=166;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:23 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:58:23 GMT
dvtp_src.js
cdn.doubleverify.com/ Frame CFF2 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dvtp_src.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29652998.363876445;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;dc_adk=2878691012;ord=kj0n7c;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P11nbg_ef2Fz3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAADskqIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoA1CYrggAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521DyO59wjgh-IaEOylis0BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjUyNjBA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1MjYw%2Fbn%3D59835%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=166;prcl=s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:9000::6875:b612 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
UploadServer /
Resource Hash
856ed99804bf5b83c5c70314917f7b561f06bfb50cc10ed5430a8fca2c40f246

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:24 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Jun 2023 14:39:49 GMT
Server
UploadServer
ETag
"6bbda2156609c9b24e1e0e365f01b513"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
*
Cache-Control
max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3374
Expires
Sun, 18 Jun 2023 14:55:16 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame CFF2 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29652998.363876445;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;dc_adk=2878691012;ord=kj0n7c;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P11nbg_ef2Fz3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAADskqIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoA1CYrggAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521DyO59wjgh-IaEOylis0BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjUyNjBA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1MjYw%2Fbn%3D59835%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=166;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:09:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6512
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Jun 2024 18:09:51 GMT
async_usersync.html
acdn.adnxs.com/dmp/ Frame B49D 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=tmpnmjnvld&e=1095001190858
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.172.245 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-172-245.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:23 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:58:25 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Unused62
8096267
Vary
Accept-Encoding
rd_log
nym1-ib.adnxs.com/ Frame CFF2 		0
933 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKFGvBMBQ0AAAMA1gAFAQjficikBhDdzrn74PvfsHMY3dfcnJHTofg2KjYJQoLix5i7dj8RnoMEGNhbcT8ZAAAAgML18D8hnoMEGNhbcT8pQYIJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlDspYrNAVi5q5cBYABopq60AXi70wOAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFjByJywgNDMwMDg0ODQ0BRbwsJIC9Q8hUUo0N19RamdoLUlhRU95bGlzMEJHQUFndWF1WEFUQUJPQUJBQUVqMVpGRHUzOEVOV0FCZ2pRUm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUUtvQVFLd0FRQzVBZmEtU1RqRERINF93UUhoZGQ3MHdzQjJQOGtCQUFBQUFNSlQ3al9aQVRZOHZWS1dJZlVfNEFIMHF2b0Q5UUdpOGY4LW1BSUFvQUlDdFFJQQEzCHZRSQEH2EF3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJvZ01PQ05TYmh5c1FBaGdDTFEBO_BVQ2lBeGNJc29uQUxCQUdHQUV0aXVpNU56SUhaR1ZtWVhWc2RLSURGZ2p1dXNBc0VBb1lBUzBRbm5JX01nWjFibWx4ZFdXaUF3NEkxSnVIS3hBTEdBSXQBWmRBTG9EQ1U1WlRUSTZOVEkyTU9BRDZVUHBBdwUeBQFAOEFQZkU0QUVtNG5uQ29nRW4BCExwQUVBWmdFQktBRUZLb0Vzd2NJXx0BCEFSRB0ODDhCR1AdDwh3RWcdDgxfQVNqHQ8IOEJNNiwAADQdHQhfQVU2WAAAUzIsAARGUTIsAABWNlgAAFk2LAAAbzIsAABYNlgAAGUyLAAMR0FBZh0uCHdHSToQAABROhAALFlBZVlWb0FFQnFBSB05CDhCczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAcLUFHMEJJQUMdpQxfQVlnNhAAAFo6IAAAWjogAABhOiAAAGE6IAAAYjogAABiOiAAAGM6IAAAYzogAABkOiAAAGQ6IAAAZTogAABlOiAAAGY6IAAAZjogAARZQS79ASEANhAAAFo6IAAAWjogAABhOiAAAGE6IAAAYjogAABiOiAAAGM6IAAAYzogAABkOiAAAGQ6IAAQZUFEQU86FAAAZjo0AABmOiAACFlBRTr0ATYQAABaOiAAAFo6IAAAYTogAABhOiAAAGI6IAAAYjogAABjOiAAAGM6IAAAZDogAABkOiAAAGU6IAAAZTogAABmOiAAAGY6IAAIWUFGOgABNhAAAFo6IAAAWjogAJhiSUVDZ2prd3BrTkVLNnp0QTI2QkJvSW5na1JLVnlQd3ZVb3pEOFqlQQkBIGc1TUtaRGNFRRkgCF9KQgkcBQEYMkFRRDhRUQUMBQHwUklJRkh3aWh5eVVRQlJnQklnTkRRVVFwTmp5OVVwWWg5VDh4UW1EbDBDTGJ5VC1JQll3cGtBWEM5azZZQlpmYTRvY0JxUVhUcEJSMGUwbnRQN0VGBVgFAQhEQkIdazx5UVVBQUFDQW1jSFNQOUVGBSMFAQREWhUouFBBXzRBV3JCUEFGMXBpSEN2Z0ZyUDNRQW9JR0EwTkJSSWdHQkpBR0FaZ0dBS0VHBT8FASRDb0JnU3lCaVFKBQ8JAQBSCQcFAQBaBQYJAQBoCQcBAVBDNEJnckFCNUFEmgLFASFEeU81OXc6-QcsTG1ybHdFZ0FDZ0FNHdFMT2dsT1dVMHlPalV5TmpCQTZVTko5OQA5HX0AQh19BEJoOZ0EOXABgwkBBEJ4CQgBARRCNEFJSUKqmQEESkERmPBeUEFf2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20v8gIRCgZBRFZfSUQSBzU1MjEwNjjyAhIKBkNQR19JRBIIMjEwODkzNjbyAhIKBUNQX0lEEgkiQgkQ8gINCggBPhhGUkVREgEwBRAcUkVNX1VTRVIFEAAMCSAYQ09ERRIA8gEPCENQRxUPEAsKB0NQFQ4UEAoFSU9fAYkAOBbMCQDyASEESU8VITgTCg9DVVNUT01fTU9ERUwBKxQA8gIaChYyFgAcTEVBRl9OQU0FcQgeCho2HQAIQVNUAT4QSUZJRUQBPhwVCghTUExJVAFNAAkV2fCwgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xODeoBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQPMTI5MTcjTllNMjo1MjYw2gQCCAHgBAHwBOylis0BiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkABQzAAADYBQHgBQHwBajgRvoFBAgAEACQBgCYBgCiBg8xMDI2NCNOWU0yOjQ0ODa4BgDBBgk2LPA_0AaeqwLaBhYKEAkSGQFgEAAYAOAGAfIGhwEIwvZOEoABX3hQV1Rsb0Gi4ERBQWtDQlFFSTBQTDNCeEMtMWJvQ0dPeUVsd01nQnlnVVFMQzB1Z2RJdjdXNkIxRHBRMWlHSTNFQQE9BQEQSGdBZ1EdEExJZ0JBSkFCQUpvQkFnZ0FxQUVBcy4gAHxBLi6ABwGIBwCgBwG6BwgqBDEtLS1AAcgHu9MD0gcNCRG5AbcI2gcGIQFwGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=5641033623c7aff4484a183f01ec6206ab6f0bba&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dtmpnmjnvld%26e%3D1095001190858,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dtmpnmjnvld%26e%3D1095001190858&
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=tmpnmjnvld&e=1095001190858
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:23 GMT
AN-X-Request-Uuid
93d4552f-8ae3-4df9-8264-ec0b8d4db7f9
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
SPug
simage4.pubmatic.com/AdServer/ Frame 1E1A 		0
260 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=156011&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:24 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
impl_v96.js
www.googletagservices.com/dcm/ Frame 5269 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v96.js
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 08:23:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
560098
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20157
x-xss-protection
0
last-modified
Mon, 22 May 2023 16:41:33 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 13 Jun 2024 08:23:26 GMT
integrator.js
adservice.google.com/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.mercurynews.com
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		31 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3467493086232492&correlator=2087288453809703&eid=31073560%2C31075027%2C31075065%2C31074793%2C31070232&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Csponsorship_1&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=300x50%7C320x50&ifi=10&adks=1140109686&didk=1622125026&sfv=1-0-40&ris=2&rcs=3&prev_scp=pos%3DSponsorship_1%26htl_refresh%3D3%26confiant_refresh%3Dtrue&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D425393090679%26rurl%3D%26articleid%3D9968021&sc=1&cookie=ID%3D66c307501df181c9%3AT%3D1687291098%3ART%3D1687291098%3AS%3DALNI_MYS3ohfCtceNj71Z5MuHLNX5CSDAg&gpic=UID%3D00000c52becd70b0%3AT%3D1687291098%3ART%3D1687291098%3AS%3DALNI_MYOkaUD_dpLztX6KsaO9yHoBXDPyw&abxe=1&dt=1687291104055&lmt=1687291104&dlt=1687291095117&idt=2133&adxs=3075&adys=79&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=320x50&msz=320x50&fws=3076&ohw=1254&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvjmCi7W3v6coGzmBboppo-0CB1wp50riqFtURiV_Y2b4Lv9VIXqle5s38h4AYN4TyiSeVVgx_Ue4bR0ytTMWdrqPMep6S4y&ga_vid=1182837468.1687291098&ga_sid=1687291098&ga_hid=1727863478&ga_fc=true&ga_cid=2078750920.1687291098&a3p=EhkKCnVpZGFwaS5jb20Y_eGL040xSABSAghkEhsKDGlkNS1zeW5jLmNvbRjw7YvTjTFIAFICCGoSGQoKcHViY2lkLm9yZxiT5ovTjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y_eGL040xSABSAghk&dblt=testdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdata
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0525b14fcdbbea04789e242eb030aa5e3afbd5f91337c1571f6bd29973b318e1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:24 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13119
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
15113160214351814612
s0.2mdn.net/simgad/ Frame ED8E 		66 KB
66 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/simgad/15113160214351814612
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B29664373.364307181;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;aucid=8797412763273810965;crid=435294756;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=730607261;ord=lulog8;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F2Ey-2ebGlD-Ix8ylu2KPPwAAAIDC9fA_iMfMpbtijz_XTL7Z5saUPxVUbClMsBZ63SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAA6h8AAAIAAAAkEvIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoA9imnFgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IRZjgAj1qecaEKSkyM8BGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjUxNjRA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjUxNjQ%3D%2Fbn%3D60383%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=67;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2006 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
72fd07e085058fb4525cae979b256d00a8a5daa16ea4732d38915d183e573b25
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 11:11:39 GMT
x-content-type-options
nosniff
age
550005
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
67760
x-xss-protection
0
last-modified
Tue, 04 Apr 2023 21:46:05 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 13 Jun 2024 11:11:39 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame ED8E 		178 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B29664373.364307181;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;aucid=8797412763273810965;crid=435294756;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=730607261;ord=lulog8;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F2Ey-2ebGlD-Ix8ylu2KPPwAAAIDC9fA_iMfMpbtijz_XTL7Z5saUPxVUbClMsBZ63SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAA6h8AAAIAAAAkEvIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoA9imnFgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IRZjgAj1qecaEKSkyM8BGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjUxNjRA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjUxNjQ%3D%2Fbn%3D60383%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=67;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57029
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1686742752845198"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:58:24 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/ Frame ED8E 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/omrhp.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B29664373.364307181;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;aucid=8797412763273810965;crid=435294756;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=730607261;ord=lulog8;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F2Ey-2ebGlD-Ix8ylu2KPPwAAAIDC9fA_iMfMpbtijz_XTL7Z5saUPxVUbClMsBZ63SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAA6h8AAAIAAAAkEvIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoA9imnFgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IRZjgAj1qecaEKSkyM8BGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjUxNjRA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjUxNjQ%3D%2Fbn%3D60383%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=67;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:09:52 GMT
content-encoding
br
x-content-type-options
nosniff
age
6512
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4172
x-xss-protection
0
server
cafe
etag
5499578052516643378
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 04 Jul 2023 18:09:52 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame ED8E 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstDn_zUbL8rBJdeSomh1GWRF6y_lF0JQK4iSdNIeiw3qDxfxMPYZv8nGBonMRyAjYgv_Cv_W0lb7L2njRXJOS1LMEWSilcbZwYHDog1fVVpHRim3yGzVPb3dymyEHNhsegqmSuHRCpkby19e0-DD4dOuHMW0f_UBAKQBx1fv43s&sai=AMfl-YQgrSUtA8MLRVWSaY6bCFKJ5kj-OV1uwTTQ4AaC1Wrod-NjClAtA9Fx0quoJlGvqGP_REpYEKX0qORqDG3wCH67-PF1bm-IIX5JYA&sig=Cg0ArKJSzCXcC6IdMNjKEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20230615.14653&arae=0&ftch=1&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B29664373.364307181;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;aucid=8797412763273810965;crid=435294756;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=730607261;ord=lulog8;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F2Ey-2ebGlD-Ix8ylu2KPPwAAAIDC9fA_iMfMpbtijz_XTL7Z5saUPxVUbClMsBZ63SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAA6h8AAAIAAAAkEvIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoA9imnFgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IRZjgAj1qecaEKSkyM8BGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjUxNjRA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjUxNjQ%3D%2Fbn%3D60383%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=67;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:24 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:58:24 GMT
px
secure.adnxs.com/ Frame ED8E
Redirect Chain
  • https://pixel.sojern.com/pixel/img/291730?p_v=1&f_v=v3_image&vid=hot
  • https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=tQADXm_ozub1-yT97yixrQ&google_nid=sojern__adx_open_bidder_seat&sjrn_id=ZNScVm_8HzJKfQzLZEqQCojagGvKxO8iZGmAhGfwwPJ1B3mbN7w1PXkF57m1bpkS&s...
  • https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=ZNScVm_8HzJKfQzLZEqQCojagGvKxO8iZGmAhGfwwPJ1B3mbN7w1PXkF57m1bpkS&sjrn_r=aHR0cHM6Ly9zZWN1cmUuYWRueHMuY29tL3B4P2lkPTE1Mjg5NjEmdD0x&sjrn_...
  • https://secure.adnxs.com/px?id=1528961&t=1
0
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.adnxs.com/px?id=1528961&t=1
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=rubwwfuc&e=1095001190858
Protocol
HTTP/1.1
Server
68.67.181.211 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:24 GMT
AN-X-Request-Uuid
cbfcbd3e-1aa3-4caf-b1cd-d4bd153aab95
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
application/javascript; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

date
Tue, 20 Jun 2023 19:58:24 GMT
via
1.1 google
vary
Accept-Encoding
content-type
image/gif
location
https://secure.adnxs.com/px?id=1528961&t=1
p3p
policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
ca
choices.truste.com/ Frame ED8E 		28 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=29664373&js=st0
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B29664373.364307181;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;aucid=8797412763273810965;crid=435294756;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=730607261;ord=lulog8;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F2Ey-2ebGlD-Ix8ylu2KPPwAAAIDC9fA_iMfMpbtijz_XTL7Z5saUPxVUbClMsBZ63SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAA6h8AAAIAAAAkEvIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoA9imnFgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IRZjgAj1qecaEKSkyM8BGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjUxNjRA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjUxNjQ%3D%2Fbn%3D60383%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=67;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.146.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-146-97.ewr52.r.cloudfront.net
Software
nginx /
Resource Hash
4375c83a59eca46627f11e4513026fd80535068b573548197485469ac700ebdc
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 57a894c75d329d29ecabaa7a88eb80a4.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
EWR52-C2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
8033
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
ieXv2EdRO5OQPuiNL0s3HUr-H7yV8fTO1Phdj6Jd_2uFW_jnlkZsRQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame ED8E 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B29664373.364307181;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;aucid=8797412763273810965;crid=435294756;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=730607261;ord=lulog8;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F2Ey-2ebGlD-Ix8ylu2KPPwAAAIDC9fA_iMfMpbtijz_XTL7Z5saUPxVUbClMsBZ63SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAA6h8AAAIAAAAkEvIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoA9imnFgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IRZjgAj1qecaEKSkyM8BGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjUxNjRA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjUxNjQ%3D%2Fbn%3D60383%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=67;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:09:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6513
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Jun 2024 18:09:51 GMT
dcm
beacon.sojern.com/imp/ Frame ED8E 		42 B
56 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.sojern.com/imp/dcm?auc=8797412763273810965&io=${INSERTION_ORDER_ID}&li=${CAMPAIGN_ID}&cr=435294756&io=${INSERTION_ORDER_ID}&seg=${PIXEL_ID_COMMA}&src=${SOURCE_URL}&ord=%c
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=rubwwfuc&e=1095001190858
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
119.244.178.107.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
date
Tue, 20 Jun 2023 19:58:24 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
vary
Accept-Encoding
content-type
image/gif
ca
choices.trustarc.com/ Frame ED8E 		27 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?sz=300x250&c=11181583&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0
Requested by
Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02_d&cid=0&c=11181583&sz=300x250&js=st_dapp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
def2c0929f78f2e330fc17831944b2a5c243d24dc5fec1b450316cb4ac51a9bc
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
ZkbyT2jropfJoC0t32zqX6LoB6BxnS32ITCCGvmSK2SHGnsG7nQAQg==
expires
Mon, 26 Jul 1997 05:00:00 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame AF75 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuLQ6DqxsMVUpAvhE-jjlU2GYnajTfADB5bJ27HmO58d-CIaNkWjrynuR2Tvc16bYiu_5vdqBpqUamHn6d9I27Y-Dr1_rKYvg6JKsCEwkp2Cd0r0XDoNXzZ81eeKuEA-1SJOBw7ADsc3XcuexlwyL3emDFqxXc0VqpqFwyhHVPw&sai=AMfl-YSu4MFX7TOeyfRFFYSH5tLgFkOTcmQyfnfnuZEruWi2Vt7qUbe-ZBshboDRaTqYm0zDLHy0CBJcWfvOwuSyTnaXnMWUzvnMPsJkYQ&sig=Cg0ArKJSzGGmzW0J8vGYEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=238&vt=11&dtpt=237&dett=2&cstd=0&cisv=r20230615.28243&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B29664373.364307181;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;aucid=6115578807624363956;crid=435294756;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=3210668679;ord=5k1ecx;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F2Ey-2ebGlD-Ix8ylu2KPPwAAAIDC9fA_iMfMpbtijz_XTL7Z5saUP7RvWxiG5t5U3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAA6h8AAAIAAAAkEvIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAoCu1owAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IBYmgAj1qecaEKSkyM8BGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjQ5MjBA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjQ5MjA%3D%2Fbn%3D89503%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=131;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:24 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:58:24 GMT
async_usersync.html
acdn.adnxs.com/dmp/ Frame 6CD7 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=udynfi&e=1095001190858
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.172.245 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-172-245.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:24 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:58:26 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Unused62
8096267
Vary
Accept-Encoding
rd_log
nym1-ib.adnxs.com/ Frame AF75 		0
933 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLSDPBMUgYAAAMA1gAFAQjficikBhC03-3C4dC571QY3dfcnJHTofg2KjYJ2Ey-2ebGlD8RiMfMpbtijz8ZAAAAgML18D8hiMfMpbtijz8p10wJJPCaMQAAACCF67E_MO7fwQ04mFBA6j9IAlCkpMjPAVi5q5cBYABopq60AXifuwWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCU3VmKCdhJywgNzc1OTExOCwgMCk7dWYoJ2knLCA4MzI2ODg2LCAwKTt1ZignZycsIDIxMTcyNjg2LCANKfCfcicsIDQzNTI5NDc1NiwgMCk7kgKBBCE2R1JEUmdqMXFlY2FFS1NreU04QkdBQWd1YXVYQVRBQU9BQkFBRWpxUDFEdTM4RU5XQUJnalFSb0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRR29BUUd3QVFDNUFXSUFMeEZGeHBRX3dRRmlBQzhSUmNhVVA4a0JBQUFBQUFBQThEX1pBUUFBQQEPdFBBXzRBSG1uZndEOVFITnpNdzltQUlBb0FJQnRRSQEiBEF2DQjwVXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQnVnTUpUbGxOTWpvME9USXc0QVBwUTRBRTZLUHZDb2dFLWFQdkNwQUVBWmdFQWNFRUFBBWMUQUFBREpCAQcNARgyQVFBOFFRDQ5gQUFBSWdGdUNhcEJkT2tGSFI3U2UwX3NRVQEaCQEYTUVGbXBtWgECEHVUX0pCATscSURWOThrXzAuKAAITmtGCTEAQSEIsGdCZTBQOEFYT280d0stQVdPeXRrRGdnWURWVk5FaUFZQWtBWUJtQVlBb1FhYQFcOG1abTVQNmdHQkxJR0pBaxFLCEFBQh3LBEJrGRgAQx0YRExnR0NnLi6aApkBIUlCWW1nQToFAjRMbXJsd0VnQUNnQU1acQFtYFptYmtfT2dsT1dVMHlPalE1TWpCQTZVTkoRYgw4RDlSEQwMQUFCWh0MAGgdDABwHQwAeB0MDDRBSWs1eOA4RDgu2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20v8gIRCgZBRFZfSUQSBzdpIRzyAhIKBkNQRwEUAAhxDRjyAgoKBUNQARQ4ATDyAg0KCEFEVl9GUkVRERAcUkVNX1VTRVIFEAARCSA8Q09ERRIFMzMyMTfyAiMKCAFWBRQYFzAwazViMAEBTFkzQ1NiQUFOX2VuXzTyAgsKB0NQCSUcAPICEAoFSU8BdQQHOGmqGPICHQoHSU8JIQwSMDA2CUZkMTBidm56QUFB8gITCg9DVVNUT01fTU9ERUwBPRQA8gIaChYyFgAgTEVBRl9OQU1FAR0IHgoaNh0ACEFTVAE-EElGSUVEASEcDQoIU1BMSVQBTfCaATCAAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA44MTcwI05ZTTI6NDkyMNoEAggB4AQB8ASkpMjPAYgFAZgFAKAF______8BBRgBwAUAyQUABQEU8D_SBQkJBQt4AAAA2AUB4AUB8AWFAvoFBAgAEACQBgCYBgC4BgDBBgEgMAAA8D_QBugp2gYWChAJERkBoBAAGADgBgHyBgIIAIAHAYgHAKAHAboHCCoEMS0tLUAByAefuwXSBw0JETMBMQjaBwYBaHAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=0157049c34d98016f1d70669641cfa935ff1d898&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dudynfi%26e%3D1095001190858,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dudynfi%26e%3D1095001190858&
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=udynfi&e=1095001190858
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:24 GMT
AN-X-Request-Uuid
aba0495a-695b-4baf-9c8a-d704b145a95b
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame E9F9 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssqYZFtjlJm7eiHdaj_O-WXSwKKrWcVGRXYpftN-m8lba6SEjhv7tnDzdDd6S8njT48xw1cnZZ0Wdfi92hQ_nZ1BvhjjRskqKKpr7gTvL_TUCsLguUe6_aldyqjuJ5YKVzYHWLy6PlET5IyM5Fp6BAQlJjfU2J1Hm-iWktGDgnk2nE&sai=AMfl-YRfMgGQTTFCScX92RSa4lwpImEK4zMAcGkgH3syMObJsyWwsj84WDcoAFdAyXWx9CYCi3GyweY73nyjqUcPypAuocLPnlNnWJmrBQ&sig=Cg0ArKJSzOAnDfE_euZFEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=296&vt=11&dtpt=294&dett=2&cstd=0&cisv=r20230615.93298&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29652998.363876445;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;dc_adk=3062143102;ord=fhkvmd;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P7h75wRw51o73SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAADskqIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAbCfotgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HiPd_Qjgh-IaEOylis0BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjQ5NzhA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo0OTc4%2Fbn%3D89615%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=144;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:24 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:58:24 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame C7FE 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstl046BqO4hDdvJ1a9MR6vj15cdiM6Cx5UbnYYlcmfk09FcaXDHw47tbffNoOmwCjKHOpxw1oFMcLaTb3a1NLALYALBpwwzM-NJB4IewOawVe6Hg6kO9bYtg5mBKRdMFYBHFcodEUvBQiYKUvERf6s6-YvHAF26VmeuZL2ZhFzx_D37o5PEz4iBvATDDW8&sai=AMfl-YTu5MryTsFJFlEEb4vFztKNq-9KNQJ7sr8Cf3Sxi27_6-WiQ78oFp1NcHeA9Td4-ak3tPbO9pAtctiuxajVfyGvJsFhac76tEiDwQ&sig=Cg0ArKJSzHtc-cnHDuxtEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=290&vt=11&dtpt=288&dett=2&cstd=0&cisv=r20230615.94537&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=zghk5r;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P0eEY4kfjjxr3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoACSb2TQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HCNH_gjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjU2MTBA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1NjEw%2Fbn%3D91848%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=109;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:24 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:58:24 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame CFF2 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvvL4Nx6NMJFh56cTnFHHO4j-i2CcHKVQjfuf8gusghS2PQJVUbTZaHRMdDyMvlag4dJadCUX1qso-ja18PJt1J1cXVb1nx8ZKQ7W5XTYO8vAhQh_voPOioM2DUOw8KNykKAu4t9m7BAzPd7OEleZZ394sdUiN8Tt_7NWuiwOApzmI&sai=AMfl-YTWR1Ji00x4fQBSAKjzX8VJc9GbsaacujQ9sTpTLhkyJa_Nhy1tVKtB4wOEDXYcylzbysskEiS-LYM0WYdv3KTmV54dgX0idF7pVA&sig=Cg0ArKJSzOuMzKQKf0tEEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=240&vt=11&dtpt=238&dett=2&cstd=0&cisv=r20230615.62296&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29652998.363876445;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;dc_adk=2878691012;ord=kj0n7c;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P11nbg_ef2Fz3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAADskqIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoA1CYrggAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521DyO59wjgh-IaEOylis0BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjUyNjBA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1MjYw%2Fbn%3D59835%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=166;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:24 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:58:24 GMT
B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1757378021;ord=vcwnbc;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P0ENJP_JR...
ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/ Frame 5269 		65 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1757378021;ord=vcwnbc;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FQoLix5i7dj-egwQY2FtxPwAAAIDC9fA_noMEGNhbcT9BguLHmLt2P0ENJP_JRBBt3SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoA-SXNRwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521ICPn_wjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjYyNjJA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo2MjYy%2Fbn%3D98104%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=222;prcl=s
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.64.70 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s30-in-f6.1e100.net
Software
cafe /
Resource Hash
f243d14902455008e5e263bd756f90991b996db063d9100441da64c55aa3c5c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:24 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29767
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 7E77 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
87420
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 19 Jun 2023 19:41:24 GMT
expires
Tue, 18 Jun 2024 19:41:24 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
async_usersync
ib.adnxs.com/ Frame 2B47 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=10264&pub_id=2025736&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:24 GMT
AN-X-Request-Uuid
42f58d63-665b-4ab9-a716-73ef007a207c
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 0010 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=10264&pub_id=2025736&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:24 GMT
AN-X-Request-Uuid
0dca1f35-8e6a-43ce-9bc6-bc7a6da340ef
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame ED8E 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstDn_zUbL8rBJdeSomh1GWRF6y_lF0JQK4iSdNIeiw3qDxfxMPYZv8nGBonMRyAjYgv_Cv_W0lb7L2njRXJOS1LMEWSilcbZwYHDog1fVVpHRim3yGzVPb3dymyEHNhsegqmSuHRCpkby19e0-DD4dOuHMW0f_UBAKQBx1fv43s&sai=AMfl-YQgrSUtA8MLRVWSaY6bCFKJ5kj-OV1uwTTQ4AaC1Wrod-NjClAtA9Fx0quoJlGvqGP_REpYEKX0qORqDG3wCH67-PF1bm-IIX5JYA&sig=Cg0ArKJSzCXcC6IdMNjKEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=281&vt=11&dtpt=279&dett=2&cstd=0&cisv=r20230615.14653&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B29664373.364307181;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;aucid=8797412763273810965;crid=435294756;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=730607261;ord=lulog8;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F2Ey-2ebGlD-Ix8ylu2KPPwAAAIDC9fA_iMfMpbtijz_XTL7Z5saUPxVUbClMsBZ63SuXE5mG8DbfBJJkAAAAAO5vsAEYKAAA6h8AAAIAAAAkEvIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoA9imnFgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IRZjgAj1qecaEKSkyM8BGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjUxNjRA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjUxNjQ%3D%2Fbn%3D60383%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=bKOKyvs2x!;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=67;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:24 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:58:24 GMT
dv-measurements3941.js
cdn.doubleverify.com/ Frame 89F2 		536 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dv-measurements3941.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:9000::6875:b612 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
UploadServer /
Resource Hash
a1b053b5e005612a140e8a725c0dcdc5393c15d3c4cc45164fece0f9e8f2cbd4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:24 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Jun 2023 10:24:03 GMT
Server
UploadServer
ETag
"245897220fbd1a0dfa41e714a5e3acf6"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
*
Cache-Control
max-age=946080900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103853
Expires
Mon, 17 Jun 2024 10:24:07 GMT
dv-measurements3941.js
cdn.doubleverify.com/ Frame B4B6 		536 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dv-measurements3941.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:9000::6875:b612 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
UploadServer /
Resource Hash
a1b053b5e005612a140e8a725c0dcdc5393c15d3c4cc45164fece0f9e8f2cbd4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:24 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Jun 2023 10:24:03 GMT
Server
UploadServer
ETag
"245897220fbd1a0dfa41e714a5e3acf6"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
*
Cache-Control
max-age=946080900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103853
Expires
Mon, 17 Jun 2024 10:24:07 GMT
vevent
nym1-ib.adnxs.com/ Frame E9F9 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLmF_BM5gsAAAMA1gAFAQjficikBhC4952ngO65rTsY3dfcnJHTofg2KjYJQoLix5i7dj8RnoMEGNhbcT8ZAAAAgML18D8hnoMEGNhbcT8pQYIJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlDspYrNAVi5q5cBYABopq60AXiPvAWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFjByJywgNDMwMDg0ODQ0BRbwsJIC7Q8hb0p4d2lBamdoLUlhRU95bGlzMEJHQUFndWF1WEFUQUJPQUJBQUVqMVpGRHUzOEVOV0FCZ2pRUm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUUtvQVFLd0FRQzVBZmEtU1RqRERINF93UUhoZGQ3MHdzQjJQOGtCQUFBQUFNSlQ3al9aQVRZOHZWS1dJZlVfNEFIMHF2b0Q5UUdpOGY4LW1BSUFvQUlDdFFJQQEzCHZRSQEH2EF3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJvZ01PQ05TYmh5c1FBaGdDTFEBO_BVQ2lBeGNJc29uQUxCQUdHQUV0aXVpNU56SUhaR1ZtWVhWc2RLSURGZ2p1dXNBc0VBb1lBUzBRbm5JX01nWjFibWx4ZFdXaUF3NEkxSnVIS3hBTEdBSXQBWmRBTG9EQ1U1WlRUSTZORGszT09BRDZVUHBBdwUeBQFAOEFQZkU0QUVtNG5uQ29nRW4BCDxwQUVBWmdFQktvRXN3Y0lfHQEIQVJEHQ4MOEJHUB0PCHdFZx0ODF9BU2odDwg4Qk02LAAANB0dCF9BVTZYAABTMiwABEZRMiwAAFY2WAAAWTYsAABvMiwAAFg2WAAAZTIsAAxHQUFmHS4Id0dJOhAAAFE6EAAsWUFlWVZvQUVCcUFIHTkIOEJzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQABwtQUcwQklBQx2lDF9BWWc2EAAAWjogAABaOiAAAGE6IAAAYTogAABiOiAAAGI6IAAAYzogAABjOiAAAGQ6IAAAZDogAABlOiAAAGU6IAAAZjogAABmOiAABFlBLv0BIQA2EAAAWjogAABaOiAAAGE6IAAAYTogAABiOiAAAGI6IAAAYzogAABjOiAAAGQ6IAAAZDogABBlQURBTzoUAABmOjQAAGY6IAAIWUFFOvQBNhAAAFo6IAAAWjogAABhOiAAAGE6IAAAYjogAABiOiAAAGM6IAAAYzogAABkOiAAAGQ6IAAAZTogAABlOiAAAGY6IAAAZjogAAhZQUY6AAE2EAAAWjogAABaOiAAmGJJRUNnamt3cGtORUs2enRBMjZCQm9JbmdrUktWeVB3dlVvekQ4WqU9CQEgZzVNS1pEY0VFGSAIX0pCCRwFARgyQVFEOFFRBQwFAfBSSUlGSHdpaHl5VVFCUmdCSWdORFFVUXBOank5VXBZaDlUOHhRbURsMENMYnlULUlCZklta0FYQzlrNllCWmZhNG9jQnFRWFRwQlIwZTBudFA3RUYFWAUBCERCQh1rPHlRVUFBQUNBbWNIU1A5RUYFIwUBBERaFSi4UEFfNEFXckJQQUYxcGlIQ3ZnRnJQM1FBb0lHQTBOQlJJZ0dCSkFHQVpnR0FLRUcFPwUBJENvQmdTeUJpUUoFDwkBAFIJBwUBAFoFBgkBAGgJBwEBQEM0QmdvLpoCxQEhSGlQZF9ROvEHLExtcmx3RWdBQ2dBTR3NTE9nbE9XVTB5T2pRNU56aEE2VU5KOTUAOR15AEIdeQRCaDmZBDlwAX8JAQRCeAkIAQEUQjRBSUlCqpUBBEpBEZj0mwFQQV_YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA8xMjkxNyNOWU0yOjQ5NzjaBAIIAeAEAfAE7KWKzQGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWo4Eb6BQQIABAAkAYAmAYAogYPMTAyNjQjTllNMjo1Mjc4uAYAwQYAAAAAAADwP9AGnqsC2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGhwEIwvZOEoABQ1JSNlQxb0FBQUFEQUFrQ0JRRUkwUEwzQnhDLTFib0NHT3lFbHdNZ0J5Z0FRTEMwdWdkSXY3VzZCMURwUTFpZUtYRUFBQUFBQUFBQUFIZ0FnUUVBQUFBIdtcQUFJZ0JBSkFCQUpvQkFnZ0FxQUVBc1FFCRwFAXguLoAHAYgHAKAHAboHCCoEMS0tLUAByAePvAXSBw0JLrcAjNoHBggAEAAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=e6985053eaec936706312eb92177b9567a77e069&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=7469063901422388822&vd=ct~0|rr~0&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:24 GMT
AN-X-Request-Uuid
f85656c1-2ae7-442f-bba2-247aae7e4ee7
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 586F 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
87420
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 19 Jun 2023 19:41:24 GMT
expires
Tue, 18 Jun 2024 19:41:24 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		32 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3467493086232492&correlator=902579259084556&eid=31073560%2C31075027%2C31075065%2C31074793%2C31070232&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Ctop_leaderboard&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=728x90%7C970x90%7C970x250&ifi=11&adks=142133714&didk=303353385&sfv=1-0-40&ris=2&rcs=3&prev_scp=pos%3Dtop_leaderboard%26htl_refresh%3D3%26confiant_refresh%3Dtrue&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D425393090679%26rurl%3D%26articleid%3D9968021&sc=1&cookie=ID%3D66c307501df181c9%3AT%3D1687291098%3ART%3D1687291098%3AS%3DALNI_MYS3ohfCtceNj71Z5MuHLNX5CSDAg&gpic=UID%3D00000c52becd70b0%3AT%3D1687291098%3ART%3D1687291098%3AS%3DALNI_MYOkaUD_dpLztX6KsaO9yHoBXDPyw&abxe=1&dt=1687291104444&lmt=1687291104&dlt=1687291095117&idt=2133&adxs=1636&adys=323&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=728x90&msz=728x90&fws=3076&ohw=1280&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvjmCi7W3v6coGzmBboppo-0CB1wp50riqFtURiV_Y2b4Lv9VIXqle5s38h4AYN4TyiSeVVgx_Ue4bR0ytTMWdrqPMep6S4y&ga_vid=1182837468.1687291098&ga_sid=1687291098&ga_hid=1727863478&ga_fc=true&ga_cid=2078750920.1687291098&a3p=EhkKCnVpZGFwaS5jb20Y_eGL040xSABSAghkEhsKDGlkNS1zeW5jLmNvbRjw7YvTjTFIAFICCGoSGQoKcHViY2lkLm9yZxiT5ovTjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y_eGL040xSABSAghk&dblt=testdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdatatestdata
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f383b3a7fb8f61a6d02aaf4f4f1708e114500e0e42576eca74f63392e41b52ed
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:24 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13337
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/g/ 		0
17 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-LMTT1ZNHB1&gtm=45je36e0&_p=1727863478&cid=1182837468.1687291098&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=2&sid=1687291097&sct=1&seg=0&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LMTT1ZNHB1&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:24 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
vevent
nym1-ib.adnxs.com/ Frame C7FE 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLyDfBM8gYAAAMA1gAFAQjficikBhDHiI7L-MOjnmsY3dfcnJHTofg2KjYJQoLix5i7dj8RnoMEGNhbcT8ZAAAAgML18D8hnoMEGNhbcT8pQYIJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXjIzQWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW8LCSAvkFIUpwOFpaZ2pnaC1JYUVMeVcxODBCR0FBZ3VhdVhBVEFCT0FCQUFFajFaRkR1MzhFTldBQmdqUVJvQUhBQWVBQ0FBUUNJQVFDUUFRR1lBUUdnQVFLb0FRS3dBUUM1QWZhLVNUakRESDRfd1FIaGRkNzB3c0IyUDhrQkFBQUFBTUpUN2pfWkFUWTh2VktXSWZVXzRBSDBxdm9EOVFHaThmOC1tQUlBb0FJQ3RRSUEBMwh2UUkBB9hBd0FJQXlBSUEwQUlBMkFJQTRBSUE2QUlBLUFJQWdBTUJtQU1Cb2dNT0NOU2JoeXNRQWhnQ0xRATvwVUNpQXhjSXNvbkFMQkFHR0FFdGl1aTVOeklIWkdWbVlYVnNkS0lERmdqdXVzQXNFQW9ZQVMwUW5uSV9NZ1oxYm1seGRXV2lBdzRJMUp1SEt4QUxHQUl0AVpkQUxvRENVNVpUVEk2TlRZeE1PQUQ2VVBwQXcFHgUBQDhBUGZFNEFFbTRubkNvZ0VuAQi4cEFFQVpnRUJMSUVDZ2prd3BrTkVLNnp0QTI2QkJvSW5na1JLVnlQd3ZVb3pEOFoFSQkBIGc1TUtaRGNFRRkgCF9KQgkcBQEYMkFRRDhRUQUMBQHwUklJRkh3aWh5eVVRQlJnQklnTkRRVVFwTmp5OVVwWWg5VDh4UW1EbDBDTGJ5VC1JQmVvcmtBWEM5azZZQlpmYTRvY0JxUVhUcEJSMGUwbnRQN0VGBVgFAQhEQkIdazx5UVVBQUFDQW1jSFNQOUVGBSMFAQREWhUouFBBXzRBV3JCUEFGMXBpSEN2Z0ZyUDNRQW9JR0EwTkJSSWdHQkpBR0FaZ0dBS0VHBT8FASRDb0JnU3lCaVFKBQ8JAQBSCQcFAQBaBQYJAQBoCQcBATxDNEJnby6aAsUBIUhDTkhfPv0CLExtcmx3RWdBQ2dBTR3NTE9nbE9XVTB5T2pVMk1UQkE2VU5KOTUAOR15AEIdeQRCaDmZBDlwAX8JAQRCeAkIAQEUQjRBSUlCqpUBBEpBEZj0mwFQQV_YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA8xMjkxNyNOWU0yOjU2MTDaBAIIAeAEAfAEvJbXzQGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWo4Eb6BQQIABAAkAYAmAYAogYPMTAyNjQjTllNMjo2MjA1uAYAwQYAAAAAAADwP9AGnqsC2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGhwEIwvZOEoABTHhSdFZsb0FBQUFEQUFrQ0JRRUkwUEwzQnhDLTFib0NHT3lFbHdNZ0J5Z0FRTEMwdWdkSXY3VzZCMURwUTFpOU1IRUFBQUFBQUFBQUFIZ0FnUUVBQUFBIdtcQUFJZ0JBSkFCQUpvQkFnZ0FxQUVBc1FFCRwFAXguLoAHAYgHAKAHAboHCCoEMS0tLUAByAfIzQXSBw0JLrcAjNoHBggAEAAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=551b2a4bf19fbd5e898fbf32dcc409379b96df2d&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=7469063901422388822&vd=ct~0|rr~0&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:24 GMT
AN-X-Request-Uuid
0564d036-e229-43f8-aa2d-1e7761fdeb4a
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 3546 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
87420
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 19 Jun 2023 19:41:24 GMT
expires
Tue, 18 Jun 2024 19:41:24 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
dv-measurements3941.js
cdn.doubleverify.com/ Frame 48CA 		536 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dv-measurements3941.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:9000::6875:b612 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
UploadServer /
Resource Hash
a1b053b5e005612a140e8a725c0dcdc5393c15d3c4cc45164fece0f9e8f2cbd4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:24 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Jun 2023 10:24:03 GMT
Server
UploadServer
ETag
"245897220fbd1a0dfa41e714a5e3acf6"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
*
Cache-Control
max-age=946080900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103853
Expires
Mon, 17 Jun 2024 10:24:07 GMT
async_usersync
ib.adnxs.com/ Frame B49D 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=10264&pub_id=2025736&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:24 GMT
AN-X-Request-Uuid
e3709a75-cf27-4301-be7f-6b56234c639b
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
vevent
nym1-ib.adnxs.com/ Frame CFF2 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLuF_BM7gsAAAMA1gAFAQjficikBhDdzrn74PvfsHMY3dfcnJHTofg2KjYJQoLix5i7dj8RnoMEGNhbcT8ZAAAAgML18D8hnoMEGNhbcT8pQYIJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlDspYrNAVi5q5cBYABopq60AXi70wOAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFjByJywgNDMwMDg0ODQ0BRbwsJIC9Q8hUUo0N19RamdoLUlhRU95bGlzMEJHQUFndWF1WEFUQUJPQUJBQUVqMVpGRHUzOEVOV0FCZ2pRUm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUUtvQVFLd0FRQzVBZmEtU1RqRERINF93UUhoZGQ3MHdzQjJQOGtCQUFBQUFNSlQ3al9aQVRZOHZWS1dJZlVfNEFIMHF2b0Q5UUdpOGY4LW1BSUFvQUlDdFFJQQEzCHZRSQEH2EF3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJvZ01PQ05TYmh5c1FBaGdDTFEBO_BVQ2lBeGNJc29uQUxCQUdHQUV0aXVpNU56SUhaR1ZtWVhWc2RLSURGZ2p1dXNBc0VBb1lBUzBRbm5JX01nWjFibWx4ZFdXaUF3NEkxSnVIS3hBTEdBSXQBWmRBTG9EQ1U1WlRUSTZOVEkyTU9BRDZVUHBBdwUeBQFAOEFQZkU0QUVtNG5uQ29nRW4BCExwQUVBWmdFQktBRUZLb0Vzd2NJXx0BCEFSRB0ODDhCR1AdDwh3RWcdDgxfQVNqHQ8IOEJNNiwAADQdHQhfQVU2WAAAUzIsAARGUTIsAABWNlgAAFk2LAAAbzIsAABYNlgAAGUyLAAMR0FBZh0uCHdHSToQAABROhAALFlBZVlWb0FFQnFBSB05CDhCczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAcLUFHMEJJQUMdpQxfQVlnNhAAAFo6IAAAWjogAABhOiAAAGE6IAAAYjogAABiOiAAAGM6IAAAYzogAABkOiAAAGQ6IAAAZTogAABlOiAAAGY6IAAAZjogAARZQS79ASEANhAAAFo6IAAAWjogAABhOiAAAGE6IAAAYjogAABiOiAAAGM6IAAAYzogAABkOiAAAGQ6IAAQZUFEQU86FAAAZjo0AABmOiAACFlBRTr0ATYQAABaOiAAAFo6IAAAYTogAABhOiAAAGI6IAAAYjogAABjOiAAAGM6IAAAZDogAABkOiAAAGU6IAAAZTogAABmOiAAAGY6IAAIWUFGOgABNhAAAFo6IAAAWjogAJhiSUVDZ2prd3BrTkVLNnp0QTI2QkJvSW5na1JLVnlQd3ZVb3pEOFqlQQkBIGc1TUtaRGNFRRkgCF9KQgkcBQEYMkFRRDhRUQUMBQHwUklJRkh3aWh5eVVRQlJnQklnTkRRVVFwTmp5OVVwWWg5VDh4UW1EbDBDTGJ5VC1JQll3cGtBWEM5azZZQlpmYTRvY0JxUVhUcEJSMGUwbnRQN0VGBVgFAQhEQkIdazx5UVVBQUFDQW1jSFNQOUVGBSMFAQREWhUouFBBXzRBV3JCUEFGMXBpSEN2Z0ZyUDNRQW9JR0EwTkJSSWdHQkpBR0FaZ0dBS0VHBT8FASRDb0JnU3lCaVFKBQ8JAQBSCQcFAQBaBQYJAQBoCQcBAVBDNEJnckFCNUFEmgLFASFEeU81OXc6-QcsTG1ybHdFZ0FDZ0FNHdFMT2dsT1dVMHlPalV5TmpCQTZVTko5OQA5HX0AQh19BEJoOZ0EOXABgwkBBEJ4CQgBARRCNEFJSUKqmQEESkERmPSbAVBBX9gCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL4ADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTg3qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDzEyOTE3I05ZTTI6NTI2MNoEAggB4AQB8ATspYrNAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBajgRvoFBAgAEACQBgCYBgCiBg8xMDI2NCNOWU0yOjQ0ODa4BgDBBgAAAAAAAPA_0AaeqwLaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gaHAQjC9k4SgAFfeFBXVGxvQUFBQURBQWtDQlFFSTBQTDNCeEMtMWJvQ0dPeUVsd01nQnlnVVFMQzB1Z2RJdjdXNkIxRHBRMWlHSTNFQUFBQUFBQUFBQUhnQWdRRUFBQUEh21xBQUlnQkFKQUJBSm9CQWdnQXFBRUFzUUUJHAUBeC4ugAcBiAcAoAcBugcIKgQxLS0tQAHIB7vTA9IHDQkutwCM2gcGCAAQABgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=1d654395f1c4930733225080ac2bf4dd75359115&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=7469063901422388822&vd=ct~0|rr~0&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:24 GMT
AN-X-Request-Uuid
d7a25d68-e8c4-4d01-866f-475734e77b9d
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame E91F 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
87420
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 19 Jun 2023 19:41:24 GMT
expires
Tue, 18 Jun 2024 19:41:24 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
vevent
nym1-ib.adnxs.com/ Frame AF75 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKdCvBMHQUAAAMA1gAFAQjficikBhC03-3C4dC571QY3dfcnJHTofg2KjYJ2Ey-2ebGlD8RiMfMpbtijz8ZAAAAgML18D8hiMfMpbtijz8p10wJJPCaMQAAACCF67E_MO7fwQ04mFBA6j9IAlCkpMjPAVi5q5cBYABopq60AXifuwWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCU3VmKCdhJywgNzc1OTExOCwgMCk7dWYoJ2knLCA4MzI2ODg2LCAwKTt1ZignZycsIDIxMTcyNjg2LCANKfCfcicsIDQzNTI5NDc1NiwgMCk7kgKBBCE2R1JEUmdqMXFlY2FFS1NreU04QkdBQWd1YXVYQVRBQU9BQkFBRWpxUDFEdTM4RU5XQUJnalFSb0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRR29BUUd3QVFDNUFXSUFMeEZGeHBRX3dRRmlBQzhSUmNhVVA4a0JBQUFBQUFBQThEX1pBUUFBQQEPdFBBXzRBSG1uZndEOVFITnpNdzltQUlBb0FJQnRRSQEiBEF2DQjwVXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQnVnTUpUbGxOTWpvME9USXc0QVBwUTRBRTZLUHZDb2dFLWFQdkNwQUVBWmdFQWNFRUFBBWMUQUFBREpCAQcNARgyQVFBOFFRDQ5gQUFBSWdGdUNhcEJkT2tGSFI3U2UwX3NRVQEaCQEYTUVGbXBtWgECEHVUX0pCATscSURWOThrXzAuKAAITmtGCTEAQSEIsGdCZTBQOEFYT280d0stQVdPeXRrRGdnWURWVk5FaUFZQWtBWUJtQVlBb1FhYQFcOG1abTVQNmdHQkxJR0pBaxFLCEFBQh3LBEJrGRgAQx0YRExnR0NnLi6aApkBIUlCWW1nQToFAjRMbXJsd0VnQUNnQU1acQFtYFptYmtfT2dsT1dVMHlPalE1TWpCQTZVTkoRYgw4RDlSEQwMQUFCWh0MAGgdDABwHQwAeB0MDDRBSWs1ePQOAThEOC7YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA44MTcwI05ZTTI6NDkyMNoEAggB4AQB8ASkpMjPAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBYUC-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBugp2gYWChAJERkBoBAAGADgBgHyBgIIAIAHAYgHAKAHAboHCCoEMS0tLUAByAefuwXSBw0JETMBMQzaBwYIBQlo4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=f347e8de8c602f7559e751ffddbc490365f1e19f&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=7469063901422388822&vd=ct~0|rr~0&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:24 GMT
AN-X-Request-Uuid
e9b5ad6a-c1e0-45dc-98c9-af75f1f2b35d
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
17632058214988633165
s0.2mdn.net/simgad/ Frame 5269 		37 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/simgad/17632058214988633165
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2006 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
dead1f4e72e8cf849bdac46b95a197af4af11ed48877c2db53f38c3b7f43e545
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 08:42:29 GMT
x-content-type-options
nosniff
age
558955
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37712
x-xss-protection
0
last-modified
Wed, 07 Jun 2023 19:19:13 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 13 Jun 2024 08:42:29 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 5269 		178 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57029
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1686742752845198"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:58:24 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/ Frame 5269 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/omrhp.js
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:09:52 GMT
content-encoding
br
x-content-type-options
nosniff
age
6512
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4172
x-xss-protection
0
server
cafe
etag
5499578052516643378
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 04 Jul 2023 18:09:52 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 5269 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssXAG3bnKY0rS0gliJEQf8A8E1DEoa7cgl_LUQvA3t208Gpw35aXHTNMvH2aVNhKyQvP3iqRovrtZLiXrorFzpXuCIO5tZD0Bi-OADGj2yFEusBwYTncmqkI3BZlPZbVpEEmW9ULyKE4b-T6quBC3ca_8mDMgGTeS3nfW4R4TGyLss&sai=AMfl-YTPw7uaYZk9513Ho_0TiRuLxNNUU0NrlmuGMZWn2rCWBCA755Rp6EU3SHGRsTUJuzvCbzQlROBzT80_r7JqZjxL2VuhP_aAlYmHWQ&sig=Cg0ArKJSzMqm3exNpvKbEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20230615.12464&arae=0&ftch=1&adurl=
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:24 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:58:24 GMT
dvtp_src.js
cdn.doubleverify.com/ Frame 5269 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dvtp_src.js
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:9000::6875:b612 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
UploadServer /
Resource Hash
856ed99804bf5b83c5c70314917f7b561f06bfb50cc10ed5430a8fca2c40f246

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:24 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Jun 2023 14:39:49 GMT
Server
UploadServer
ETag
"6bbda2156609c9b24e1e0e365f01b513"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
*
Cache-Control
max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3374
Expires
Sun, 18 Jun 2023 14:55:16 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 5269 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:09:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6513
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Jun 2024 18:09:51 GMT
async_usersync.html
acdn.adnxs.com/dmp/ Frame 8373 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=fumtwxvuy&e=1095001190858
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.172.245 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-172-245.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:24 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:58:26 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Unused62
8096267
Vary
Accept-Encoding
rd_log
nym1-ib.adnxs.com/ Frame 5269 		0
933 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKJEPBMCQgAAAMA1gAFAQjficikBhDBmpD5n5mRiG0Y3dfcnJHTofg2KjYJQoLix5i7dj8RnoMEGNhbcT8ZAAAAgML18D8hnoMEGNhbcT8pQYIJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXi4_gWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW8LCSAvkFIU81LUVkUWpnaC1JYUVMeVcxODBCR0FBZ3VhdVhBVEFCT0FCQUFFajFaRkR1MzhFTldBQmdqUVJvQUhBQWVBQ0FBUUNJQVFDUUFRR1lBUUdnQVFLb0FRS3dBUUM1QWZhLVNUakRESDRfd1FIaGRkNzB3c0IyUDhrQkFBQUFBTUpUN2pfWkFUWTh2VktXSWZVXzRBSDBxdm9EOVFHaThmOC1tQUlBb0FJQ3RRSUEBMwh2UUkBB9hBd0FJQXlBSUEwQUlBMkFJQTRBSUE2QUlBLUFJQWdBTUJtQU1Cb2dNT0NOU2JoeXNRQWhnQ0xRATvwVUNpQXhjSXNvbkFMQkFHR0FFdGl1aTVOeklIWkdWbVlYVnNkS0lERmdqdXVzQXNFQW9ZQVMwUW5uSV9NZ1oxYm1seGRXV2lBdzRJMUp1SEt4QUxHQUl0AVpkQUxvRENVNVpUVEk2TmpJMk11QUQ2VVBwQXcFHgUBQDhBUGZFNEFFbTRubkNvZ0VuAQi4cEFFQVpnRUJMSUVDZ2prd3BrTkVLNnp0QTI2QkJvSW5na1JLVnlQd3ZVb3pEOFoFSQkBIGc1TUtaRGNFRRkgCF9KQgkcBQEYMkFRRDhRUQUMBQHwUklJRkh3aWh5eVVRQlJnQklnTkRRVVFwTmp5OVVwWWg5VDh4UW1EbDBDTGJ5VC1JQmZZd2tBWEM5azZZQlpmYTRvY0JxUVhUcEJSMGUwbnRQN0VGBVgFAQhEQkIdazx5UVVBQUFDQW1jSFNQOUVGBSMFAQREWhUouFBBXzRBV3JCUEFGMXBpSEN2Z0ZyUDNRQW9JR0EwTkJSSWdHQkpBR0FaZ0dBS0VHBT8FASRDb0JnU3lCaVFKBQ8JAQBSCQcFAQBaBQYJAQBoCQcBAUBDNEJnby6aAsUBIUlDUG5fdzr9AixMbXJsd0VnQUNnQU0dzUxPZ2xPV1UweU9qWXlOakpBNlVOSjk1ADkdeQBCHXkEQmg5mQQ5cAF_CQEEQngJCAEBFEI0QUlJQqqVAQRKQRGY8F5QQV_YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS_yAhEKBkFEVl9JRBIHNTUyMTA2OPICEgoGQ1BHX0lEEggyMTA4OTM2NvICEgoFQ1BfSUQSCZVGEPICDQoIAT4YRlJFURIBMAUQHFJFTV9VU0VSBRAADAkgGENPREUSAPIBDwhDUEcVDxALCgdDUBUOFBAKBUlPXwGJADiJ0ADyASEESU8VITgTCg9DVVNUT01fTU9ERUwBKxQA8gIaChYyFgAcTEVBRl9OQU0FcQgeCho2HQAIQVNUAT4QSUZJRUQBPhwVCghTUExJVAFNAAkV2fCwgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xODeoBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQPMTI5MTcjTllNMjo2MjYy2gQCCAHgBAHwBLyW180BiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkABQzAAADYBQHgBQHwBajgRvoFBAgAEACQBgCYBgCiBg8xMDI2NCNOWU0yOjY0Mza4BgDBBgk2LPA_0AaeqwLaBhYKEAkSGQFgEAAYAOAGAfIGhwEIwvZOEoABR0JReVVsb0Gi4ERBQWtDQlFFSTBQTDNCeEMtMWJvQ0dPeUVsd01nQnlnQVFMQzB1Z2RJdjdXNkIxRHBRMWlrTW5FQQE9BQEQSGdBZ1EdEExJZ0JBSkFCQUpvQkFnZ0FxQUVBcy4gAHxBLi6ABwGIBwCgBwG6BwgqBDEtLS1AAcgHuP4F0gcNCRG5AbcI2gcGIQFwGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=737d1d211ca8b1372ab1aac4c3140836a76758bb&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dfumtwxvuy%26e%3D1095001190858,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dfumtwxvuy%26e%3D1095001190858&
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:24 GMT
AN-X-Request-Uuid
760f469f-6ecb-4989-85f3-3a931ba1eb4c
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync.html
acdn.adnxs.com/dmp/ Frame 2F31 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=rubwwfuc&e=1095001190858
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.172.245 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-172-245.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:24 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:58:26 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Unused62
8096267
Vary
Accept-Encoding
rd_log
nym1-ib.adnxs.com/ Frame ED8E 		0
933 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLWDPBMVgYAAAMA1gAFAQjficikBhCVqLHLwomsi3oY3dfcnJHTofg2KjYJ2Ey-2ebGlD8RiMfMpbtijz8ZAAAAgML18D8hiMfMpbtijz8p10wJJPCaMQAAACCF67E_MO7fwQ04mFBA6j9IAlCkpMjPAVi5q5cBYABopq60AXjf1wOAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCU3VmKCdhJywgNzc1OTExOCwgMCk7dWYoJ2knLCA4MzI2ODg2LCAwKTt1ZignZycsIDIxMTcyNjg2LCANKfCfcicsIDQzNTI5NDc1NiwgMCk7kgKFBCFsMldqZUFqMXFlY2FFS1NreU04QkdBQWd1YXVYQVRBQU9BQkFBRWpxUDFEdTM4RU5XQUJnalFSb0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRR29BUUd3QVFDNUFXSUFMeEZGeHBRX3dRRmlBQzhSUmNhVVA4a0JBQUFBQUFBQThEX1pBUUFBQQEPdFBBXzRBSG1uZndEOVFITnpNdzltQUlBb0FJQnRRSQEiBEF2DQjwWHdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQnVnTUpUbGxOTWpvMU1UWTA0QVBwUTRBRTZLUHZDb2dFLWFQdkNwQUVBWmdFQWFBRUZNRUVBBWYBAQhESkIBBw0BGDJBUUE4UVENDmBBQUFJZ0ZyQ2lwQmRPa0ZIUjdTZTBfc1FVARoJARhNRUZtcG1aAQIQdVRfSkIBOxxJRFY5OGtfMC4oAAhOa0YJMQBBIQywZ0JlMFA4QVhPbzR3Sy1BV095dGtEZ2dZRFZWTkVpQVlBa0FZQm1BWUFvUWFhAVw4bVptNVA2Z0dCTElHSkFrEUsMQUFCRR0MAGsZDABDHRhETGdHQ2cuLpoCmQEhSVJaamdBOgkCNExtcmx3RWdBQ2dBTVpxAW1gWm1ia19PZ2xPV1UweU9qVXhOalJBNlVOShFiDDhEOVIRDAxBQUJaHQwAaB0MAHAdDAB4HQwMNEFJazV44DhEOC7YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS_yAhEKBkFEVl9JRBIHN2klHPICEgoGQ1BHARQACHERGPICCgoFQ1ABFDgBMPICDQoIQURWX0ZSRVEREBxSRU1fVVNFUgUQABEJIDxDT0RFEgUzMzIxN_ICIwoIAVYFFBgXMDBrNWIwAQFMWTNDU2JBQU5fZW5fNPICCwoHQ1AJJRwA8gIQCgVJTwF1BAc4aa4Y8gIdCgdJTwkhDBIwMDYJRmQxMGJ2bnpBQUHyAhMKD0NVU1RPTV9NT0RFTAE9FADyAhoKFjIWACBMRUFGX05BTUUBHQgeCho2HQAIQVNUAT4QSUZJRUQBIRwNCghTUExJVAFN8JoBMIADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTg3qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDjgxNzAjTllNMjo1MTY02gQCCAHgBAHwBKSkyM8BiAUBmAUAoAX______wEFGAHABQDJBQAFARTwP9IFCQkFC3gAAADYBQHgBQHwBYUC-gUECAAQAJAGAJgGALgGAMEGASAwAADwP9AG6CnaBhYKEAkRGQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBugcIKgQxLS0tQAHIB9_XA9IHDQkRMwExCNoHBgFocBgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=dcb34ca2d7a1109dce7c70c168e7f04393af9dbc&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Drubwwfuc%26e%3D1095001190858,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Drubwwfuc%26e%3D1095001190858&
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=rubwwfuc&e=1095001190858
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:24 GMT
AN-X-Request-Uuid
f35e6541-bfdc-4fe9-8344-597a6ea8063c
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
PugMaster
image6.pubmatic.com/AdServer/ Frame 9629 		2 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=13486164&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
9c6bbd3ccfb7769c5995831c6c1d9fd73c42c92b85f263dbacc57fcd5039d84a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:23 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
container.html
7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 62AA 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
6
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:18 GMT
expires
Wed, 19 Jun 2024 19:58:18 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
async_usersync
ib.adnxs.com/ Frame 6CD7 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=10264&pub_id=2025736&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:24 GMT
AN-X-Request-Uuid
f2847af2-1fc9-4960-8169-39cd1713aaf8
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 1660 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
87420
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 19 Jun 2023 19:41:24 GMT
expires
Tue, 18 Jun 2024 19:41:24 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
visit.js
tps.doubleverify.com/ Frame B4B6 		724 B
748 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=413&ttfrms=30&brid=3&brver=114.0.5735.133&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D%3E6C4FCJ%3F6HD%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D%3E6C4FCJ%3F6HD%5D4%40%3ETar9EEADTbpTauTauD%40A2%3D%3C%5D4%40%3ETar9EEADTbpTauTauD%40A2%3D%3C%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=1491&ddur=136&uid=1687291104821576&jsCallback=dvCallback_1687291104821515&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.133%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=250&winw=300&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=3941&tgjsver=3941&lvvn=28&m1=13&refD=2&referrer=https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dibehklirob%26e%3D1095001190858&fcifrms=24&brh=2&sdf=2&dvp_epl=196&noc=4&nav_pltfrm=Win32&ctx=13693614&cmp=29652998&sid=7119312&plc=363876445&crt=193266029&btreg=554230373&btadsrv=doubleclick&adsrv=1&advid=10627282&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&dvp_rcp=2&dvp_htec=1&dvp_seem=2&dvp_tuk=1&dvp_sukv=21201896749.885468&dvp_tukv=74724135.50596863&dvp_strhd=0.3999977111816406&dvpx_strhd=0.3999977111816406&dvp_tuid=121139248161&jurtd=246835023
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements3941.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
b9635dbf46ae9928791d0cb10f66f32b67936e42157d6c237db3c2bce0c417ff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:24 GMT
Content-Encoding
br
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=0
Connection
keep-alive
Timing-Allow-Origin
*
Expires
06/19/2023 19:58:24
visit.js
tps.doubleverify.com/ Frame 89F2 		724 B
750 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=476&ttfrms=7&brid=3&brver=114.0.5735.133&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D%3E6C4FCJ%3F6HD%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D%3E6C4FCJ%3F6HD%5D4%40%3ETar9EEADTbpTauTauD%40A2%3D%3C%5D4%40%3ETar9EEADTbpTauTauD%40A2%3D%3C%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=1544&ddur=109&uid=1687291104842969&jsCallback=dvCallback_1687291104842527&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.133%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=250&winw=300&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=3941&tgjsver=3941&lvvn=28&m1=13&refD=2&referrer=https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Deqxddgiid%26e%3D1095001190858&fcifrms=24&brh=2&sdf=2&dvp_epl=196&noc=4&nav_pltfrm=Win32&ctx=13693614&cmp=29599255&sid=7119312&plc=364198308&crt=193069666&btreg=554237588&btadsrv=doubleclick&adsrv=1&advid=10627282&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&dvp_rcp=2&dvp_htec=1&dvp_seem=2&dvp_tuk=1&dvp_sukv=137834.48620765188&dvp_tukv=58412749392.8108&dvp_strhd=0.09999847412109375&dvpx_strhd=0.09999847412109375&dvp_tuid=1475012488177&jurtd=3549718354
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements3941.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
735bbd15020c8fee03453f0c214734b19a34091290333905a1e628c8706c83e6

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:24 GMT
Content-Encoding
br
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=0
Connection
keep-alive
Timing-Allow-Origin
*
Expires
06/19/2023 19:58:24
container.html
7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 156D 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
6
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:18 GMT
expires
Wed, 19 Jun 2024 19:58:18 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
generate_204
tpc.googlesyndication.com/ Frame 0DC9 		0
10 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?jybZRg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:24 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
view
googleads4.g.doubleclick.net/pcs/ Frame 5269 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssXAG3bnKY0rS0gliJEQf8A8E1DEoa7cgl_LUQvA3t208Gpw35aXHTNMvH2aVNhKyQvP3iqRovrtZLiXrorFzpXuCIO5tZD0Bi-OADGj2yFEusBwYTncmqkI3BZlPZbVpEEmW9ULyKE4b-T6quBC3ca_8mDMgGTeS3nfW4R4TGyLss&sai=AMfl-YTPw7uaYZk9513Ho_0TiRuLxNNUU0NrlmuGMZWn2rCWBCA755Rp6EU3SHGRsTUJuzvCbzQlROBzT80_r7JqZjxL2VuhP_aAlYmHWQ&sig=Cg0ArKJSzMqm3exNpvKbEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=260&vt=11&dtpt=259&dett=2&cstd=0&cisv=r20230615.12464&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:24 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:58:24 GMT
F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
pagead2.googlesyndication.com/bg/ Frame 7E77 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:35:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
1358
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14698
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:35:46 GMT
F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
pagead2.googlesyndication.com/bg/ Frame 586F 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:35:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
1358
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14698
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:35:46 GMT
visit.js
tps.doubleverify.com/ Frame 48CA 		724 B
750 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=422&ttfrms=7&brid=3&brver=114.0.5735.133&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D%3E6C4FCJ%3F6HD%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D%3E6C4FCJ%3F6HD%5D4%40%3ETar9EEADTbpTauTauD%40A2%3D%3C%5D4%40%3ETar9EEADTbpTauTauD%40A2%3D%3C%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=1576&ddur=78&uid=1687291104939971&jsCallback=dvCallback_1687291104939852&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.133%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=250&winw=300&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=3941&tgjsver=3941&lvvn=28&m1=13&refD=2&referrer=https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dtmpnmjnvld%26e%3D1095001190858&fcifrms=24&brh=2&sdf=2&dvp_epl=196&noc=4&nav_pltfrm=Win32&ctx=13693614&cmp=29652998&sid=7119312&plc=363876445&crt=193266029&btreg=554230373&btadsrv=doubleclick&adsrv=1&advid=10627282&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&dvp_rcp=2&dvp_htec=1&dvp_seem=2&dvp_tuk=1&dvp_sukv=1857401683.8044763&dvp_tukv=98447635817.08813&dvp_strhd=0.20000076293945312&dvpx_strhd=0.20000076293945312&dvp_tuid=894251619788&jurtd=2714855297
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements3941.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
13c76ad5d0b5e7433f0c010b2f2c0b179682d1682b157cf9ca997cc42b047697

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:24 GMT
Content-Encoding
br
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=0
Connection
keep-alive
Timing-Allow-Origin
*
Expires
06/19/2023 19:58:24
log
protected-by.clarium.io/ Frame 62AA 		0
0
log
protected-by.clarium.io/ Frame 62AA 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.73.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-73-233.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:58:25 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 62AA 		0
0
F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
pagead2.googlesyndication.com/bg/ Frame 3546 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:35:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
1359
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14698
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:35:46 GMT
vevent
nym1-ib.adnxs.com/ Frame ED8E 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKhCvBMIQUAAAMA1gAFAQjficikBhCVqLHLwomsi3oY3dfcnJHTofg2KjYJ2Ey-2ebGlD8RiMfMpbtijz8ZAAAAgML18D8hiMfMpbtijz8p10wJJPCaMQAAACCF67E_MO7fwQ04mFBA6j9IAlCkpMjPAVi5q5cBYABopq60AXjf1wOAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCU3VmKCdhJywgNzc1OTExOCwgMCk7dWYoJ2knLCA4MzI2ODg2LCAwKTt1ZignZycsIDIxMTcyNjg2LCANKfCfcicsIDQzNTI5NDc1NiwgMCk7kgKFBCFsMldqZUFqMXFlY2FFS1NreU04QkdBQWd1YXVYQVRBQU9BQkFBRWpxUDFEdTM4RU5XQUJnalFSb0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRR29BUUd3QVFDNUFXSUFMeEZGeHBRX3dRRmlBQzhSUmNhVVA4a0JBQUFBQUFBQThEX1pBUUFBQQEPdFBBXzRBSG1uZndEOVFITnpNdzltQUlBb0FJQnRRSQEiBEF2DQjwWHdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQnVnTUpUbGxOTWpvMU1UWTA0QVBwUTRBRTZLUHZDb2dFLWFQdkNwQUVBWmdFQWFBRUZNRUVBBWYBAQhESkIBBw0BGDJBUUE4UVENDmBBQUFJZ0ZyQ2lwQmRPa0ZIUjdTZTBfc1FVARoJARhNRUZtcG1aAQIQdVRfSkIBOxxJRFY5OGtfMC4oAAhOa0YJMQBBIQywZ0JlMFA4QVhPbzR3Sy1BV095dGtEZ2dZRFZWTkVpQVlBa0FZQm1BWUFvUWFhAVw4bVptNVA2Z0dCTElHSkFrEUsMQUFCRR0MAGsZDABDHRhETGdHQ2cuLpoCmQEhSVJaamdBOgkCNExtcmx3RWdBQ2dBTVpxAW1gWm1ia19PZ2xPV1UweU9qVXhOalJBNlVOShFiDDhEOVIRDAxBQUJaHQwAaB0MAHAdDAB4HQwMNEFJazV49A4BOEQ4LtgCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL4ADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTg3qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDjgxNzAjTllNMjo1MTY02gQCCAHgBAHwBKSkyM8BiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFhQL6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AG6CnaBhYKEAkRGQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBugcIKgQxLS0tQAHIB9_XA9IHDQkRMwExDNoHBggFCWjgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=efbe8ab91cf2e4c8d8cd22cb7084cb99632b21b0&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=7469063901422388822&vd=ct~0|rr~0&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:25 GMT
AN-X-Request-Uuid
93045bec-47dc-4918-aff4-80a0deacf487
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
dcm
s.amazon-adsystem.com/ Frame 752E 		43 B
855 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&redir=true&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:25 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid
7TG90RNMW26YRQWDZWFM
Pug
simage2.pubmatic.com/AdServer/ Frame B136
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
42 B
405 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:58:25 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:25 GMT
Expires
Tue, 20 Jun 2023 19:58:24 GMT
Keep-Alive
timeout=360
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server
MT3 1031 59fd23a master iad iad-pixel-x14 config_version:"1969"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
Pug
image2.pubmatic.com/AdServer/ Frame EEB8
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFFSmVFN0pKQW9BQUNEN3IzV1AxZw&gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Csyn%2Cpm&bee_sync_current_partner=adx&b...
  • https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Csyn%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
  • https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AAEJeE7JJAoAACD7r3WP1g&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Csyn%252Cpm%26bee_sync_cur...
  • https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Csyn%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AAEJeE7JJAoAACD7r3WP1g&pid=558502&do=add&gd...
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEJeE7JJAoAACD7r3WP1g&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dsyn%...
  • https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=syn%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=8231229510999469573&gdpr=0&gdpr_consent=
  • https://sync.technoratimedia.com/services?srv=cs&pid=73&uid=AAEJeE7JJAoAACD7r3WP1g&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26userid%3D8231229510999469573%26gdpr%3D0%...
  • https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&userid=8231229510999469573&gdpr=0&gdpr_consent=&bee_sync_partners=pm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=4
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAEJeE7JJAoAACD7r3WP1g&gdpr=0&gdpr_consent=
42 B
278 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAEJeE7JJAoAACD7r3WP1g&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:58:25 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:25 GMT
Server
gunicorn
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAEJeE7JJAoAACD7r3WP1g&gdpr=0&gdpr_consent=
strict-transport-security
max-age=2592000; includeSubDomains
Pug
image2.pubmatic.com/AdServer/ Frame 13B4
Redirect Chain
  • https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_d782ad8a5c874f3ebf8d6
42 B
279 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_d782ad8a5c874f3ebf8d6
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:58:23 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

content-length
0
content-type
image/gif
date
Tue, 20 Jun 2023 19:58:24 GMT
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_d782ad8a5c874f3ebf8d6
p3p
policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server
b
Pug
simage2.pubmatic.com/AdServer/ Frame C0E0
Redirect Chain
  • https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3958812064475458525&gdpr=0&gdpr_consent=
42 B
298 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3958812064475458525&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:58:24 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

AN-X-Request-Uuid
e18be95c-95ee-4ac6-aa2b-8ac4839c0364
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
Content-Type
text/html; charset=utf-8
Date
Tue, 20 Jun 2023 19:58:25 GMT
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3958812064475458525&gdpr=0&gdpr_consent=
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma
no-cache
Server
nginx/1.21.3
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
usersync
usersync.gumgum.com/ Frame DCC1 		35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=pbm&i=F2EBBF7D-4C79-4F31-B67B-920625C98DEF
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-127-173.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:25 GMT
Expires
0
Pragma
no-cache
sd
us-u.openx.net/w/1.0/ Frame 9629 		43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=540245193&val=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:25 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT
Martin
crb.kargo.com/api/v1/dsync/ Frame 9629 		43 B
504 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://crb.kargo.com/api/v1/dsync/Martin?exid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.209.177.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-209-177-129.compute-1.amazonaws.com
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:25 GMT
X-Accel-Expires
0
Vary
Origin
Content-Type
image/gif
Cache-Control
no-cache, no-store, must-revalidate, private, max-age=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 UTC
sync
sync.bfmio.com/ Frame 9629 		0
425 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.bfmio.com/sync?pid=187&uid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.204.174.60 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-204-174-60.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Connection
keep-alive
Date
Tue, 20 Jun 2023 19:58:24 GMT
syncMe
synchroscript.deliveryengine.adswizz.com/ Frame 9629 		0
397 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=mrtnsvr.com&idType=cookie&partnerUserId=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.229.88.75 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-229-88-75.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:24 GMT
X-Clacks-Overhead
GNU Terry Pratchett
X-Adswizz-request-id
d15a3ff1-0fa4-11ee-8f1c-06e4d4512189
Connection
keep-alive
Content-Length
0
X-Application-Context
application:production
Instance-id
i-04c86e9e8505b2f38
SPug
image4.pubmatic.com/AdServer/ Frame 9629
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&redir=true&gdpr=0&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-hxcr9SVE2uW_0uYPpkxnktY4jkhSgis-~A&gdpr=0
0
128 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-hxcr9SVE2uW_0uYPpkxnktY4jkhSgis-~A&gdpr=0
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H2
Server
162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:25 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-hxcr9SVE2uW_0uYPpkxnktY4jkhSgis-~A&gdpr=0
date
Tue, 20 Jun 2023 19:58:25 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.57
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
F2EBBF7D-4C79-4F31-B67B-920625C98DEF
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 9629 		43 B
603 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/pubmatic/F2EBBF7D-4C79-4F31-B67B-920625C98DEF?gdpr=0&gdpr_consent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:4e9:5a05:3fdd:1e3f:2ebe:5c68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:25 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
content-type
image/gif
content-length
43
Pug
simage2.pubmatic.com/AdServer/ Frame 9629
Redirect Chain
  • https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
  • https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=6f33179dc0e205ef&is_secure=true&networkId=17100&version=1&nuid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAB5mRHm03IoAMPllOYAAAAAAA&expiration=1687377505&nuid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&...
42 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAB5mRHm03IoAMPllOYAAAAAAA&expiration=1687377505&nuid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&is_secure=true&gdpr_consent=&gdpr=0
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:58:25 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:25 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAB5mRHm03IoAMPllOYAAAAAAA&expiration=1687377505&nuid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&is_secure=true&gdpr_consent=&gdpr=0
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
Pug
simage2.pubmatic.com/AdServer/ Frame 9629
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=d73a5f9f-f848-4ab7-950f-b9fc12a99154&gdpr=0&gdpr_consent=
1 B
318 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=d73a5f9f-f848-4ab7-950f-b9fc12a99154&gdpr=0&gdpr_consent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 18:08:37 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=d73a5f9f-f848-4ab7-950f-b9fc12a99154&gdpr=0&gdpr_consent=
Date
Tue, 20 Jun 2023 19:58:25 GMT
Connection
keep-alive
X-CI-RTID
f25cd903-dadd-40af-8adb-cc45c15eb6d1
Content-Length
205
Content-Type
text/html; charset=utf-8
Pug
simage2.pubmatic.com/AdServer/ Frame 9629
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
  • https://sonata-notifications.taptapnetworks.com/web/cookie/bidswitch/sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&gdpr_consent=&gdpr_pd=
  • https://x.bidswitch.net/sync?dsp_id=413&ssp=pubmatic&user_id=csonata_b302fbb7-fdbb-4009-9633-f71c8aea77c7&bsw_param=56daf56a-28b1-40e7-a167-b6cb39d3f949&expires=10&gdpr=0&gdpr_consent=&gdpr_pd=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&gdpr_consent=&gdpr_pd=
1 B
166 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&gdpr_consent=&gdpr_pd=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:58:25 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location
//simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&gdpr_consent=&gdpr_pd=
Date
Tue, 20 Jun 2023 19:58:25 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
pagead2.googlesyndication.com/bg/ Frame E91F 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:35:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
1359
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14698
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:35:46 GMT
log
protected-by.clarium.io/ Frame 156D 		0
0
log
protected-by.clarium.io/ Frame 156D 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.73.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-73-233.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:58:25 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 156D 		0
0
async_usersync
ib.adnxs.com/ Frame 8373 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=10264&pub_id=2025736&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:25 GMT
AN-X-Request-Uuid
885eef2b-794f-4b98-9730-4208263b118d
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 2F31 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=10264&pub_id=2025736&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:25 GMT
AN-X-Request-Uuid
d2d2e58e-cc2d-4f6d-8ee2-b4b9f3ff3d9c
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame AF75 		42 B
174 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssXTOyph7_GPXsu1ZWKRCaTbc_B7lUsi2AvyeXbGtwOtYAEpBSw-3cqnpT5Bxqrmt5ypIF6dPY4ykavV72Ech9RAqgqauNP&sig=Cg0ArKJSzCildfqxVCoeEAE&id=lidar2&mcvt=1208&p=0,0,250,300&mtos=1208,1208,1208,1208,1208&tos=1208,0,0,0,0&v=20230614&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=32&adk=3210668679&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687291102378&rpt=1791&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:25 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dv-measurements3941.js
cdn.doubleverify.com/ Frame 0106 		536 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dv-measurements3941.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:9000::6875:b612 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
UploadServer /
Resource Hash
a1b053b5e005612a140e8a725c0dcdc5393c15d3c4cc45164fece0f9e8f2cbd4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:25 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Jun 2023 10:24:03 GMT
Server
UploadServer
ETag
"245897220fbd1a0dfa41e714a5e3acf6"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
*
Cache-Control
max-age=946080900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103853
Expires
Mon, 17 Jun 2024 10:24:07 GMT
vevent
nym1-ib.adnxs.com/ Frame 5269 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLyDfBM8gYAAAMA1gAFAQjficikBhDBmpD5n5mRiG0Y3dfcnJHTofg2KjYJQoLix5i7dj8RnoMEGNhbcT8ZAAAAgML18D8hnoMEGNhbcT8pQYIJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXi4_gWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW8LCSAvkFIU81LUVkUWpnaC1JYUVMeVcxODBCR0FBZ3VhdVhBVEFCT0FCQUFFajFaRkR1MzhFTldBQmdqUVJvQUhBQWVBQ0FBUUNJQVFDUUFRR1lBUUdnQVFLb0FRS3dBUUM1QWZhLVNUakRESDRfd1FIaGRkNzB3c0IyUDhrQkFBQUFBTUpUN2pfWkFUWTh2VktXSWZVXzRBSDBxdm9EOVFHaThmOC1tQUlBb0FJQ3RRSUEBMwh2UUkBB9hBd0FJQXlBSUEwQUlBMkFJQTRBSUE2QUlBLUFJQWdBTUJtQU1Cb2dNT0NOU2JoeXNRQWhnQ0xRATvwVUNpQXhjSXNvbkFMQkFHR0FFdGl1aTVOeklIWkdWbVlYVnNkS0lERmdqdXVzQXNFQW9ZQVMwUW5uSV9NZ1oxYm1seGRXV2lBdzRJMUp1SEt4QUxHQUl0AVpkQUxvRENVNVpUVEk2TmpJMk11QUQ2VVBwQXcFHgUBQDhBUGZFNEFFbTRubkNvZ0VuAQi4cEFFQVpnRUJMSUVDZ2prd3BrTkVLNnp0QTI2QkJvSW5na1JLVnlQd3ZVb3pEOFoFSQkBIGc1TUtaRGNFRRkgCF9KQgkcBQEYMkFRRDhRUQUMBQHwUklJRkh3aWh5eVVRQlJnQklnTkRRVVFwTmp5OVVwWWg5VDh4UW1EbDBDTGJ5VC1JQmZZd2tBWEM5azZZQlpmYTRvY0JxUVhUcEJSMGUwbnRQN0VGBVgFAQhEQkIdazx5UVVBQUFDQW1jSFNQOUVGBSMFAQREWhUouFBBXzRBV3JCUEFGMXBpSEN2Z0ZyUDNRQW9JR0EwTkJSSWdHQkpBR0FaZ0dBS0VHBT8FASRDb0JnU3lCaVFKBQ8JAQBSCQcFAQBaBQYJAQBoCQcBAUBDNEJnby6aAsUBIUlDUG5fdzr9AixMbXJsd0VnQUNnQU0dzUxPZ2xPV1UweU9qWXlOakpBNlVOSjk1ADkdeQBCHXkEQmg5mQQ5cAF_CQEEQngJCAEBFEI0QUlJQqqVAQRKQRGY9JsBUEFf2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20vgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xODeoBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQPMTI5MTcjTllNMjo2MjYy2gQCCAHgBAHwBLyW180BiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFqOBG-gUECAAQAJAGAJgGAKIGDzEwMjY0I05ZTTI6NjQzNrgGAMEGAAAAAAAA8D_QBp6rAtoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgHyBocBCML2ThKAAUdCUXlVbG9BQUFBREFBa0NCUUVJMFBMM0J4Qy0xYm9DR095RWx3TWdCeWdBUUxDMHVnZEl2N1c2QjFEcFExaWtNbkVBQUFBQUFBQUFBSGdBZ1FFQUFBQSHbXEFBSWdCQUpBQkFKb0JBZ2dBcUFFQXNRRQkcBQF4Li6ABwGIBwCgBwG6BwgqBDEtLS1AAcgHuP4F0gcNCS63AIzaBwYIABAAGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=3de7662d0d9a5d7d1ca499caa713d1296eec2f66&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=7469063901422388822&vd=ct~0|rr~0&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:25 GMT
AN-X-Request-Uuid
58f59153-46fb-47cf-9a90-5dcfd0c8828e
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame A186 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
87421
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 19 Jun 2023 19:41:24 GMT
expires
Tue, 18 Jun 2024 19:41:24 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
views
prod-dfm-proxy-connext.azurewebsites.net/api/ 		90 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/views?UserId=23c7b2911e37a18862bb7d8d9656a1d8&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC
Requested by
Host: cdn.czx5eyk0exbhwp43ya.biz
URL: https://cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/t8y9347t.min.js?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0, Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash
bf7da55ef6be4cdd0d0932dd1e689a423b9b04c68e3cc9b083d4c099bf0e0ec9

Request headers

source-system
Plugin
site-code
DFM
autoqa
false
accept-language
en-CA,en;q=0.9
settingskey
BANG,MERC
authorization
Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkNvbm5lWHQiLCJleHAiOjE3NTkyOTEwOTh9.d86FimQCDiFllnd6RjHNCAu06Pcn78tQzgjpvGPsXf0
ssid
41f857f9d088451caa7ad3fe5bf0e18d
environment
prod
config-code
BANGWPPRODWAB
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
content-type
application/json
access-control-allow-origin
*
accept
application/json
attr
MERC
location
System
Referer
https://www.mercurynews.com/
version
Version: 2.8.5

Response headers

Expires
-1
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:25 GMT
Content-Encoding
gzip
X-Server-Time
6/20/2023 7:58:25 PM
Server
Microsoft-IIS/10.0, Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET, ASP.NET
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-Server-Time,Request-Context
Cache-Control
no-cache
Request-Context
appId=cid-v1:b3b1c194-8bfe-45e5-8168-866947d4f019
views
prod-dfm-proxy-connext.azurewebsites.net/api/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/views?UserId=23c7b2911e37a18862bb7d8d9656a1d8&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Request-Method
GET
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Access-Control-Allow-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:25 GMT
X-Powered-By
ASP.NET
activeview
pagead2.googlesyndication.com/pcs/ Frame C7FE 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv35TeBUJOO2qNsPnqttNERYo-hmp5E-nU-AAtmTpFNHkbUfQ_NLAMcGMHfENGzIYmg-XvZwIF6jT87i4kLbrNfckSB7_Bp8xQ&sig=Cg0ArKJSzN4zG1VVdltgEAE&id=lidar2&mcvt=1320&p=0,0,250,300&mtos=1320,1320,1320,1320,1320&tos=1320,0,0,0,0&v=20230614&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=32&adk=1241189742&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687291102370&rpt=1952&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:25 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame E9F9 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvqXkxnDyR4GT7H4eIGZsAApvMidIwoKWvO-PQgrFloJnFp2mZlUGZ6zrfd4ZP76ivIAt1ccVX9lL7obFUcK2W-F8IxnheLUAY&sig=Cg0ArKJSzAKJMYvxJXsjEAE&id=lidar2&mcvt=1323&p=0,0,250,300&mtos=1323,1323,1323,1323,1323&tos=1323,0,0,0,0&v=20230614&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=32&adk=3062143102&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687291102396&rpt=1866&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:25 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame ACDA 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:25 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:58:25 GMT
F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
pagead2.googlesyndication.com/bg/ Frame 1660 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:35:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
1359
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14698
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:35:46 GMT
vevent
nym1-ib.adnxs.com/ Frame E9F9 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLmF_BM5gsAAAMA1gAFAQjficikBhC4952ngO65rTsY3dfcnJHTofg2KjYJQoLix5i7dj8RnoMEGNhbcT8ZAAAAgML18D8hnoMEGNhbcT8pQYIJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlDspYrNAVi5q5cBYABopq60AXiPvAWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFjByJywgNDMwMDg0ODQ0BRbwsJIC7Q8hb0p4d2lBamdoLUlhRU95bGlzMEJHQUFndWF1WEFUQUJPQUJBQUVqMVpGRHUzOEVOV0FCZ2pRUm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUUtvQVFLd0FRQzVBZmEtU1RqRERINF93UUhoZGQ3MHdzQjJQOGtCQUFBQUFNSlQ3al9aQVRZOHZWS1dJZlVfNEFIMHF2b0Q5UUdpOGY4LW1BSUFvQUlDdFFJQQEzCHZRSQEH2EF3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJvZ01PQ05TYmh5c1FBaGdDTFEBO_BVQ2lBeGNJc29uQUxCQUdHQUV0aXVpNU56SUhaR1ZtWVhWc2RLSURGZ2p1dXNBc0VBb1lBUzBRbm5JX01nWjFibWx4ZFdXaUF3NEkxSnVIS3hBTEdBSXQBWmRBTG9EQ1U1WlRUSTZORGszT09BRDZVUHBBdwUeBQFAOEFQZkU0QUVtNG5uQ29nRW4BCDxwQUVBWmdFQktvRXN3Y0lfHQEIQVJEHQ4MOEJHUB0PCHdFZx0ODF9BU2odDwg4Qk02LAAANB0dCF9BVTZYAABTMiwABEZRMiwAAFY2WAAAWTYsAABvMiwAAFg2WAAAZTIsAAxHQUFmHS4Id0dJOhAAAFE6EAAsWUFlWVZvQUVCcUFIHTkIOEJzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQABwtQUcwQklBQx2lDF9BWWc2EAAAWjogAABaOiAAAGE6IAAAYTogAABiOiAAAGI6IAAAYzogAABjOiAAAGQ6IAAAZDogAABlOiAAAGU6IAAAZjogAABmOiAABFlBLv0BIQA2EAAAWjogAABaOiAAAGE6IAAAYTogAABiOiAAAGI6IAAAYzogAABjOiAAAGQ6IAAAZDogABBlQURBTzoUAABmOjQAAGY6IAAIWUFFOvQBNhAAAFo6IAAAWjogAABhOiAAAGE6IAAAYjogAABiOiAAAGM6IAAAYzogAABkOiAAAGQ6IAAAZTogAABlOiAAAGY6IAAAZjogAAhZQUY6AAE2EAAAWjogAABaOiAAmGJJRUNnamt3cGtORUs2enRBMjZCQm9JbmdrUktWeVB3dlVvekQ4WqU9CQEgZzVNS1pEY0VFGSAIX0pCCRwFARgyQVFEOFFRBQwFAfBSSUlGSHdpaHl5VVFCUmdCSWdORFFVUXBOank5VXBZaDlUOHhRbURsMENMYnlULUlCZklta0FYQzlrNllCWmZhNG9jQnFRWFRwQlIwZTBudFA3RUYFWAUBCERCQh1rPHlRVUFBQUNBbWNIU1A5RUYFIwUBBERaFSi4UEFfNEFXckJQQUYxcGlIQ3ZnRnJQM1FBb0lHQTBOQlJJZ0dCSkFHQVpnR0FLRUcFPwUBJENvQmdTeUJpUUoFDwkBAFIJBwUBAFoFBgkBAGgJBwEBQEM0QmdvLpoCxQEhSGlQZF9ROvEHLExtcmx3RWdBQ2dBTR3NTE9nbE9XVTB5T2pRNU56aEE2VU5KOTUAOR15AEIdeQRCaDmZBDlwAX8JAQRCeAkIAQEUQjRBSUlCqpUBBEpBEZj0mwFQQV_YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA8xMjkxNyNOWU0yOjQ5NzjaBAIIAeAEAfAE7KWKzQGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWo4Eb6BQQIABAAkAYAmAYAogYPMTAyNjQjTllNMjo1Mjc4uAYAwQYAAAAAAADwP9AGnqsC2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGhwEIwvZOEoABQ1JSNlQxb0FBQUFEQUFrQ0JRRUkwUEwzQnhDLTFib0NHT3lFbHdNZ0J5Z0FRTEMwdWdkSXY3VzZCMURwUTFpZUtYRUFBQUFBQUFBQUFIZ0FnUUVBQUFBIdtcQUFJZ0JBSkFCQUpvQkFnZ0FxQUVBc1FFCRwFAXguLoAHAYgHAKAHAboHCCoEMS0tLUAByAePvAXSBw0JLrcAjNoHBggAEAAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=e6985053eaec936706312eb92177b9567a77e069&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=7469063901422388822&vd=ct~0|rr~5&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:25 GMT
AN-X-Request-Uuid
3fe3bd65-76f0-45f0-8a74-93817359e24c
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
ca
choices.trustarc.com/ Frame AF75 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=747924248&js=pmw1&base=te-clr1-f98320f7-8d78-4991-9ce7-c7f8262a8ff9
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?sz=300x250&c=747924248&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
76bcae4994da8290d3a0fcf27ae859d958bc4916065051e21e1d667088d774e3
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
2330
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
B6HrM9V_fibNVSab8c4qtMU8ST1QQU0m9MNjDh9yh8h24XhAAzZe9Q==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame AF75 		38 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=747924248&js=pmw2
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?sz=300x250&c=747924248&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
KVhr7CeOWaVCo4ZU_BU50JGm4LIC5dM2GnwRYNDjlziPCk9e5hqttg==
expires
Mon, 26 Jul 1997 05:00:00 GMT
cap
choices.trustarc.com/ Frame AF75 		43 B
1019 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/cap?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=9d4d
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:25 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Origin
content-type
image/gif
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
5jPHKlOYpMMw5FlfjoQu_DCeRG_eo6mcYj86E4tgi0AMEshl4vAeXQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame AF75 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=29664373&js=st_1&sz=300x250&c=te-4c2a
Requested by
Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=29664373&js=st0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
080ad8b5d6dbbb1c8760424bf5cf690b492117512a8593405f40a22b97ee19e9
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
2245
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
gdcu-XF0DmL49woqy5WERl1l3PqU6Kb6qvxyajtSFe8gnRI3AgVi8A==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame AF75 		38 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=29664373&js=st_2
Requested by
Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=29664373&js=st0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
ce02a171fe79c0155c0e09b826d4e6542ab09be711d05cf4d75d569622a9d24c
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
yB6dGYoIhotPVbWRtY2ifM_g8Lj2-TIdk1Ck6NIexZ35Rqeiawtmlw==
expires
Mon, 26 Jul 1997 05:00:00 GMT
cap
choices.trustarc.com/ Frame AF75 		43 B
1020 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/cap?aid=sojern02&pid=sojern01&cid=29664373&w=300&h=250&c=dd32
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:25 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Origin
content-type
image/gif
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
F0VVpHmGSiI-IbpQwJYnG8ItWYRDgyBg-cR6sxNB7j4otFuufSQhcA==
expires
Mon, 26 Jul 1997 05:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame CFF2 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssqvk2R6a6WbeZfaLjUyHHGusKGacOhWwbYSf9pOukndk_XoY4Qo-sv4-N0121okH6NZRaQi6MpTVv_blXZ0TIiLg_DjWLNBWs&sig=Cg0ArKJSzIRC9vwNA0qJEAE&id=lidar2&mcvt=1205&p=0,0,250,300&mtos=1205,1205,1205,1205,1205&tos=1205,0,0,0,0&v=20230614&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=32&adk=2878691012&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687291102391&rpt=2087&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:25 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame ED8E 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv8SvrphLwihc2byhVBRotMIBxTURFHOK9QnLXnotpuxaGQ74DZ9EBdxyvE5ET71ZwDmXAfdCUAT7uL-D_VZ6Ei-59CP2TP&sig=Cg0ArKJSzN-9pnuyuTEXEAE&id=lidar2&mcvt=1111&p=0,0,250,300&mtos=1111,1111,1111,1111,1111&tos=1111,0,0,0,0&v=20230614&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=32&adk=730607261&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687291102426&rpt=2215&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:25 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
vevent
nym1-ib.adnxs.com/ Frame C7FE 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLyDfBM8gYAAAMA1gAFAQjficikBhDHiI7L-MOjnmsY3dfcnJHTofg2KjYJQoLix5i7dj8RnoMEGNhbcT8ZAAAAgML18D8hnoMEGNhbcT8pQYIJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXjIzQWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW8LCSAvkFIUpwOFpaZ2pnaC1JYUVMeVcxODBCR0FBZ3VhdVhBVEFCT0FCQUFFajFaRkR1MzhFTldBQmdqUVJvQUhBQWVBQ0FBUUNJQVFDUUFRR1lBUUdnQVFLb0FRS3dBUUM1QWZhLVNUakRESDRfd1FIaGRkNzB3c0IyUDhrQkFBQUFBTUpUN2pfWkFUWTh2VktXSWZVXzRBSDBxdm9EOVFHaThmOC1tQUlBb0FJQ3RRSUEBMwh2UUkBB9hBd0FJQXlBSUEwQUlBMkFJQTRBSUE2QUlBLUFJQWdBTUJtQU1Cb2dNT0NOU2JoeXNRQWhnQ0xRATvwVUNpQXhjSXNvbkFMQkFHR0FFdGl1aTVOeklIWkdWbVlYVnNkS0lERmdqdXVzQXNFQW9ZQVMwUW5uSV9NZ1oxYm1seGRXV2lBdzRJMUp1SEt4QUxHQUl0AVpkQUxvRENVNVpUVEk2TlRZeE1PQUQ2VVBwQXcFHgUBQDhBUGZFNEFFbTRubkNvZ0VuAQi4cEFFQVpnRUJMSUVDZ2prd3BrTkVLNnp0QTI2QkJvSW5na1JLVnlQd3ZVb3pEOFoFSQkBIGc1TUtaRGNFRRkgCF9KQgkcBQEYMkFRRDhRUQUMBQHwUklJRkh3aWh5eVVRQlJnQklnTkRRVVFwTmp5OVVwWWg5VDh4UW1EbDBDTGJ5VC1JQmVvcmtBWEM5azZZQlpmYTRvY0JxUVhUcEJSMGUwbnRQN0VGBVgFAQhEQkIdazx5UVVBQUFDQW1jSFNQOUVGBSMFAQREWhUouFBBXzRBV3JCUEFGMXBpSEN2Z0ZyUDNRQW9JR0EwTkJSSWdHQkpBR0FaZ0dBS0VHBT8FASRDb0JnU3lCaVFKBQ8JAQBSCQcFAQBaBQYJAQBoCQcBATxDNEJnby6aAsUBIUhDTkhfPv0CLExtcmx3RWdBQ2dBTR3NTE9nbE9XVTB5T2pVMk1UQkE2VU5KOTUAOR15AEIdeQRCaDmZBDlwAX8JAQRCeAkIAQEUQjRBSUlCqpUBBEpBEZj0mwFQQV_YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA8xMjkxNyNOWU0yOjU2MTDaBAIIAeAEAfAEvJbXzQGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWo4Eb6BQQIABAAkAYAmAYAogYPMTAyNjQjTllNMjo2MjA1uAYAwQYAAAAAAADwP9AGnqsC2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGhwEIwvZOEoABTHhSdFZsb0FBQUFEQUFrQ0JRRUkwUEwzQnhDLTFib0NHT3lFbHdNZ0J5Z0FRTEMwdWdkSXY3VzZCMURwUTFpOU1IRUFBQUFBQUFBQUFIZ0FnUUVBQUFBIdtcQUFJZ0JBSkFCQUpvQkFnZ0FxQUVBc1FFCRwFAXguLoAHAYgHAKAHAboHCCoEMS0tLUAByAfIzQXSBw0JLrcAjNoHBggAEAAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=551b2a4bf19fbd5e898fbf32dcc409379b96df2d&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=7469063901422388822&vd=ct~0|rr~5&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:25 GMT
AN-X-Request-Uuid
58934d23-98c9-44be-84cd-5042b51a32da
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
vevent
nym1-ib.adnxs.com/ Frame CFF2 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLuF_BM7gsAAAMA1gAFAQjficikBhDdzrn74PvfsHMY3dfcnJHTofg2KjYJQoLix5i7dj8RnoMEGNhbcT8ZAAAAgML18D8hnoMEGNhbcT8pQYIJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlDspYrNAVi5q5cBYABopq60AXi70wOAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFjByJywgNDMwMDg0ODQ0BRbwsJIC9Q8hUUo0N19RamdoLUlhRU95bGlzMEJHQUFndWF1WEFUQUJPQUJBQUVqMVpGRHUzOEVOV0FCZ2pRUm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUUtvQVFLd0FRQzVBZmEtU1RqRERINF93UUhoZGQ3MHdzQjJQOGtCQUFBQUFNSlQ3al9aQVRZOHZWS1dJZlVfNEFIMHF2b0Q5UUdpOGY4LW1BSUFvQUlDdFFJQQEzCHZRSQEH2EF3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJvZ01PQ05TYmh5c1FBaGdDTFEBO_BVQ2lBeGNJc29uQUxCQUdHQUV0aXVpNU56SUhaR1ZtWVhWc2RLSURGZ2p1dXNBc0VBb1lBUzBRbm5JX01nWjFibWx4ZFdXaUF3NEkxSnVIS3hBTEdBSXQBWmRBTG9EQ1U1WlRUSTZOVEkyTU9BRDZVUHBBdwUeBQFAOEFQZkU0QUVtNG5uQ29nRW4BCExwQUVBWmdFQktBRUZLb0Vzd2NJXx0BCEFSRB0ODDhCR1AdDwh3RWcdDgxfQVNqHQ8IOEJNNiwAADQdHQhfQVU2WAAAUzIsAARGUTIsAABWNlgAAFk2LAAAbzIsAABYNlgAAGUyLAAMR0FBZh0uCHdHSToQAABROhAALFlBZVlWb0FFQnFBSB05CDhCczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAcLUFHMEJJQUMdpQxfQVlnNhAAAFo6IAAAWjogAABhOiAAAGE6IAAAYjogAABiOiAAAGM6IAAAYzogAABkOiAAAGQ6IAAAZTogAABlOiAAAGY6IAAAZjogAARZQS79ASEANhAAAFo6IAAAWjogAABhOiAAAGE6IAAAYjogAABiOiAAAGM6IAAAYzogAABkOiAAAGQ6IAAQZUFEQU86FAAAZjo0AABmOiAACFlBRTr0ATYQAABaOiAAAFo6IAAAYTogAABhOiAAAGI6IAAAYjogAABjOiAAAGM6IAAAZDogAABkOiAAAGU6IAAAZTogAABmOiAAAGY6IAAIWUFGOgABNhAAAFo6IAAAWjogAJhiSUVDZ2prd3BrTkVLNnp0QTI2QkJvSW5na1JLVnlQd3ZVb3pEOFqlQQkBIGc1TUtaRGNFRRkgCF9KQgkcBQEYMkFRRDhRUQUMBQHwUklJRkh3aWh5eVVRQlJnQklnTkRRVVFwTmp5OVVwWWg5VDh4UW1EbDBDTGJ5VC1JQll3cGtBWEM5azZZQlpmYTRvY0JxUVhUcEJSMGUwbnRQN0VGBVgFAQhEQkIdazx5UVVBQUFDQW1jSFNQOUVGBSMFAQREWhUouFBBXzRBV3JCUEFGMXBpSEN2Z0ZyUDNRQW9JR0EwTkJSSWdHQkpBR0FaZ0dBS0VHBT8FASRDb0JnU3lCaVFKBQ8JAQBSCQcFAQBaBQYJAQBoCQcBAVBDNEJnckFCNUFEmgLFASFEeU81OXc6-QcsTG1ybHdFZ0FDZ0FNHdFMT2dsT1dVMHlPalV5TmpCQTZVTko5OQA5HX0AQh19BEJoOZ0EOXABgwkBBEJ4CQgBARRCNEFJSUKqmQEESkERmPSbAVBBX9gCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL4ADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTg3qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDzEyOTE3I05ZTTI6NTI2MNoEAggB4AQB8ATspYrNAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBajgRvoFBAgAEACQBgCYBgCiBg8xMDI2NCNOWU0yOjQ0ODa4BgDBBgAAAAAAAPA_0AaeqwLaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gaHAQjC9k4SgAFfeFBXVGxvQUFBQURBQWtDQlFFSTBQTDNCeEMtMWJvQ0dPeUVsd01nQnlnVVFMQzB1Z2RJdjdXNkIxRHBRMWlHSTNFQUFBQUFBQUFBQUhnQWdRRUFBQUEh21xBQUlnQkFKQUJBSm9CQWdnQXFBRUFzUUUJHAUBeC4ugAcBiAcAoAcBugcIKgQxLS0tQAHIB7vTA9IHDQkutwCM2gcGCAAQABgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=1d654395f1c4930733225080ac2bf4dd75359115&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=7469063901422388822&vd=ct~0|rr~5&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:25 GMT
AN-X-Request-Uuid
e562d576-fc92-4f5d-9395-1a65bcd5c4f1
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
vevent
nym1-ib.adnxs.com/ Frame AF75 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKdCvBMHQUAAAMA1gAFAQjficikBhC03-3C4dC571QY3dfcnJHTofg2KjYJ2Ey-2ebGlD8RiMfMpbtijz8ZAAAAgML18D8hiMfMpbtijz8p10wJJPCaMQAAACCF67E_MO7fwQ04mFBA6j9IAlCkpMjPAVi5q5cBYABopq60AXifuwWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCU3VmKCdhJywgNzc1OTExOCwgMCk7dWYoJ2knLCA4MzI2ODg2LCAwKTt1ZignZycsIDIxMTcyNjg2LCANKfCfcicsIDQzNTI5NDc1NiwgMCk7kgKBBCE2R1JEUmdqMXFlY2FFS1NreU04QkdBQWd1YXVYQVRBQU9BQkFBRWpxUDFEdTM4RU5XQUJnalFSb0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRR29BUUd3QVFDNUFXSUFMeEZGeHBRX3dRRmlBQzhSUmNhVVA4a0JBQUFBQUFBQThEX1pBUUFBQQEPdFBBXzRBSG1uZndEOVFITnpNdzltQUlBb0FJQnRRSQEiBEF2DQjwVXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQnVnTUpUbGxOTWpvME9USXc0QVBwUTRBRTZLUHZDb2dFLWFQdkNwQUVBWmdFQWNFRUFBBWMUQUFBREpCAQcNARgyQVFBOFFRDQ5gQUFBSWdGdUNhcEJkT2tGSFI3U2UwX3NRVQEaCQEYTUVGbXBtWgECEHVUX0pCATscSURWOThrXzAuKAAITmtGCTEAQSEIsGdCZTBQOEFYT280d0stQVdPeXRrRGdnWURWVk5FaUFZQWtBWUJtQVlBb1FhYQFcOG1abTVQNmdHQkxJR0pBaxFLCEFBQh3LBEJrGRgAQx0YRExnR0NnLi6aApkBIUlCWW1nQToFAjRMbXJsd0VnQUNnQU1acQFtYFptYmtfT2dsT1dVMHlPalE1TWpCQTZVTkoRYgw4RDlSEQwMQUFCWh0MAGgdDABwHQwAeB0MDDRBSWs1ePQOAThEOC7YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA44MTcwI05ZTTI6NDkyMNoEAggB4AQB8ASkpMjPAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBYUC-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBugp2gYWChAJERkBoBAAGADgBgHyBgIIAIAHAYgHAKAHAboHCCoEMS0tLUAByAefuwXSBw0JETMBMQzaBwYIBQlo4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=f347e8de8c602f7559e751ffddbc490365f1e19f&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=7469063901422388822&vd=ct~0|rr~5&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:25 GMT
AN-X-Request-Uuid
2beeb93a-da72-4ca2-84eb-b240c41e5f82
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
visit.js
tps.doubleverify.com/ Frame 0106 		724 B
750 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=473&ttfrms=9&brid=3&brver=114.0.5735.133&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D%3E6C4FCJ%3F6HD%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D%3E6C4FCJ%3F6HD%5D4%40%3ETar9EEADTbpTauTauD%40A2%3D%3C%5D4%40%3ETar9EEADTbpTauTauD%40A2%3D%3C%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=2241&ddur=20&uid=1687291105930359&jsCallback=dvCallback_1687291105930640&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.133%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=250&winw=300&wouh=1200&wouw=1600&scah=1200&scaw=1600&dvp_isOnHead=1&jsver=3941&tgjsver=3941&lvvn=28&m1=13&refD=2&referrer=https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dfumtwxvuy%26e%3D1095001190858&fcifrms=24&brh=2&sdf=2&dvp_epl=196&noc=4&nav_pltfrm=Win32&ctx=13693614&cmp=29599255&sid=7119312&plc=364198308&crt=193069666&btreg=554237588&btadsrv=doubleclick&adsrv=1&advid=10627282&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&dvp_rcp=2&dvp_htec=1&dvp_seem=2&dvp_tuk=1&dvp_sukv=42872475.88244968&dvp_tukv=16234933.93157614&dvp_strhd=0.1999969482421875&dvpx_strhd=0.1999969482421875&dvp_tuid=846781029889&jurtd=2371185721
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
076f2e88a9bf8677685af29386cd2303bcbcb6e3fea6e5d750ffd17bcd2786f6

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:25 GMT
Content-Encoding
br
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=0
Connection
keep-alive
Timing-Allow-Origin
*
Expires
06/19/2023 19:58:25
async_usersync.html
acdn.adnxs.com/dmp/ Frame 70E6 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.172.245 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-172-245.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:25 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:58:27 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Unused62
8096267
Vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame ADB7 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.173.8 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-173-8.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165146
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:58:26 GMT
expires
Thu, 22 Jun 2023 17:50:52 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
/
csync.smilewanted.com/ Frame 3541 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e42869601ae87a83476b74dbfb615c3acde329931afc04beea4bd387f3703c7e

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69624bbfd2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:26 GMT
server
cloudflare
vary
Accept-Encoding
usync.html
eus.rubiconproject.com/ Frame A021 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:58:26 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
/
rtb-csync.smartadserver.com/redir/ Frame ACDA
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=560288&ev=1&rurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D92%26partneruserid%3D%25%25VGUID%25%25&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=sk2jAnLigg03&ev=1&pid=560288&gdpr_consent=&gdpr=0
43 B
487 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=sk2jAnLigg03&ev=1&pid=560288&gdpr_consent=&gdpr=0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:25 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

strict-transport-security
max-age=15768000
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server
Jetty(10.0.14)
content-language
en-CA
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=sk2jAnLigg03&ev=1&pid=560288&gdpr_consent=&gdpr=0
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-6d945594b4-rfn2r
expires
-1
/
wt.rqtrk.eu/ Frame ACDA
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=150&partneruserid=0&redirurl=https%3A%2F%2Fwt.rqtrk.eu%3Fpid%3D58a76248-f101-4e52-b8f7-c4de9362ea12%26src%3Dwww%26type%3D100%26sid%3D0%26...
  • https://wt.rqtrk.eu/?pid=58a76248-f101-4e52-b8f7-c4de9362ea12&src=www&type=100&sid=0&uid=8231229510999469573&gdpr_pd=0&gdpr=0&gdpr_consent=
43 B
351 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wt.rqtrk.eu/?pid=58a76248-f101-4e52-b8f7-c4de9362ea12&src=www&type=100&sid=0&uid=8231229510999469573&gdpr_pd=0&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
15.235.42.104 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS
haproxy-ca-003.roqad.pl
Software
istio-envoy /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
server
istio-envoy
p3p
CP="NOI DSP COR DEVa PSAa PSDa OUR BUS UNI COM NAV STA"
content-type
image/gif
cache-control
no-cache,private
x-envoy-upstream-service-time
0
content-length
43
expires
Tue, 20 Jun 2023 19:58:25 GMT

Redirect headers

location
https://wt.rqtrk.eu?pid=58a76248-f101-4e52-b8f7-c4de9362ea12&src=www&type=100&sid=0&uid=8231229510999469573&gdpr_pd=0&gdpr=0&gdpr_consent=
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:25 GMT
cache-control
no-cache,no-store
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
/
rtb-csync.smartadserver.com/redir/ Frame ACDA
Redirect Chain
  • https://cms.quantserve.com/pixel/p-EtBqU4Lj3YbAv.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=F5iYHxGYxRQMyMQeEZqMGkPIxR8MzsQVGJ07SUos
43 B
515 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=F5iYHxGYxRQMyMQeEZqMGkPIxR8MzsQVGJ07SUos
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:25 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=F5iYHxGYxRQMyMQeEZqMGkPIxR8MzsQVGJ07SUos
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
/
rtb-csync.smartadserver.com/redir/ Frame ACDA
Redirect Chain
  • https://ad.turn.com/r/cs?pid=33&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D32%26partneruserid%3D%23USER_ID%23%26gdpr%3D%23GDPR_APPLICABLE%23%26gdpr_consent%...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=8818067066479886686&gdpr=0&gdpr_consent=
43 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=8818067066479886686&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:25 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=8818067066479886686&gdpr=0&gdpr_consent=
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:25 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
p
a.audrte.com/ Frame ACDA
Redirect Chain
  • https://a.audrte.com/get?p=M501991648&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D141%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=ZzY4WHNaeGdELTdTZk9aNnNwRjd5a3lhQQ==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZ...
  • https://a.audrte.com/ddp?red=eyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2lcdTAwM2QxXHUwMDI2cGFydG5lcmlkXHUwMDNkMTQxXHUwMDI2cGFydG5lcnVzZXJpZFx1MDAzZGc2OFhzWnhnRC03U2ZPWjZz...
  • https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2lcdTAwM2QxXHUwMDI2cGFydG5lcmlkXHUwMDNkMTQxXHUwMDI2cGFydG5lcnVzZXJpZFx...
  • https://a.audrte.com/a?adform_uid=5407894714181040436&r=eyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2lcdTAwM2QxXHUwMDI2cGFydG5lcmlkXHUwMDNkMTQxXHUwMDI2cGFydG5lcnVzZXJpZFx1M...
  • https://rtb-csync.smartadserver.com/redir/?partnerid=141&partneruserid=g68XsZxgD-7SfOZ6spF7ykyaA&gdpr=0&gdpr_consent=&redirurl=https%3A%2F%2Fa.audrte.com%2Fmatch%3Fuid%3DSMART_USER_ID%26p%3DM501991...
  • https://a.audrte.com/match?uid=8231229510999469573&p=M501991648&r=https%3A%2F%2Fa.audrte.com%2Fp%3F&gdpr=0&gdpr_consent=
  • https://a.audrte.com/p?
68 B
424 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.audrte.com/p?
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
3.221.8.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-221-8-21.compute-1.amazonaws.com
Software
nginx/1.18.0 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:28 GMT
Server
nginx/1.18.0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
68

Redirect headers

Date
Tue, 20 Jun 2023 19:58:28 GMT
Server
nginx/1.18.0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Access-Control-Allow-Origin
*
Location
https://a.audrte.com/p?
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
pagead2.googlesyndication.com/bg/ Frame A186 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:35:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
1360
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14698
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:35:46 GMT
usync.js
eus.rubiconproject.com/ Frame A021 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:26 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 08:41:09 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=45779
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 08:41:25 GMT
delete
prod-dfm-proxy-connext.azurewebsites.net/api/views/user/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/views/user/delete?UserId=23c7b2911e37a18862bb7d8d9656a1d8&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC&conversationId=104103
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Request-Method
GET
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Access-Control-Allow-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:26 GMT
X-Powered-By
ASP.NET
delete
prod-dfm-proxy-connext.azurewebsites.net/api/views/user/ 		0
805 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/views/user/delete?UserId=23c7b2911e37a18862bb7d8d9656a1d8&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC&conversationId=104103
Requested by
Host: cdn.czx5eyk0exbhwp43ya.biz
URL: https://cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/t8y9347t.min.js?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0, Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

source-system
Plugin
site-code
DFM
autoqa
false
accept-language
en-CA,en;q=0.9
settingskey
BANG,MERC
authorization
Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkNvbm5lWHQiLCJleHAiOjE3NTkyOTEwOTh9.d86FimQCDiFllnd6RjHNCAu06Pcn78tQzgjpvGPsXf0
ssid
41f857f9d088451caa7ad3fe5bf0e18d
environment
prod
config-code
BANGWPPRODWAB
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
content-type
application/json
access-control-allow-origin
*
accept
application/json
attr
MERC
location
System
Referer
https://www.mercurynews.com/
version
Version: 2.8.5

Response headers

Expires
-1
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:26 GMT
X-Server-Time
6/20/2023 7:58:26 PM
Server
Microsoft-IIS/10.0, Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET, ASP.NET
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-Server-Time,Request-Context
Cache-Control
no-cache
Content-Length
0
Request-Context
appId=cid-v1:b3b1c194-8bfe-45e5-8168-866947d4f019
ca
choices.trustarc.com/ Frame ED8E 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=11181583&js=pmw1&base=te-clr1-5aaf7ceb-d946-46b1-b35f-10f0cf02c740
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?sz=300x250&c=11181583&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
d2943288882559692f85ae8d29de8bf78c448aed6c6990bca2a7290b32661335
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
2327
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
ZmbNOtweCD6t9Dbhs4mgGKIjcdweYcad-beaDGejKUkv30xPTv_LPA==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame ED8E 		38 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=11181583&js=pmw2
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?sz=300x250&c=11181583&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
oc4oqtOzFNSitLoAV1wZCygQ2s3zUWA60g-sW5hrCsOBAx9mTT8HfA==
expires
Mon, 26 Jul 1997 05:00:00 GMT
cap
choices.trustarc.com/ Frame ED8E 		43 B
1019 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/cap?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=896b
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Origin
content-type
image/gif
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
eXl8j-VIKNqJMaM3EluzeNGujR08JOZY2CfMT-ciq00r_Awib-euug==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame ED8E 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=29664373&js=st_1&sz=300x250&c=te-eda3
Requested by
Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=29664373&js=st0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
6a71ac78889985a1f137d5c3045277ed1c699f0bed1bbdea4c8a298d46760e1f
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
2247
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
jbGTAUE-4f60yEP_CimMe4ap6fgGc10YysukikA9EXRINcNLZ7TRXA==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame ED8E 		38 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=29664373&js=st_2
Requested by
Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=29664373&js=st0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
ce02a171fe79c0155c0e09b826d4e6542ab09be711d05cf4d75d569622a9d24c
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
age
1
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
_rXY-Iab8E49lrEJdnfD_7ybLwiUaktRM7OpnQAvBiusRXTzzZbgaA==
expires
Mon, 26 Jul 1997 05:00:00 GMT
cap
choices.trustarc.com/ Frame ED8E 		43 B
1020 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/cap?aid=sojern02&pid=sojern01&cid=29664373&w=300&h=250&c=6e77
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Origin
content-type
image/gif
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
PShF26gV5exY9PPTT6MhBdeRsR2lsDg8vxDsAp0-ROSlkmL7j_vW1g==
expires
Mon, 26 Jul 1997 05:00:00 GMT
get
choices.trustarc.com/ Frame AF75 		287 B
629 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Mon, 19 Jun 2023 00:08:52 GMT
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P2
age
157774
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
287
x-amz-cf-id
ubryXudTELTNjfD1xQFLnDGuZJ4JSR3mgkPvluEgLi32GmjZVXhH1w==
expires
Wed, 19 Jul 2023 00:08:52 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 5269 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu3ZyrTjFqv7E2RCNyPzJByrFDidf0sLTlqfpCR0piorDN1zWgFVyL0EbwGRMjxP2F8_xgt604Q6aDnhULsKpSkSkKQbzwogQw&sig=Cg0ArKJSzMv1emf7camcEAE&id=lidar2&mcvt=1440&p=0,0,250,300&mtos=1440,1440,1440,1440,1440&tos=1440,0,0,0,0&v=20230614&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=32&adk=1757378021&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687291102418&rpt=2781&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 70E6 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:26 GMT
AN-X-Request-Uuid
202d791e-f126-4cf6-abe4-ef8920695aee
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usync.html
eus.rubiconproject.com/ Frame 3285 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:58:26 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame 7337 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.172.245 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-172-245.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:26 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:58:28 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Unused62
8096267
Vary
Accept-Encoding
/
csync.smilewanted.com/ Frame 0D45 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e42869601ae87a83476b74dbfb615c3acde329931afc04beea4bd387f3703c7e

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69629695f2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:26 GMT
server
cloudflare
vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 44FE 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.173.8 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-173-8.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165146
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:58:26 GMT
expires
Thu, 22 Jun 2023 17:50:52 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
/
rtb-csync.smartadserver.com/redir/ Frame 97F8
Redirect Chain
  • https://b1sync.zemanta.com/usersync/smart/?cb=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D116%26partneruserid%3D__ZUID__&gdpr=0&gdpr_consent=
  • https://stags.bluekai.com/site/23178?id=enfOlcX9S9Dq6ua2mBcD&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIWWG43ZNZRS443NMFZHIYLEONSXE5TFOIXGG33N...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIWWG43ZNZRS443NMFZHIYLEONSXE5TFOIXGG33NF5ZGKZDJOIXT6ZLYMNUGC3THMU6XG3LBOJ2CMZ3EOBZD2MBGNFZXG2J5GETHAYLSORXGK4TJMQ6TCMJWEZYGC...
  • https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=enfOlcX9S9Dq6ua2mBcD
43 B
737 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=enfOlcX9S9Dq6ua2mBcD
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:27 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:27 GMT
Content-Type
text/html; charset=utf-8
Location
https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=enfOlcX9S9Dq6ua2mBcD
P3p
CP="We do not support P3P header."
Cache-Control
no-cache, no-store, must-revalidate
Content-Length
140
Expires
Thu, 01 Dec 1994 16:00:00 GMT
/
rtb-csync.smartadserver.com/redir/ Frame 97F8
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/gjIEMT18?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D94%26partneruserid%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=ZJIE3AABR7XTlQAz&gdpr=0&gdpr_consent=
43 B
545 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=ZJIE3AABR7XTlQAz&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:27 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

x-served-by
cache-yyz4557-YYZ
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
via
1.1 varnish
server
Varnish
x-timer
S1687291107.761412,VS0,VE0
x-cache
HIT
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=ZJIE3AABR7XTlQAz&gdpr=0&gdpr_consent=
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
/
rtb-csync.smartadserver.com/redir/ Frame 97F8
Redirect Chain
  • https://visitor.omnitagjs.com/visitor/bsync?uid=627080440e659fbe0f85333c665ae1de&name=SMARTADSERVER&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D117%26partnerus...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=757349f6dab79002613d93ce22427ff9&gdpr=0&gdpr_consent=0
43 B
562 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=757349f6dab79002613d93ce22427ff9&gdpr=0&gdpr_consent=0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:27 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
x-content-type-options
nosniff
server
ayl-lb-usa02
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=757349f6dab79002613d93ce22427ff9&gdpr=0&gdpr_consent=0
p3p
CP="CAO PSA OUR"
cache-control
no-cache, no-store, must-revalidate
x-envoy-upstream-service-time
20
content-length
0
expires
0
/
rtb-csync.smartadserver.com/redir/ Frame 97F8
Redirect Chain
  • https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&pubid=5679&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=f66eb2fc-b468-4574-8969-c71d03ddbfc2&gdpr_consent=null&gdpr=0
43 B
579 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=f66eb2fc-b468-4574-8969-c71d03ddbfc2&gdpr_consent=null&gdpr=0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=f66eb2fc-b468-4574-8969-c71d03ddbfc2&gdpr_consent=null&gdpr=0
date
Tue, 20 Jun 2023 19:58:26 GMT
server
_
content-length
0
/
rtb-csync.smartadserver.com/redir/ Frame 97F8
Redirect Chain
  • https://secure.adnxs.com/getuid?https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D86%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=3958812064475458525&gdpr=0&gdpr_consent=
43 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=3958812064475458525&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Date
Tue, 20 Jun 2023 19:58:26 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
2ff878c6-5f2e-486f-98bb-2c932fb49029
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=3958812064475458525&gdpr=0&gdpr_consent=
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usync.html
eus.rubiconproject.com/ Frame D898 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:58:26 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
/
csync.smilewanted.com/ Frame 02AD 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e42869601ae87a83476b74dbfb615c3acde329931afc04beea4bd387f3703c7e

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6962969622c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:26 GMT
server
cloudflare
vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 205C 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.173.8 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-173-8.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165146
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:58:26 GMT
expires
Thu, 22 Jun 2023 17:50:52 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame ED6C 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.172.245 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-172-245.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:26 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:58:28 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Unused62
8096267
Vary
Accept-Encoding
/
rtb-csync.smartadserver.com/redir/ Frame 37D1
Redirect Chain
  • https://ad.turn.com/r/cs?pid=33&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D32%26partneruserid%3D%23USER_ID%23%26gdpr%3D%23GDPR_APPLICABLE%23%26gdpr_consent%...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=8818067066479886686&gdpr=0&gdpr_consent=
43 B
525 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=8818067066479886686&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:27 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=8818067066479886686&gdpr=0&gdpr_consent=
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
/
rtb-csync.smartadserver.com/redir/ Frame 37D1
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=10&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D22%26partneruserid%3DYOUR_USER_ID&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=5407894714181040436&gdpr=0&gdpr_consent=
43 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=5407894714181040436&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
GET
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=5407894714181040436&gdpr=0&gdpr_consent=
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
/
rtb-csync.smartadserver.com/redir/ Frame 37D1
Redirect Chain
  • https://dsp.adfarm1.adition.com/cookie/?ssp=5&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7246860123398011025&gdpr=0&gdpr_consent=
43 B
561 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7246860123398011025&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Location
https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7246860123398011025&gdpr=0&gdpr_consent=
Date
Tue, 20 Jun 2023 19:58:27 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
p3p
policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
/
rtb-csync.smartadserver.com/redir/ Frame 37D1
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=v5hJK9Sl&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44&gdpr=0
43 B
566 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44&gdpr=0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44&gdpr=0
date
Tue, 20 Jun 2023 19:58:26 GMT
content-length
0
dcm
aax-eu.amazon-adsystem.com/s/ Frame 37D1
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=135&partneruserid=TAM_OK&redirurl=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fdcm%3Fpid%3Df7a5db36-1d5c-4c26-81b6-b4d0807faffb%26id%3D...
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=8231229510999469573&gdpr=0&gdpr_consent=
43 B
855 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=8231229510999469573&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
52.94.223.167 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:27 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
N12HYATJVHF0DXJE189Y
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location
https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=8231229510999469573&gdpr=0&gdpr_consent=
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
cache-control
no-cache,no-store
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
async_usersync.html
acdn.adnxs.com/dmp/ Frame 3812 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.172.245 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-172-245.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:26 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:58:28 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Unused62
8096267
Vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 4E62 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.173.8 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-173-8.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165146
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:58:26 GMT
expires
Thu, 22 Jun 2023 17:50:52 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
usync.html
eus.rubiconproject.com/ Frame 5A1E 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:58:26 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
/
csync.smilewanted.com/ Frame 8D17 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e42869601ae87a83476b74dbfb615c3acde329931afc04beea4bd387f3703c7e

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6962969672c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:26 GMT
server
cloudflare
vary
Accept-Encoding
p
a.audrte.com/ Frame 8FB1
Redirect Chain
  • https://a.audrte.com/get?p=M501991648&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D141%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
  • https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2lcdTAwM2QxXHUwMDI2cGFydG5lcmlkXHUwMDNkMTQxXHUwMDI2cGFydG5lcnVzZXJpZFx...
  • https://a.audrte.com/a?adform_uid=5407894714181040436&r=eyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2lcdTAwM2QxXHUwMDI2cGFydG5lcmlkXHUwMDNkMTQxXHUwMDI2cGFydG5lcnVzZXJpZFx1M...
  • https://rtb-csync.smartadserver.com/redir/?partnerid=141&partneruserid=g68XsZxgD-7SfOZ6spF7ykyaA&gdpr=0&gdpr_consent=&redirurl=https%3A%2F%2Fa.audrte.com%2Fmatch%3Fuid%3DSMART_USER_ID%26p%3DM501991...
  • https://a.audrte.com/match?uid=8231229510999469573&p=M501991648&r=https%3A%2F%2Fa.audrte.com%2Fp%3F&gdpr=0&gdpr_consent=
  • https://a.audrte.com/p?
68 B
424 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.audrte.com/p?
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
3.221.8.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-221-8-21.compute-1.amazonaws.com
Software
nginx/1.18.0 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:28 GMT
Server
nginx/1.18.0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
68

Redirect headers

Date
Tue, 20 Jun 2023 19:58:28 GMT
Server
nginx/1.18.0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Access-Control-Allow-Origin
*
Location
https://a.audrte.com/p?
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
/
rtb-csync.smartadserver.com/redir/ Frame 8FB1
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?&rd=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D91%26partneruserid%3D%23PM_USER_ID%26gdpr%3DPM_GDPR%26gdpr_conse...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=91&partneruserid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
43 B
565 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=91&partneruserid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=91&partneruserid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
date
Tue, 20 Jun 2023 19:58:26 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
/
rtb-csync.smartadserver.com/redir/ Frame 8FB1
Redirect Chain
  • https://cs.admanmedia.com/e09bad714a425a93d6dea503dcf9c528.gif?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D130%26partneruserid%3D%5BUID%5D%26gdpr%3D%5BGDPR%5...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=130&partneruserid=d90855e2-a762-4191-8327-12f7f682caea&gdpr=0&gdpr_consent=[GDPR_CONSENT]
43 B
566 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=130&partneruserid=d90855e2-a762-4191-8327-12f7f682caea&gdpr=0&gdpr_consent=[GDPR_CONSENT]
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:26 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Server
nginx
Transfer-Encoding
chunked
X-Frame-Options
DENY
Location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=130&partneruserid=d90855e2-a762-4191-8327-12f7f682caea&gdpr=0&gdpr_consent=[GDPR_CONSENT]
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Expires
0
/
rtb-csync.smartadserver.com/redir/ Frame 8FB1
Redirect Chain
  • https://s.ad.smaato.net/c/?adExInit=sas&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D133%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=133&partneruserid=d854fcfc
43 B
538 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=133&partneruserid=d854fcfc
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

date
Tue, 20 Jun 2023 19:58:26 GMT
via
1.1 6f9ef5ae165c9835aa6935d9fb7e2072.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
EWR53-P1
x-cache
FunctionGeneratedResponse from cloudfront
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=133&partneruserid=d854fcfc
cache-control
no-cache, must-revalidate
content-length
0
x-amz-cf-id
9mUgp5hY7gJPvEmRtBqTZ4_EhrQqgTdMnNiRlCdiRNEWUDXZtJQ1pQ==
/
rtb-csync.smartadserver.com/redir/ Frame 8FB1
Redirect Chain
  • https://sync.1rx.io/usersync2/smartadserver?gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4236283162
  • https://sync.1rx.io/usersync/tradedesk/120447a6-30d3-414b-b8f9-7a5eddeefdcd
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fpartnerid%3D113%26partneruserid%3DRX-99a076fc-2...
  • https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
43 B
785 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:27 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Location
https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Date
Tue, 20 Jun 2023 19:58:27 GMT
Content-Type
text/html
Connection
keep-alive
ETag
RX99a076fc201349ba8081ddfafa3aaa10005
Transfer-Encoding
chunked
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
usync.html
eus.rubiconproject.com/ Frame 4CB4 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:58:26 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame E240 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.173.8 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-173-8.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165146
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:58:26 GMT
expires
Thu, 22 Jun 2023 17:50:52 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame B36E 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.172.245 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-172-245.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:26 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:58:28 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Unused62
8096267
Vary
Accept-Encoding
/
csync.smilewanted.com/ Frame 1A36 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e42869601ae87a83476b74dbfb615c3acde329931afc04beea4bd387f3703c7e

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6962969692c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:26 GMT
server
cloudflare
vary
Accept-Encoding
dcm
aax-eu.amazon-adsystem.com/s/ Frame BC0F
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=135&partneruserid=TAM_OK&redirurl=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fdcm%3Fpid%3Df7a5db36-1d5c-4c26-81b6-b4d0807faffb%26id%3D...
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=8231229510999469573&gdpr=0&gdpr_consent=
43 B
855 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=8231229510999469573&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
52.94.223.167 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:27 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
VC6XR1CX6K7CN1T739NP
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location
https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=8231229510999469573&gdpr=0&gdpr_consent=
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:25 GMT
cache-control
no-cache,no-store
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
p
a.audrte.com/ Frame BC0F
Redirect Chain
  • https://a.audrte.com/get?p=M501991648&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D141%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
  • https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2lcdTAwM2QxXHUwMDI2cGFydG5lcmlkXHUwMDNkMTQxXHUwMDI2cGFydG5lcnVzZXJpZFx...
  • https://a.audrte.com/a?adform_uid=5407894714181040436&r=eyJ1IjoiaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2lcdTAwM2QxXHUwMDI2cGFydG5lcmlkXHUwMDNkMTQxXHUwMDI2cGFydG5lcnVzZXJpZFx1M...
  • https://rtb-csync.smartadserver.com/redir/?partnerid=141&partneruserid=g68XsZxgD-7SfOZ6spF7ykyaA&gdpr=0&gdpr_consent=&redirurl=https%3A%2F%2Fa.audrte.com%2Fmatch%3Fuid%3DSMART_USER_ID%26p%3DM501991...
  • https://a.audrte.com/match?uid=8231229510999469573&p=M501991648&r=https%3A%2F%2Fa.audrte.com%2Fp%3F&gdpr=0&gdpr_consent=
  • https://a.audrte.com/p?
68 B
424 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.audrte.com/p?
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
3.221.8.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-221-8-21.compute-1.amazonaws.com
Software
nginx/1.18.0 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:28 GMT
Server
nginx/1.18.0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
68

Redirect headers

Date
Tue, 20 Jun 2023 19:58:28 GMT
Server
nginx/1.18.0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Access-Control-Allow-Origin
*
Location
https://a.audrte.com/p?
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
/
rtb-csync.smartadserver.com/redir/ Frame BC0F
Redirect Chain
  • https://cms.quantserve.com/pixel/p-EtBqU4Lj3YbAv.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=F5iYHxGYxRQMyMQeEZqMGkPIxR8MzsQVGJ07SUos
43 B
569 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=F5iYHxGYxRQMyMQeEZqMGkPIxR8MzsQVGJ07SUos
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=F5iYHxGYxRQMyMQeEZqMGkPIxR8MzsQVGJ07SUos
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
cache-control
private, no-cache, no-store, proxy-revalidate
strict-transport-security
max-age=86400
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
/
rtb-csync.smartadserver.com/redir/ Frame BC0F
Redirect Chain
  • https://eu-u.openx.net/w/1.0/cm?id=a547219b-814b-4e3e-8a4f-35c044fa1891&ph=ec81d0b7-c42e-4a42-b97a-9305af647d30&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D100%2...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=5365c23c-c653-4b2f-916e-16ca119a86ed
43 B
566 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=5365c23c-c653-4b2f-916e-16ca119a86ed
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:27 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

date
Tue, 20 Jun 2023 19:58:26 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=5365c23c-c653-4b2f-916e-16ca119a86ed
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
genericusersync.ashx
sync.tidaltv.com/ Frame BC0F 		0
67 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.tidaltv.com/genericusersync.ashx?dpid=3157&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:1c96:4102:4bd7:5264:40b8:b37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
awselb/2.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:26 GMT
server
awselb/2.0
content-length
0
content-type
text/plain; charset=utf-8
vevent
nym1-ib.adnxs.com/ Frame ED8E 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKhCvBMIQUAAAMA1gAFAQjficikBhCVqLHLwomsi3oY3dfcnJHTofg2KjYJ2Ey-2ebGlD8RiMfMpbtijz8ZAAAAgML18D8hiMfMpbtijz8p10wJJPCaMQAAACCF67E_MO7fwQ04mFBA6j9IAlCkpMjPAVi5q5cBYABopq60AXjf1wOAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCU3VmKCdhJywgNzc1OTExOCwgMCk7dWYoJ2knLCA4MzI2ODg2LCAwKTt1ZignZycsIDIxMTcyNjg2LCANKfCfcicsIDQzNTI5NDc1NiwgMCk7kgKFBCFsMldqZUFqMXFlY2FFS1NreU04QkdBQWd1YXVYQVRBQU9BQkFBRWpxUDFEdTM4RU5XQUJnalFSb0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRR29BUUd3QVFDNUFXSUFMeEZGeHBRX3dRRmlBQzhSUmNhVVA4a0JBQUFBQUFBQThEX1pBUUFBQQEPdFBBXzRBSG1uZndEOVFITnpNdzltQUlBb0FJQnRRSQEiBEF2DQjwWHdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQnVnTUpUbGxOTWpvMU1UWTA0QVBwUTRBRTZLUHZDb2dFLWFQdkNwQUVBWmdFQWFBRUZNRUVBBWYBAQhESkIBBw0BGDJBUUE4UVENDmBBQUFJZ0ZyQ2lwQmRPa0ZIUjdTZTBfc1FVARoJARhNRUZtcG1aAQIQdVRfSkIBOxxJRFY5OGtfMC4oAAhOa0YJMQBBIQywZ0JlMFA4QVhPbzR3Sy1BV095dGtEZ2dZRFZWTkVpQVlBa0FZQm1BWUFvUWFhAVw4bVptNVA2Z0dCTElHSkFrEUsMQUFCRR0MAGsZDABDHRhETGdHQ2cuLpoCmQEhSVJaamdBOgkCNExtcmx3RWdBQ2dBTVpxAW1gWm1ia19PZ2xPV1UweU9qVXhOalJBNlVOShFiDDhEOVIRDAxBQUJaHQwAaB0MAHAdDAB4HQwMNEFJazV49A4BOEQ4LtgCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL4ADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTg3qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDjgxNzAjTllNMjo1MTY02gQCCAHgBAHwBKSkyM8BiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFhQL6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AG6CnaBhYKEAkRGQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBugcIKgQxLS0tQAHIB9_XA9IHDQkRMwExDNoHBggFCWjgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=efbe8ab91cf2e4c8d8cd22cb7084cb99632b21b0&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=7469063901422388822&vd=ct~0|rr~5&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:26 GMT
AN-X-Request-Uuid
df19cb71-d7a1-45e5-8ea0-69469b474f1b
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j100&a=1727863478&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ul=en-us&de=UTF-8&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=MeterStart&el=%7B%22ConversationName%22%3A%22Not%20Set%22%2C%22MeterLevel%22%3A%22Metered%22%2C%22ConversationDateStarted%22%3A%22Not%20Set%22%2C%22ConversationDateEnded%22%3A%22Not%20Set%22%2C%22ConversationDateExpiratation%22%3A%22Not%20Set%22%2C%22ConversationPaywallLimit%22%3A%22Not%20Set%22%2C%22ArticleViews%22%3A%22Not%20Set%22%7D&_u=aGDACEAjBAAAACgFKAC~&jid=&gjid=&cid=1182837468.1687291098&tid=UA-61435456-5&_gid=2078750920.1687291098&gtm=45He36e0n81NFD2QGD&cd3=mercurynews.com&cd121=Not%20Set&cd95=Not%20Set&cd96=Not%20Set&cd97=Not%20Set&cd98=Not%20Set&cd100=1687291106869.rlxaigaw&cd101=23c7b2911e37a18862bb7d8d9656a1d8&cd102=Not%20Set&cd103=Not%20Set&cd104=Not%20Set&cd105=Unknown&cd106=Metered&cd107=Not%20Set&cd108=Not%20Set&cd109=Not%20Set&cd110=Not%20Set&cd111=Not%20Set&cd112=Not%20Set&cd113=Not%20Set&cd114=Not%20Set&cd115=Not%20Set&cd116=article&cd117=Not%20Set&cd119=Not%20Set&cd120=Default&cd122=1.0.0.2&cd123=Not%20Set&z=64160634
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 19 Jun 2023 21:07:47 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
82239
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
css
fonts.googleapis.com/ 		8 KB
745 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,600,300&G2I_ActionId=120521&returnUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%3FclearUserState%3Dtrue
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
124f165a1243b48bd2ac21cebd8852c818c5deb7692fbfb5c80f5d5b72625da9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:58:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:18:36 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 20 Jun 2023 19:58:26 GMT
truncated
/ 		2 KB
2 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cd0b7385c8a691d9b2e7af11f3fbe1e7b1f42ecf11531882594908bf4a1b830e

Request headers

Referer
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
application/x-font-woff2;charset=utf-8
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j100&a=1727863478&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ul=en-us&de=UTF-8&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=ActionShown&el=%7B%22ConversationName%22%3A%22BANG%20Klay%20Production%20Conv%22%2C%22MeterLevel%22%3A%22Metered%22%2C%22ActionName%22%3A%22a-toaster-sub-pv1-mg2pw05-flash%22%2C%22ActionType%22%3A%22Banner%22%7D&_u=aGDACEAjBAAAACgFKAC~&jid=&gjid=&cid=1182837468.1687291098&tid=UA-61435456-5&_gid=2078750920.1687291098&gtm=45He36e0n81NFD2QGD&cd3=mercurynews.com&cd121=Not%20Set&cd95=Not%20Set&cd96=Not%20Set&cd97=Not%20Set&cd98=Not%20Set&cd100=1687291106976.xgeg4r1&cd101=23c7b2911e37a18862bb7d8d9656a1d8&cd102=Not%20Set&cd103=Not%20Set&cd104=Not%20Set&cd105=Unknown&cd106=Metered&cd107=BANG%20Klay%20Production%20Conv&cd108=1&cd109=1&cd110=2&cd111=2023-06-20T19%3A58%3A26Z&cd112=Not%20Set&cd113=2023-08-19T19%3A58%3A26Z&cd114=a-toaster-sub-pv1-mg2pw05-flash&cd115=Banner&cd116=article&cd117=Not%20Set&cd119=Not%20Set&cd120=Default&cd122=1.0.0.2&cd123=Not%20Set&z=918497036
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 19 Jun 2023 21:07:47 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
82240
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=pv&page=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&metered=1%7C2&metername=BANG%20Klay%20Production%20Conv&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=b08272d9-051e-47f3-9cde-47e44ff0f5bb&pid=96430c62-9e9b-4e9e-9c51-bae8ae4a6a48&dtm=1687291107007&qnm=_matherq&visible=1&tabid=a2cbfdc5-fc55-4203-bb3e-307d8f7af5bb&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&vp=1600x1200&ds=4000x8886&tofa=1687291098&vid=1&lvidt=1687291098&duid=db7bf053-61e0-4111-899e-812311da85ef&fp=967226427&cid=ma23578&mrk=239876506&cx=eyJhY3Rpb24iOnsiY2F0ZWdvcnkiOiJkaXNwbGF5IiwiYWN0aW9uIjoiYmFubmVyIiwiZGF0YSI6eyJtZXRlciI6eyJpZCI6IjIiLCJuYW1lIjoiTWV0ZXJlZCIsIm1ldGhvZCI6IkRlZmF1bHQifSwiY2FtcGFpZ24iOnsiaWQiOiIxMDE0MTgiLCJuYW1lIjoiQkFORyB3b3JkIHByZXNzIHcvYWRibG9jayJ9LCJjb252ZXJzYXRpb24iOnsibmFtZSI6IkJBTkcgS2xheSBQcm9kdWN0aW9uIENvbnYiLCJvcmRlciI6IjIifSwiYWN0aW9uIjp7Im5hbWUiOiJhLXRvYXN0ZXItc3ViLXB2MS1tZzJwdzA1LWZsYXNoIiwidHlwZUlkIjoiMSIsInR5cGVOYW1lIjoiYmFubmVyIiwib3JkZXIiOiIyIn19LCJ2ZW5kb3IiOiJtZzIiLCJ0eXBlIjoidW5rbm93biJ9LCJpZGVudGl0aWVzIjpbeyJ0eXBlIjoiZ2EiLCJpZCI6IjExODI4Mzc0NjgiLCJyZWZUaW1lIjoiMTY4NzI5MTEwNzAwNiJ9LHsidHlwZSI6Im1nMiIsImlkIjoiMjNjN2IyOTExZTM3YTE4ODYyYmI3ZDhkOTY1NmExZDgiLCJyZWZUaW1lIjoiMTY4NzI5MTEwNjk5MiJ9XSwiYXVkaWVuY2UiOlt7InByb3ZpZGVyIjoidXNlckRCIiwic2VnbWVudHMiOlsiTUFUSEVSX1U5X0lOU1RBTlRCXzIwMjAwMjAzIl0sInBhZ2VJZCI6Ijk2NDMwYzYyLTllOWItNGU5ZS05YzUxLWJhZThhZTRhNmE0OCJ9LHsicHJvdmlkZXIiOiJpU2VncyIsInNlZ21lbnRzIjpbIk1BVEhFUl9VOV9JTlNUQU5UQl8yMDIwMDIwMyJdLCJwYWdlSWQiOiI5NjQzMGM2Mi05ZTliLTRlOWUtOWM1MS1iYWU4YWU0YTZhNDgifV0sIm1nMkRhdGEiOnsidmVyc2lvbiI6IlZlcnNpb246IDIuOC41IiwiZW52aXJvbm1lbnQiOiJwcm9kIiwiYXV0aFN5c3RlbSI6IkF1dGgwVW5pdmVyc2FsTG9naW4iLCJjYW1wYWlnbk5hbWUiOiJCQU5HIHdvcmQgcHJlc3Mgdy9hZGJsb2NrIiwiY2FtcGFpZ25JZCI6IjEwMTQxOCIsInN1YnNjcmlwdGlvbnMiOltdLCJjb252ZXJzYXRpb24iOnsiSWQiOiIxMDQwMDAiLCJDb2RlIjoiMTA0MDAwIiwiTmFtZSI6IkJBTkcgS2xheSBQcm9kdWN0aW9uIENvbnYiLCJPcmRlciI6IjIiLCJQcm9wZXJ0aWVzIjp7IlBheXdhbGxMaW1pdCI6IjIiLCJWaWV3cyI6IjEiLCJEYXRlIjp7IkV4cGlyYXRpb24iOiIyMDIzLTA4LTE5VDE5OjU4OjI2LjUyN1oiLCJTdGFydGVkIjoiMjAyMy0wNi0yMFQxOTo1ODoyNi41MjdaIn0sIkFydGljbGVMZWZ0IjoiMSIsIlZpZXdUeXBlIjoiQ29udmVyc2F0aW9uIiwiUGF5d2FsbEluZm8iOnsiQXJ0aWNsZUxlZnQiOnsiQ29udmVyc2F0aW9uIjoiMSIsIk1ldGVyIjoidW5saW1pdGVkIn0sIkxpbWl0Ijp7IkNvbnZlcnNhdGlvbiI6IjIiLCJNZXRlciI6InVubGltaXRlZCJ9LCJNaW5WaWV3IjoiQ29udmVyc2F0aW9uIn19fX0sInVzZXJEYXRhIjp7Im1nMkRhdGEiOnsiT3duZWRTdWJzY3JpcHRpb25zIjpbXSwiQXV0aFN5c3RlbSI6IkF1dGgwVW5pdmVyc2FsTG9naW4iLCJEaWdpdGFsQWNjZXNzIjp7IkFjY2Vzc0xldmVsIjp7fSwiU3Vic2NyaXB0aW9uIjpbXX0sIklnbVJlZ0lEIjpudWxsLCJFbWFpbCI6IiIsIk56d0xpZCI6bnVsbCwiTWFzdGVySWQiOm51bGwsIkRpc3BsYXlOYW1lIjoiIiwiRW1haWxQcmVmZXJlbmNlcyI6bnVsbCwiQWRkRGF0ZSI6bnVsbH19fQ
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.162.81.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-162-81-74.compute-1.amazonaws.com
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date
Tue, 20 Jun 2023 19:58:27 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j100&a=1727863478&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ul=en-us&de=UTF-8&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=SetTimer&_u=aGDACEAjBAAAACgFKAC~&jid=&gjid=&cid=1182837468.1687291098&tid=UA-61435456-5&_gid=2078750920.1687291098&gtm=45He36e0n81NFD2QGD&cd3=mercurynews.com&cd121=Not%20Set&cd95=11680&cd96=7917&cd97=Not%20Set&cd98=Not%20Set&cd100=1687291107050.dc6r04sp&cd101=23c7b2911e37a18862bb7d8d9656a1d8&cd102=Not%20Set&cd103=Not%20Set&cd104=Not%20Set&cd105=Unknown&cd106=Metered&cd107=BANG%20Klay%20Production%20Conv&cd108=1&cd109=1&cd110=2&cd111=2023-06-20T19%3A58%3A26Z&cd112=Not%20Set&cd113=2023-08-19T19%3A58%3A26Z&cd114=Timer&cd115=Banner&cd116=article&cd117=Not%20Set&cd119=Not%20Set&cd120=Default&cd122=1.0.0.2&cd123=Not%20Set&z=2078098271
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 19 Jun 2023 21:07:47 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
82240
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j100&a=1727863478&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ul=en-us&de=UTF-8&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=PageView&el=%7B%22Page%22%3A%22Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify%22%2C%22ContentType%22%3A%22Not%20Set%22%2C%22MeterLevel%22%3A%22Metered%22%7D&_u=aGDACEAjBAAAACgFKAC~&jid=&gjid=&cid=1182837468.1687291098&tid=UA-61435456-5&_gid=2078750920.1687291098&gtm=45He36e0n81NFD2QGD&cd3=mercurynews.com&cd121=Not%20Set&cd95=11680&cd96=7917&cd97=Not%20Set&cd98=Not%20Set&cd100=1687291107057.e2y2r7e8&cd101=23c7b2911e37a18862bb7d8d9656a1d8&cd102=Not%20Set&cd103=Not%20Set&cd104=Not%20Set&cd105=Unknown&cd106=Metered&cd107=BANG%20Klay%20Production%20Conv&cd108=1&cd109=1&cd110=2&cd111=2023-06-20T19%3A58%3A26Z&cd112=Not%20Set&cd113=2023-08-19T19%3A58%3A26Z&cd114=Timer&cd115=Banner&cd116=article&cd117=Not%20Set&cd119=Not%20Set&cd120=Default&cd122=1.0.0.2&cd123=Not%20Set&z=985307386
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 19 Jun 2023 21:07:47 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
82240
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
/
csync.smilewanted.com/ Frame EA34 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e42869601ae87a83476b74dbfb615c3acde329931afc04beea4bd387f3703c7e

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6962bcc8b2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:27 GMT
server
cloudflare
vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame F392 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.173.8 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-173-8.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165145
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:58:27 GMT
expires
Thu, 22 Jun 2023 17:50:52 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame D1EF 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.172.245 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-172-245.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:27 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:58:29 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Unused62
8096267
Vary
Accept-Encoding
usync.html
eus.rubiconproject.com/ Frame CF4A 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:58:27 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
/
rtb-csync.smartadserver.com/redir/ Frame 2938
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/gjIEMT18?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D94%26partneruserid%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=ZJIE3AABR7XTlQAz&gdpr=0&gdpr_consent=
43 B
599 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=ZJIE3AABR7XTlQAz&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

x-served-by
cache-yyz4557-YYZ
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:27 GMT
via
1.1 varnish
server
Varnish
x-timer
S1687291107.152522,VS0,VE0
x-cache
HIT
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=ZJIE3AABR7XTlQAz&gdpr=0&gdpr_consent=
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
/
rtb-csync.smartadserver.com/redir/ Frame 2938
Redirect Chain
  • https://secure.adnxs.com/getuid?https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D86%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=3958812064475458525&gdpr=0&gdpr_consent=
43 B
643 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=3958812064475458525&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:27 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Date
Tue, 20 Jun 2023 19:58:27 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
8c6e90c3-104a-4abc-8f6e-964231524a16
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=3958812064475458525&gdpr=0&gdpr_consent=
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
rtb-csync.smartadserver.com/redir/ Frame 2938
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=30&p=273&cp=smartortb&cu=1&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D79%26partneruserid%3D%40%40CRITEO_USERID%40%4...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=33ce34a0-aa4b-4208-9ad8-c7db1317a38f&gdpr=0&gdpr_consent=
43 B
619 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=33ce34a0-aa4b-4208-9ad8-c7db1317a38f&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
x-errorlevel
0
strict-transport-security
max-age=31536000; preload;
server
Kestrel
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=33ce34a0-aa4b-4208-9ad8-c7db1317a38f&gdpr=0&gdpr_consent=
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
1098824
content-length
0
expires
Tue, 20 Jun 2023 00:00:00 GMT
redir
rtb-csync.smartadserver.com/ Frame 2938
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEJeE7JJAoAACD7r3WP1g&gdpr=0
43 B
579 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEJeE7JJAoAACD7r3WP1g&gdpr=0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEJeE7JJAoAACD7r3WP1g&gdpr=0
Date
Tue, 20 Jun 2023 19:58:27 GMT
strict-transport-security
max-age=2592000; includeSubDomains
Server
gunicorn
Connection
keep-alive
Content-Length
0
/
rtb-csync.smartadserver.com/redir/ Frame 2938
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=39&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D25%26partneruserid%3D%5BMM_UUID%5D&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=25&partneruserid=cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
43 B
619 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=25&partneruserid=cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:27 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Date
Tue, 20 Jun 2023 19:58:27 GMT
Server
MT3 1031 59fd23a master iad iad-pixel-x12 config_version:"1969"
Content-Type
image/gif
Access-Control-Allow-Origin
*
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=25&partneruserid=cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 20 Jun 2023 19:58:26 GMT
usync.html
eus.rubiconproject.com/ Frame 16D7 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:58:27 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame 5AD2 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.172.245 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-172-245.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:27 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:58:29 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Unused62
8096267
Vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 44A5 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.77.173.8 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-77-173-8.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165145
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:58:27 GMT
expires
Thu, 22 Jun 2023 17:50:52 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
/
csync.smilewanted.com/ Frame 6AC7 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e42869601ae87a83476b74dbfb615c3acde329931afc04beea4bd387f3703c7e

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6962bfcdb2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:27 GMT
server
cloudflare
vary
Accept-Encoding
/
rtb-csync.smartadserver.com/redir/ Frame 3348
Redirect Chain
  • https://eu-u.openx.net/w/1.0/cm?id=a547219b-814b-4e3e-8a4f-35c044fa1891&ph=ec81d0b7-c42e-4a42-b97a-9305af647d30&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D100%2...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=5365c23c-c653-4b2f-916e-16ca119a86ed
43 B
620 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=5365c23c-c653-4b2f-916e-16ca119a86ed
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:26 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

date
Tue, 20 Jun 2023 19:58:27 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=5365c23c-c653-4b2f-916e-16ca119a86ed
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
/
rtb-csync.smartadserver.com/redir/ Frame 3348
Redirect Chain
  • https://sync.adotmob.com/cookie/smart?r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D66%26partneruserid%3D%7Bamob_user_id%7D&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=66&partneruserid=093922040744add39d31a086&gdpr=0&gdpr_consent=
43 B
671 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=66&partneruserid=093922040744add39d31a086&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:27 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=66&partneruserid=093922040744add39d31a086&gdpr=0&gdpr_consent=
Date
Tue, 20 Jun 2023 19:58:27 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Powered-By
Express
Content-Length
0
Vary
Origin
v1
match.sharethrough.com/sync/ Frame 3348
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=139&partneruserid=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D98KUz37ype9D3X2sf9ovgeTt%26source_user_id%3DS...
  • https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=8231229510999469573&gdpr=0&gdpr_consent=
68 B
607 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=8231229510999469573&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
3.217.98.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-217-98-147.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:29 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

location
https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=8231229510999469573&gdpr=0&gdpr_consent=
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:28 GMT
cache-control
no-cache,no-store
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
/
rtb-csync.smartadserver.com/redir/ Frame 3348
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=76&partneruserid=GOOGLE_HOSTED_SI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc...
  • https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_sc&google_hm=ODIzMTIyOTUxMDk5OTQ2OTU3Mw==&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEGQ_6d8VPjWWfZOkdsHEBow&gdpr=0&gdpr_consent=&google_cver=1
43 B
682 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEGQ_6d8VPjWWfZOkdsHEBow&gdpr=0&gdpr_consent=&google_cver=1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:58:27 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:27 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEGQ_6d8VPjWWfZOkdsHEBow&gdpr=0&gdpr_consent=&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
345
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
711890.gif
id.rlcdn.com/ Frame 3348 		42 B
310 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/711890.gif?credir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D136%26partneruserid%3D&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:27 GMT
via
1.1 google
content-type
image/gif
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
usync.js
eus.rubiconproject.com/ Frame 3285 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:27 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 08:41:09 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=45778
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 08:41:25 GMT
get
choices.trustarc.com/ Frame 7668 		287 B
629 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=747924248&js=pmw2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Mon, 19 Jun 2023 00:08:52 GMT
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P2
age
157775
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
287
x-amz-cf-id
nIm4eK2dFyuzWbMxkXgOrOU3xgqf9ZWFHGvxEkn0rqWG3AKNhxCd5A==
expires
Wed, 19 Jul 2023 00:08:52 GMT
get
choices.trustarc.com/ Frame 7668 		739 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-full-tr.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Sun, 18 Jun 2023 12:17:59 GMT
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P2
age
200428
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
739
x-amz-cf-id
Ed4n4xEVJSqPE54JmjXiw1VvF-LYsYvrAXh1HQDuet-G77lyTAYWCQ==
expires
Tue, 18 Jul 2023 12:17:59 GMT
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame 3541 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:27 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1153072
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da6962c2d162c07-ORD
expires
Thu, 31 Dec 2037 23:55:55 GMT
vevent
nym1-ib.adnxs.com/ Frame 5269 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLyDfBM8gYAAAMA1gAFAQjficikBhDBmpD5n5mRiG0Y3dfcnJHTofg2KjYJQoLix5i7dj8RnoMEGNhbcT8ZAAAAgML18D8hnoMEGNhbcT8pQYIJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXi4_gWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW8LCSAvkFIU81LUVkUWpnaC1JYUVMeVcxODBCR0FBZ3VhdVhBVEFCT0FCQUFFajFaRkR1MzhFTldBQmdqUVJvQUhBQWVBQ0FBUUNJQVFDUUFRR1lBUUdnQVFLb0FRS3dBUUM1QWZhLVNUakRESDRfd1FIaGRkNzB3c0IyUDhrQkFBQUFBTUpUN2pfWkFUWTh2VktXSWZVXzRBSDBxdm9EOVFHaThmOC1tQUlBb0FJQ3RRSUEBMwh2UUkBB9hBd0FJQXlBSUEwQUlBMkFJQTRBSUE2QUlBLUFJQWdBTUJtQU1Cb2dNT0NOU2JoeXNRQWhnQ0xRATvwVUNpQXhjSXNvbkFMQkFHR0FFdGl1aTVOeklIWkdWbVlYVnNkS0lERmdqdXVzQXNFQW9ZQVMwUW5uSV9NZ1oxYm1seGRXV2lBdzRJMUp1SEt4QUxHQUl0AVpkQUxvRENVNVpUVEk2TmpJMk11QUQ2VVBwQXcFHgUBQDhBUGZFNEFFbTRubkNvZ0VuAQi4cEFFQVpnRUJMSUVDZ2prd3BrTkVLNnp0QTI2QkJvSW5na1JLVnlQd3ZVb3pEOFoFSQkBIGc1TUtaRGNFRRkgCF9KQgkcBQEYMkFRRDhRUQUMBQHwUklJRkh3aWh5eVVRQlJnQklnTkRRVVFwTmp5OVVwWWg5VDh4UW1EbDBDTGJ5VC1JQmZZd2tBWEM5azZZQlpmYTRvY0JxUVhUcEJSMGUwbnRQN0VGBVgFAQhEQkIdazx5UVVBQUFDQW1jSFNQOUVGBSMFAQREWhUouFBBXzRBV3JCUEFGMXBpSEN2Z0ZyUDNRQW9JR0EwTkJSSWdHQkpBR0FaZ0dBS0VHBT8FASRDb0JnU3lCaVFKBQ8JAQBSCQcFAQBaBQYJAQBoCQcBAUBDNEJnby6aAsUBIUlDUG5fdzr9AixMbXJsd0VnQUNnQU0dzUxPZ2xPV1UweU9qWXlOakpBNlVOSjk1ADkdeQBCHXkEQmg5mQQ5cAF_CQEEQngJCAEBFEI0QUlJQqqVAQRKQRGY9JsBUEFf2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20vgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xODeoBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQPMTI5MTcjTllNMjo2MjYy2gQCCAHgBAHwBLyW180BiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFqOBG-gUECAAQAJAGAJgGAKIGDzEwMjY0I05ZTTI6NjQzNrgGAMEGAAAAAAAA8D_QBp6rAtoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgHyBocBCML2ThKAAUdCUXlVbG9BQUFBREFBa0NCUUVJMFBMM0J4Qy0xYm9DR095RWx3TWdCeWdBUUxDMHVnZEl2N1c2QjFEcFExaWtNbkVBQUFBQUFBQUFBSGdBZ1FFQUFBQSHbXEFBSWdCQUpBQkFKb0JBZ2dBcUFFQXNRRQkcBQF4Li6ABwGIBwCgBwG6BwgqBDEtLS1AAcgHuP4F0gcNCS63AIzaBwYIABAAGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=3de7662d0d9a5d7d1ca499caa713d1296eec2f66&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=7469063901422388822&vd=ct~0|rr~5&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:27 GMT
AN-X-Request-Uuid
d3597f76-fe29-4b9b-91c7-85218e5878a0
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame ACDA 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202306140101&jk=2482955454090949&bg=!WFulWw_NAAaGYqkwpmI7ADkAdvg8Wu7v-hZR37m4GPUVdaCMllx6JSHrQo97cQxoy3HnKDH56vc61LBfZ0v_Uy8-hFTyCtZTG6UCAAAF3lIAAAADaAEHmQMvtkrytzc7-basopcXwIrqz6OtljoPXTSG1-vtE1hZ6_mPfRB5BDmUqMwpBDpCi53MS722rtRUlg46EDBMjM60AGyjqP0b1mbf2rsp7E6TahoIS_eidq8BNyQayAT1IkAu7E2iFxMa3XR-5pxXVsVnwRqNslu6ZE5X2xo9i9nuk7Mn62LvXGoQjHLHlvCrfJAiaOU91iNb8zMOeFMtQ_UuLxG6BCJdDDsgy4LWvlP8ICKstcYjmHJZIhYXj0NU865IGtqP0gvQL0XQjFoJJYnaOW_50CXxzm-qoRAAcIUi_79iCcYfXtiJ4bSBXDtM4JNqh0TbhRsKJkdAmO0uaObxMLkupzGlI5F_65cNq-QOX8VPJGPyGRNA_SN8InQrC_LNP361_COUaPMGTYDKDQeMPkPSQMtLy_zsHSM8Gsuo0fpMImjot3ynZAlLgRkskZNEzOuagu0oO3gz7rWMfnJfujtQwLHD9P4Ef--VMn7p6RhWuNHF1-HoC6TXGWTEux5_XtMf8bwPo3vd-J7zwkoXNqiKn1UReVoddFMWlS8turxk0x9CsqrctgLEF6sJXOjPyqUEuL8qJSccTr7lIGWTDfh1EP7myQlV-ODJW85OSz13LWplwdiaKC1MJ_Xn-0sAuCqLPvx0kvoS__6loNpgqfy50j14exWvHxVjVU9jmHajX0GCZdoAixhKS-MUU7CfzeAMaaLtI-e_CuL24BmqadKx079cljWDMNvTS9Uxb8vw3cS8AWzQvU7j0ZFBNELMoVKLxWJd0SjXNlaANU7dPMFgkNCr7HHiDwNzrlfgBppve6Dz9-wxaRGURpR7yX3dct00j-c3MbQhSixDA4qBUfef1sj5kWoRXmLgJRAZ6xVBtgNht58WBchE5U0KzqvtcGct7xoJol0SCJ4RM47CKw-TfZsX_w8yBg-SKirMMTV5cundns5ZkcsZ3j-2LU8wbxe16ta2dp7NFHtUkPBE15tDXfezxV5vJhHUrke5zre6ombCyylWeQCVUPUoxoR5gx9-1Fjmapx1UsqGFmq1O_cFjG6ekezwYxPYzOJM9s_viG2ozX_ovHFQ0aCbDG0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
usync.js
eus.rubiconproject.com/ Frame D898 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:27 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 08:41:09 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=45778
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 08:41:25 GMT
usync.js
eus.rubiconproject.com/ Frame 5A1E 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:27 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 08:41:09 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=45778
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 08:41:25 GMT
usync.js
eus.rubiconproject.com/ Frame 4CB4 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:27 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 08:41:09 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=45778
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 08:41:25 GMT
get
choices.trustarc.com/ Frame 3876 		287 B
629 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=29664373&js=st_2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Mon, 19 Jun 2023 00:08:52 GMT
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P2
age
157775
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
287
x-amz-cf-id
Ihck-UWPYxdpB_mhEQsJ-G6qbZ4WPorxQmqAg9Lw-SY0MKqDLsKXMQ==
expires
Wed, 19 Jul 2023 00:08:52 GMT
get
choices.trustarc.com/ Frame 3876 		739 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-full-tr.png
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=29664373&js=st_2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Sun, 18 Jun 2023 12:17:59 GMT
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P2
age
200428
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
739
x-amz-cf-id
CEM6pzrMqEKhbRnpuuXQlBdW4GjzWTsGw94rjUyIOo7ONctt5XxxyQ==
expires
Tue, 18 Jul 2023 12:17:59 GMT
4a811c95-f27d-4268-a9b1-c0deb846c0fd
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/4a811c95-f27d-4268-a9b1-c0deb846c0fd
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
usync.js
eus.rubiconproject.com/ Frame CF4A 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:27 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 08:41:09 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=45778
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 08:41:25 GMT
usync.js
eus.rubiconproject.com/ Frame 16D7 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.28.206.17 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-206-17.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:27 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 08:41:09 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=45778
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 08:41:25 GMT
SPug
simage4.pubmatic.com/AdServer/ Frame 9629 		0
128 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:26 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame 0D45 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:27 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1153072
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da69630ad1b2c07-ORD
expires
Thu, 31 Dec 2037 23:55:55 GMT
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame 1A36 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:27 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1153072
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da69630ad212c07-ORD
expires
Thu, 31 Dec 2037 23:55:55 GMT
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame 02AD 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:27 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1153072
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da69630ad222c07-ORD
expires
Thu, 31 Dec 2037 23:55:55 GMT
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame 8D17 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:27 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1153072
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da69630bd252c07-ORD
expires
Thu, 31 Dec 2037 23:55:55 GMT
async_usersync
ib.adnxs.com/ Frame 7337 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:28 GMT
AN-X-Request-Uuid
cf6efc41-ab85-41a1-b27b-92dd6676833b
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
get
choices.trustarc.com/ Frame ED8E 		287 B
628 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=11181583&js=pmw2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Mon, 19 Jun 2023 00:08:52 GMT
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P2
age
157776
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
287
x-amz-cf-id
llaJVEWK8H9yRgcZWUbeM4T6uqFoSsXM8qeSsSIhUs8KV300hY6cjw==
expires
Wed, 19 Jul 2023 00:08:52 GMT
async_usersync
ib.adnxs.com/ Frame ED6C 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:28 GMT
AN-X-Request-Uuid
a96a88ee-905c-4097-961b-3b4fb7a0d01e
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
PugMaster
image6.pubmatic.com/AdServer/ Frame 205C 		4 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=84540965&p=156383&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
c65deba56ff3d2973b7770c8f88617751f286efefc1373918171d50a11606c38

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:27 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
gen_204
pagead2.googlesyndication.com/pagead/ Frame 7E77 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BBy0A3wSSZPv3LqucoPMP7bivwAUAAAAAOAHgBAI&bg=!0NOl04fNAAaGYqkwpmI7ADkAdvg8Wuv7YFgEzZT5X9GXfmaRaZsHtGZVb6EcfHSi-pRVuQsx7vTBzez8cuA0CDXkr-u_U5EgXMsCAAAHS1IAAAAEaAEHmQMGpDiFj1c6Klei0L0zaQC50DKowKurZvf4zacx1Q8KmibTp7y6gimmL-Xe2pFJ8g6eCvhfS_IiRihZ_NRVXt5pjoQJCZJktT9SaFxlHP10Rot2zf_XKFvSVyXw3fiocyuVeA7K66Yn7Ty9UoGW6eIfVbTEcq9TYK4YVjfyI8hIQPK_Z6RqoJyvHMdTskMt9xnA2VELauP9XoAhK0-kosI4ibypZxA3gpnfQFKcG_nrlRrEwnWhTd_-YGuO3irZ9FHjN7P5zVHkqJ04Dn9PwGdk8S4pqlqhvC0eqKC11vutnQMf_-g8d_hmlApcKz5O3WDods7HYODp3qdIa_l6l8N2ey0gecQrOfRs3cWgH78FvZSFqSDdJzxSJsUB-6p9IdXlHmcsYSF-3hLJucpmHO0UhAWL4gRjtccn9KSJpZ0KCe95XVHhKDr69HX0AwLKgkbYBGTrNAbpIdnQUnkBGmylrOdmMp96CoDkzurIOkg3mcbbw9Yx5nm-Q02SXuW30GbEXIhyzLwFsYHmh5C2MhD-dsUGj68d0zlvCCCdnUY6ZnP5fIGnZ1BzD-89Tsr1Y69TQSnVoO0JgRnCTQ4RTrWhPkZ9l72saNG0VpqVHMg17-iqUiquq4ej30ZtZNup-t5514tc6_Zuifes50lEgwHuG4QUGtdS-3nSDFnOGY2eKKDDCiy5sGerI64TFOU1KzBXZPIgsII9U3Mfs5G93W0uR5PH2tNzATfvCd-YHSc6IC4QIzJEIW6LRKyEbochmEt_P_0pphlxr4UZl_mILdY-YrcI5QIIfeTSL9pcaYKwSkzMY2gJ7S0VKLTrOFvkrbNKt-Fjp52m9TPXrqt7Uqb7OGYRzdNKvwP_VpA9gXKg_OCDtUBFhD35Qf_SpZA8Yn7rSF_VDhvvW0GXnVaeq2xD2R70YAdWN8kDziJXwchfOAtllxlxojSzhzEZaazKB2lawYLRrT5ptV5uQa-NlI0KiPpF6ACvrRgGIIXBoXUy4Tlnfh9iSU8zv5VKeGmRVs4gunaLjZ7O
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:28 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 3812 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:28 GMT
AN-X-Request-Uuid
12f9348a-5ebb-45aa-a085-1b7ff8fea2f4
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 586F 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BaKFl3wSSZI7_LtHMowa0276IDwAAAAA4AeAEAg&bg=!SkmlSR3NAAaGYqkwpmI7ADkAdvg8Wi3N9nHviBbx8xPApFsN9rrhayvRPNSQHltLsIgLWqHgiX8B3dFjaQRCp6JzpddSMhwWZVICAAAHd1IAAAAEaAEHmQMeaGHCJKdvHIG24ECueZBXF0W0GjNbCkaR3elEjtN6sXk8_ov_k4bOeXJhOFymFjJqFCh_a2_JGPxo5VlFrICVflklUVFXa1PAFeSqWnFciO3SpN8frHKlO91u10WFpa6JPPM07HdmOxz4dufz39iOU1wD7AuJgmFEGg2JIaWu-Kn1dR1xc5b5rlWEPFg42dHRW5Jvhl1y1nKiI3wkYLHCn1dS2ttUNwNbQjWeJi1HWsyhFJm8N3uHUCRt0Bwn1GfX6FkQ1dN27jsP2ICm3-6X_2yH1hM8AQ1s6wWQgvd5UeRXQkFHzq0ihBPzlvKCGHA7yQd40sWH47hah88aVktKUIX4DM83ous35Ns8KXVYzW_jU0S9oGo2yjGJWOhvHxU6TQc3n4QyoA-0qnKEFVJJWaJ2FF5NEv2UJVpmW1HVarc49BZD_S3txK2tsp1VIpLtJSEc-tpfCoMTmBrzXraVk8vpmaQz_6FfxCihSlbXzoqfLf43IaZNjMsbHIieXF29iOxs4J3mFta_9ILLp9HTN6CEE8mxBcj20cG7TG-ORqkGpIZot5wTH2Cg055ARFd6h8XxxjkeFPUrBR2G17Vn-A_zTEL1ctWkSIgTVgnOzYBXkKV1G86fv3brn0-cb3yLSkdlzfJQvtkWWGyE3R7UhO0mFRylTSmspYu4dhKr0hn6L15TCJsRASAUXh-NEJZUwkyq9PYSiduZWbBN8w1V2KfOL-jT_GZy1tt20UZyAngiXx7soGmtUTTgI3hc4xu1ZP9ny-HksvA9J1eGbeJ_bwKQ_8_tpLwAfFyLqA9yMd3VPDsy6YEyQqn9EmzIuQuWuykpNcFeGP2UI3_mxTMjAUw22v2NOg5ckqF4tkGUYgntvAqt_KFq2Shxb2cY9Pz1Xm7KyX0P5ABI5fOQr-QcdTOrVSnqPVv3B1laWF5RPVOCtzxWPkBW68Fu7ilEoxDF3kfg2yOKJysaAiNQX_NwmEUKkobHbHdkOr5EFZrewK2LUcml4FNd-gtA93kIuWaLjB-TF0kq9PmryWTwCCfqZuEcDfNLeh18Mb4zlOuK
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:28 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
async_usersync
ib.adnxs.com/ Frame B36E 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:28 GMT
AN-X-Request-Uuid
ec1ea185-bb1c-4fa0-a61d-f498342456ef
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame EA34 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1153073
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da69631ee9d2c07-ORD
expires
Thu, 31 Dec 2037 23:55:55 GMT
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame 6AC7 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1153073
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da69631eea02c07-ORD
expires
Thu, 31 Dec 2037 23:55:55 GMT
analytics.js
www.google-analytics.com/ 		51 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 20 Jun 2023 18:11:08 GMT
last-modified
Mon, 17 Apr 2023 22:36:01 GMT
server
Golfe2
age
6440
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20737
expires
Tue, 20 Jun 2023 20:11:08 GMT
async_usersync
ib.adnxs.com/ Frame D1EF 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:28 GMT
AN-X-Request-Uuid
de9cd513-5925-402c-a82f-90ef4f37262b
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 5AD2 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:28 GMT
AN-X-Request-Uuid
004315c2-0535-42d3-9884-45be8242afed
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 3546 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BRHn43wSSZLr3Ls7izwW_gbG4DwAAAAA4AeAEAg&bg=!ExClEETNAAaGYqkwpmI7ADkAdvg8WisoVazNfT3EruGayXOVS8qSGqUMOkJDVAAnm5ln8poaOwe2T5B8-saq95GmiVhUqBDft4wCAAAIF1IAAAAFaAEHCgBJ9sCL9KHYpVDDmSG1ipVoDtsDRIr9LCzxpcVLs4SCeEdPqaya3l2WVt9o50U2q8sTdL_e0qGcOtYc4COE9teUTrFnOU2MoiHB8pkDFsS2MMoLMmLZ-1dcxRlkG7SpWKIW_mkhbk3r0RvjRGuQT6g_1RKFVzIpKwAAMyHs4Py-UdHW1xRIoVCR3kqExo0Gqcfc5E7SOL75qlWxNgUsxa6WWsJPojZb51ZM2QsCMDdjtTFiOlxE61ev_NZ5MIUrNyiGdlaIRVAfgaIpBXkbbuPUQjZlZwdua_VXY17JRvy9K-FqC3wbx_b0loc9spPdM9PX136OLc3JiNnQAj1ayZpK2I6kM5tDiAenxHt7b04gDnjBsM-puXtu0EPWYGEUzBQgPQf-qjuwgapuvbYOA7fhYD7sNJukp3fm1s50MUU8YHLXNXAf4Huc8BqUv2RYMxFNajwmrYzdSPQcMjrcNf6uxRzbkdxshnO-ZvOvHar5onwNhGGWv2aLw5vyAJ-63c-rq34lMdj9ubJsTx6FrBg75kIt-6DSgWy67FoVDOaPEpp4sITFW5QkrUOqBjzcgkowXEVRWh5abwLT9el8cZZxWYUAsHdwP-BhKXx79sBk6pU0AOV96RHt2Ns6MCiKiIfW47MG5020JRuerIvNCzQWzpWqvvm9yu2k752lGCLmUfly4r4-OO8SHLLS2MIFHiyZb-mcxtq_ZMl62WH8Pi6O1D-0wjd5z7-KSUUR-BtHajCeVBvXPGVmybMVv1WG_L5xzzn2sYjEWys4Uy-1XqHqwkPR1ZXhFARLITv5rFKcyk1yBwehRHNUNqQqQ_fluCVqJqWfyjzeRiwiPAFUJXBVnvhK_YjFrg65sTpdY91uc9ZL_yBzvt6XUd4J8hFAyrEfcHd94BysNMWik455didsCyiILTbS-EjW0bNDFNNdHhx35gCFgTMcwa8OCDkPaiZwAEzrJDoxsF0d_oWERH81XEzCF0tfyiIO0mZIb6ZqUB_DEIBXgcEHNHTyxk9KVMj6jskgmOaV6cN_CfZXknJkBfscyPB-821bywS8wHU0ZmBpxToPY0mdmm58TxtcXlYQH4i585nk-pWB7r66-O_b-BEls6UAf5kDpm1WrG_V5DQMGXm-0Rga1KNB90F06jA8gO4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:28 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
drop_cookie_sw.php
csync.smilewanted.com/ Frame 66E1 		0
318 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696325f482c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding
gen_204
pagead2.googlesyndication.com/pagead/ Frame E91F 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BWnQ_3wSSZKrLL6PA1wX-7rG4DwAAAAA4AeAEAg&bg=!KyilKHzNAAaGYqkwpmI7ADkAdvg8WufDNEs-JQf0639-JuWbfKxurJ-ydmEGTTxnz_hyj6wIbdVfVUGs0uQfAr6e-3Lg8yCStPUCAAAIUVIAAAACaAEHmQMBm-khdCENTKPAckfIAjT2Y22yQTNQA_Gfz6nt8RrZlih85qbhiSW7zr4dMWzAqls8oyZ2AvxkibseynUHrzuT7GOaacwCeGKJaq51w6NdkBjuIKk-XKz5Z5R2E6eiQkXJLr575KwrWwDt3wIRaWttZ5ah6jR5f5Pwk1wzS1XwskVVNb469UEuKsem_WvDkxpAuWyVGYsoeSRaMAVFU5eGM8zc4GuWpcQLN-7MMcRU67U0YpsnqtlT16u7vUVvuNbdyG3MzryToEQ94G5ZmuNNl62ueSx0MQ-oMbCUT5FBMS3PVI1pXcGxFwSXKhC5yfuoF3YVydsgs5uHG7vnygT-Fm9zJsa0tq4DVdlg9P48DAAZWs7uAhHJ9LtD1bGYi8ULFPdsMpTULnKG6hpfms5UifQuyKVwYbK62O9ZBpHSn9sHFcUPLDSqI8fxpqzF_FG8-ECeiVJxu43s7_myLC-lEasqcopXuHJrPqtxkOxi65Khf5mQGQQ4Fyos7HVBNVzRO7QYnqt6E8d6eCL-izQIpnqcxCAMxuFP8m6nwXMrflKnD7SW3_VtR8M6_465wsXVMGovc3KYhKoAhi-Mk10LDHB_QnWY7qoYi9qis8rOEqaSS22wzKeydO6FfEJK-s6UM6eaYaxnf_kHYKQf1AuuzMcxevuXI0h5nA-B-Ee6DFL9SzSuCFD1VwSmLIFl4xRVItt8SHXYBBHAYHt-F9lLBlr06ToNSzpsZs6MGxOOpIQcDwnwvd_GBBK7Pl2_ThzcK1dDOLNBz-CPtckToBgT7tgzNfmUauxZt7fZc2TlhM34UjGzPx_-LLnukRU1zpEbANPVetNInNRd2j4b1MeXVFEKmBxrw5I7gpgmchW8UE5XDlhCJG6p1dNA2vpr4ODwn5jVvtcw0tZjp-njE-MC5qthr25k5_KxNEgEtZwDZHt_TUG413uLDo5RM4wKc_LotxYE8pkXM6lw2RflAZ1SlXL7g-WzfVNhXH2DWSOWLM74o93U-Ji98enr8JJ2-Od4zQ
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:28 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
get
choices.trustarc.com/ Frame D50B 		287 B
628 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=11181583&js=pmw2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Mon, 19 Jun 2023 00:08:52 GMT
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P2
age
157776
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
287
x-amz-cf-id
fpnXcpJ6BFSbssRC8krzzqtuJ5fYGJyAeAPB6_9WjXoolHJG_fWZrA==
expires
Wed, 19 Jul 2023 00:08:52 GMT
get
choices.trustarc.com/ Frame D50B 		739 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-full-tr.png
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=11181583&js=pmw2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Sun, 18 Jun 2023 12:17:59 GMT
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P2
age
200429
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
739
x-amz-cf-id
ssog5577N_AqY2VTr-2G0_3GzKmuBuYDKjkkFXLkIdwRECgX8rueWQ==
expires
Tue, 18 Jul 2023 12:17:59 GMT
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=pe&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&f_privb=0&tid=cd586743-7a8d-4f7d-b739-981389d2b75d&pid=96430c62-9e9b-4e9e-9c51-bae8ae4a6a48&dtm=1687291108212&qnm=_matherq&visible=1&tabid=a2cbfdc5-fc55-4203-bb3e-307d8f7af5bb&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&vp=1600x1200&ds=4000x8886&tofa=1687291098&vid=1&lvidt=1687291098&duid=db7bf053-61e0-4111-899e-812311da85ef&fp=967226427&cid=ma23578&mrk=239876506&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTY4NzI5MTA5NDgxMSIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiI0Mi4xbWIiLCJoZWFwVCI6IjcyLjJtYiIsImZzdFBhaW50IjoiMTEzNiIsImZldGNoUyI6IjM4IiwiZG9tYWluUyI6IjM5IiwiZG9tYWluRSI6IjM5IiwiY29ublMiOiIzOSIsImNvbm5FIjoiNzUiLCJzc2xTIjoiNTUiLCJyZXF1UyI6Ijc1IiwicmVzcFMiOiIzMDEiLCJyZXNwRSI6IjMzNyIsImRvbUxvYWQiOiIzMDYiLCJkb21JbnRlciI6IjE4NTEiLCJkb21Mb2FkUyI6IjE4OTkiLCJkb21Mb2FkRSI6IjE5NDYifX0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.162.81.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-162-81-74.compute-1.amazonaws.com
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date
Tue, 20 Jun 2023 19:58:28 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
G2VucPZH9VEpuxOrQmKrKkiA
csync.smilewanted.com/set_partner_userid_get/sovrn/ Frame 5D3B
Redirect Chain
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
0
89 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69632cfd82c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:28 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
X-Sovrn-Pod
ad_ap2dca1
Pug
image2.pubmatic.com/AdServer/ Frame D756
Redirect Chain
  • https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=neYIRJvmVU-GtlRFm-QcQcm2VUSGsFROkuPGfL6_
42 B
419 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=neYIRJvmVU-GtlRFm-QcQcm2VUSGsFROkuPGfL6_
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:58:27 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
date
Tue, 20 Jun 2023 19:58:28 GMT
expires
Fri, 04 Aug 1978 12:00:00 GMT
location
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=neYIRJvmVU-GtlRFm-QcQcm2VUSGsFROkuPGfL6_
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
pragma
no-cache
strict-transport-security
max-age=86400
Pug
simage2.pubmatic.com/AdServer/ Frame 696C
Redirect Chain
  • https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
  • https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=d2fde370-0fa4-11ee-b2e6-13cc15e39a1e
42 B
321 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=d2fde370-0fa4-11ee-b2e6-13cc15e39a1e
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:58:27 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, proxy-revalidate
content-length
0
content-type
image/gif
date
Tue, 20 Jun 2023 19:58:28 GMT
expires
Thu, 23 Sep 2004 17:42:04 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=d2fde370-0fa4-11ee-b2e6-13cc15e39a1e
p3p
CP="NOI OTC OTP OUR NOR"
pragma
no-cache
server
Cowboy
x-realserver-nx
lga-delivery-6
Pug
simage2.pubmatic.com/AdServer/ Frame 0936
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
42 B
95 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:58:28 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

cache-control
no-cache
content-length
0
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:28 GMT
expires
Tue, 20 Jun 2023 00:00:00 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma
no-cache
server
Kestrel
server-processing-duration-in-ticks
747769
strict-transport-security
max-age=31536000; preload;
x-errorlevel
0
Pug
simage2.pubmatic.com/AdServer/ Frame 8570
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=ruPoSpZIUIJ7GLwbam2kAZU4mbs&gdpr=0&gdpr_consent=
42 B
378 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=ruPoSpZIUIJ7GLwbam2kAZU4mbs&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:58:28 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Connection
keep-alive
Content-Length
188
Content-Type
text/html; charset=utf-8
Date
Tue, 20 Jun 2023 19:58:28 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=ruPoSpZIUIJ7GLwbam2kAZU4mbs&gdpr=0&gdpr_consent=
Pug
simage2.pubmatic.com/AdServer/ Frame AA4E
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:G7IN0PJx1QbHuI5&gdpr=0&gdpr_consent=
42 B
300 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:G7IN0PJx1QbHuI5&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 18:03:25 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
Fri, 01 Jan 1990 00:00:00 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:G7IN0PJx1QbHuI5&gdpr=0&gdpr_consent=
Pragma
no-cache
Server
PingMatch/v2.0.30-780-gdfb6b2e#rel-ec2-master i-0f584c9f7e23e0d61@us-east-1e@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
pbmtc.gif
beacon.lynx.cognitivlabs.com/ Frame 7085
Redirect Chain
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=085b959a-8ada-4bf5-97c1-bd2b77bb3e82&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF
42 B
499 B 		Document
General
Check archive.org
Download Go to
Full URL
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.223.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-197-223-55.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
keep-alive
Content-Length
42
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:28 GMT
Server
Kestrel

Redirect headers

cache-control
no-store, no-cache, private
date
Tue, 20 Jun 2023 19:58:27 GMT
location
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx
Pug
simage2.pubmatic.com/AdServer/ Frame 8CDC
Redirect Chain
  • https://ums.acuityplatform.com/tum?umid=6
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=792503744794
42 B
289 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=792503744794
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 18:09:03 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Access-Control-Allow-Origin
*
Content-Length
0
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=792503744794
Pug
simage2.pubmatic.com/AdServer/ Frame 6C5F
Redirect Chain
  • https://ad.mrtnsvr.com/sync/pubmatic?gdpr=0&gdpr_consent=
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw%26piggybackCookie%3D%23PM_USER_ID%26gdpr...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
42 B
513 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 18:08:40 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

content-length
0
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:27 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
i.match
s.tribalfusion.com/z/ Frame 259F
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
  • https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...
43 B
410 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache private
cf-cache-status
DYNAMIC
cf-ray
7da696340fdfecf2-YUL
content-length
43
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:58:28 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
x-function
302

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache private
cf-cache-status
DYNAMIC
cf-ray
7da696333ec0ecf2-YUL
content-type
text/html
date
Tue, 20 Jun 2023 19:58:28 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
x-function
206
x-reuse-index
198
Pug
simage2.pubmatic.com/AdServer/ Frame D88F
Redirect Chain
  • https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
  • https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F1508%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=115762805
  • https://sync.1rx.io/usersync3/mediamathtest/1508/cb896492-04dd-4900-a8be-bcb5698eda5a?zcc=0&sspret=1
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
42 B
253 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:58:28 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:28 GMT
ETag
RX99a076fc201349ba8081ddfafa3aaa10005
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Transfer-Encoding
chunked
Pug
simage2.pubmatic.com/AdServer/ Frame 6D55
Redirect Chain
  • https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}
  • https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
0
93 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:58:28 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:58:28 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
server
_
Pug
image2.pubmatic.com/AdServer/ Frame 40B6
Redirect Chain
  • https://gocm.c.appier.net/pubmatic
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=tAdeHa1cC-S_ZuUT5ASSZA
42 B
278 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=tAdeHa1cC-S_ZuUT5ASSZA
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:58:29 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

accept-ch
Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
cache-control
no-store
content-length
153
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:58:28 GMT
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=tAdeHa1cC-S_ZuUT5ASSZA
p3p
CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
nginx
cm
ipac.ctnsnet.com/int/ Frame FE86 		43 B
369 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.193.173 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
173.193.186.35.bc.googleusercontent.com
Software
Apache-Coyote/1.1 /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
43
content-type
image/gif
date
Tue, 20 Jun 2023 19:58:28 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
CP="NOI DSP COR NID CUR OUR NOR"
pragma
no-cache
server
Apache-Coyote/1.1
via
1.1 google
Pug
image2.pubmatic.com/AdServer/ Frame D235
Redirect Chain
  • https://mweb.ck.inmobi.com/sync/15?redirect=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA%3D%3D%26piggybackCookie%3D%24DSP_CKID
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=e7dec152-414a-4f0d-b405-72cafd61690d
1 B
72 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=e7dec152-414a-4f0d-b405-72cafd61690d
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
1
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:58:27 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:58:28 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=e7dec152-414a-4f0d-b405-72cafd61690d
strict-transport-security
max-age=15724800; includeSubDomains
pub
matching.truffle.bid/sync/ Frame 0586 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://matching.truffle.bid/sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
157.90.40.26 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.26.40.90.157.clients.your-server.de
Software
nginx/1.23.1 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
keep-alive
Date
Tue, 20 Jun 2023 19:58:28 GMT
Server
nginx/1.23.1
Strict-Transport-Security
max-age=15768000
cookiesync
core.iprom.net/ Frame 96E5 		43 B
279 B 		Document
General
Check archive.org
Download Go to
Full URL
https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
195.5.165.20 , Slovenia, ASN44968 (IPROM-AS, SI),
Reverse DNS
Software
/
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
close
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:28 GMT
Vary
Accept-Encoding
X-adserver-worker
erebus-0d2e81934424@version_1.556v2
X-core-time
0ms
X-server-arch
v2
Pug
simage2.pubmatic.com/AdServer/ Frame 3030
Redirect Chain
  • https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID
  • https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ7405775081198469329&uid=Q740577508119846...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7405775081198469329
568 B
643 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7405775081198469329
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
7921a6035cc8a0981a5dee737dd3d29b150ddd48407717d3fca4b6376f2b0e70

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-length
568
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
nginx

Redirect headers

Cache-Control
max-age=24245
Connection
keep-alive
Content-Length
154
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:28 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7405775081198469329
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server
Apache/2.4.6 (CentOS)
Vary
Accept-Encoding
X-Powered-By
PHP/7.3.33
Pug
simage2.pubmatic.com/AdServer/ Frame E7FA
Redirect Chain
  • https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:28F7D4B9C0A54A32B1BE3A0226AC86D4&gdpr=0&gdpr_consent=
1 B
53 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:28F7D4B9C0A54A32B1BE3A0226AC86D4&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
1
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:58:28 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-length
142
content-type
text/html
date
Tue, 20 Jun 2023 19:58:28 GMT
expires
Mon, 19 Jun 2023 19:58:28 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:28F7D4B9C0A54A32B1BE3A0226AC86D4&gdpr=0&gdpr_consent=
server
openresty
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
458249.gif
idsync.rlcdn.com/ Frame 205C
Redirect Chain
  • https://idsync.rlcdn.com/712188.gif?partner_uid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
  • https://pippio.com/api/sync?pid=5324&it=1&iv=309b2b86923efcb94b5b12e54be52a071167914db5a9c9f8422b3708a0390cda791426b5417dce21&_=2
  • https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlAzMDliMmI4NjkyM2VmY2I5NGI1YjEyZTU0YmU1MmEwNzExNjc5MTRkYjVhOWM5Zjg0MjJiMzcwOGEwMzkwY2RhNzkxNDI2YjU...
  • https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlAzMDliMmI4NjkyM2VmY2I5NGI1YjEyZTU0YmU1MmEwNzExNjc5MTRkYjVhOWM5Zjg0MjJiMzcwOGEwMzkwY2RhNzkxNDI2YjU0MTdkY2UyMRAAGgwI5InIpAYSBAgCEABCAEoA&goog...
  • https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
  • https://idsync.rlcdn.com/458249.gif?partner_uid=5be19df6-7853-4bd9-8606-e81139b4cea9
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/458249.gif?partner_uid=5be19df6-7853-4bd9-8606-e81139b4cea9
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:28 GMT
via
1.1 google
content-type
image/gif
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

location
https://idsync.rlcdn.com/458249.gif?partner_uid=5be19df6-7853-4bd9-8606-e81139b4cea9
date
Tue, 20 Jun 2023 19:58:28 GMT
via
1.1 google
x-samesite
secure
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
111
content-type
text/html; charset=utf-8
gdpr_consent=
bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF/gdpr=0/ Frame 205C 		49 B
543 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF/gdpr=0/gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.72.123.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-72-123-193.compute-1.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:28 GMT
server
Jetty(9.4.38.v20210224)
content-type
image/gif
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
*
cache-control
no-cache
x-server
10.40.3.244
content-length
49
expires
0
receive
pixel.tapad.com/idsync/ex/ Frame 205C 		95 B
123 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:28 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type
image/png
access-control-allow-origin
*
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95
/
bpi.rtactivate.com/tag/ Frame 205C 		43 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bpi.rtactivate.com/tag/?id=20909&user_id=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.204.156.95 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-204-156-95.compute-1.amazonaws.com
Software
awselb/2.0 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:28 GMT
server
awselb/2.0
content-length
43
content-type
image/gif
CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 205C 		0
35 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.165.35.122 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-165-35-122.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:28 GMT
sn.ashx
pmp.mxptint.net/ Frame 205C
Redirect Chain
  • https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33645_104947644_BB9C7463&r=https://pmp.mxptint.net/sn.ashx?ak=1
  • https://pmp.mxptint.net/sn.ashx?ak=1
43 B
266 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pmp.mxptint.net/sn.ashx?ak=1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
38.98.69.175 New York, United States, ASN174 (COGENT-174, US),
Reverse DNS
Software
/
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
Security Headers
Name Value
Strict-Transport-Security max-age=-370295851; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
-1
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:28 GMT
Cache-Control
no-cache
Strict-Transport-Security
max-age=-370295851; includeSubDomains
Content-Length
43
Content-Type
image/gif

Redirect headers

location
https://pmp.mxptint.net/sn.ashx?ak=1
date
Tue, 20 Jun 2023 19:58:27 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Pug
image2.pubmatic.com/AdServer/ Frame 205C
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=
42 B
342 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:58:28 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:27 GMT
server
A
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 205C
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=5407894714181040436
42 B
322 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=5407894714181040436
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 18:08:52 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
GET
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=5407894714181040436
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
Pug
simage2.pubmatic.com/AdServer/ Frame 205C
Redirect Chain
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3958812064475458525
42 B
95 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3958812064475458525
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 18:08:47 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Tue, 20 Jun 2023 19:58:28 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
2f14d2c3-fcf1-4363-b48c-eec5d4e0357b
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3958812064475458525
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 205C
Redirect Chain
  • https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:c6c815c7-1cf2-483a-9a6d-c792c2e0047e&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
42 B
95 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:c6c815c7-1cf2-483a-9a6d-c792c2e0047e&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:58:27 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:c6c815c7-1cf2-483a-9a6d-c792c2e0047e&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date
Tue, 20 Jun 2023 19:58:28 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=3000
Content-Length
0
P3P
policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"
drop_cookie_sw.php
csync.smilewanted.com/ Frame 0F06 		0
317 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69633081d2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding
drop_cookie_sw.php
csync.smilewanted.com/ Frame A6D0 		0
327 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69633081f2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding
drop_cookie_sw.php
csync.smilewanted.com/ Frame B94E 		0
529 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6963318232c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding
drop_cookie_sw.php
csync.smilewanted.com/ Frame 248E 		0
324 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69633182c2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding
/
sync.richaudience.com/a939d25b950298d0a5d324cea4fcd3d1/ Frame 54FC
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.richaudience.com%2Fa939d25b950298d0a5d324cea4fcd3d1%2F%3Fuid%3D$UID&gdpr=0&gdpr_consent=
  • https://sync.richaudience.com/a939d25b950298d0a5d324cea4fcd3d1/?uid=3958812064475458525&gdpr=0&gdpr_consent=
95 B
366 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.richaudience.com/a939d25b950298d0a5d324cea4fcd3d1/?uid=3958812064475458525&gdpr=0&gdpr_consent=
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.55.233.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.29.233.55.162.clients.your-server.de
Software
nginx/1.14.1 / PHP/8.2.4
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-type
image/png
date
Tue, 20 Jun 2023 19:58:27 GMT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
server
nginx/1.14.1
x-powered-by
PHP/8.2.4

Redirect headers

AN-X-Request-Uuid
f60a7614-abdc-49d8-975c-9d5661525850
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
Content-Type
text/html; charset=utf-8
Date
Tue, 20 Jun 2023 19:58:29 GMT
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Location
https://sync.richaudience.com/a939d25b950298d0a5d324cea4fcd3d1/?uid=3958812064475458525&gdpr=0&gdpr_consent=
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma
no-cache
Server
nginx/1.21.3
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
G2VucPZH9VEpuxOrQmKrKkiA
csync.smilewanted.com/set_partner_userid_get/sovrn/ Frame DBC6
Redirect Chain
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69633f9752c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:28 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
X-Sovrn-Pod
ad_ap2dca1
G2VucPZH9VEpuxOrQmKrKkiA
csync.smilewanted.com/set_partner_userid_get/sovrn/ Frame FCDA
Redirect Chain
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69633f9772c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:28 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
X-Sovrn-Pod
ad_ap2dca1
RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
csync.smilewanted.com/set_partner_userid_get/unruly/ Frame 9DC8
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted
  • https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F2069.66%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=1662735446
  • https://sync.1rx.io/usersync3/mediamathtest/2069.66/cb896492-04dd-4900-a8be-bcb5698eda5a?zcc=0&sspret=1
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-99a076fc-2013-49ba-8081-ddf...
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
0
383 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6963449ce2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:28 GMT
ETag
RX99a076fc201349ba8081ddfafa3aaa10005
Location
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Transfer-Encoding
chunked
G2VucPZH9VEpuxOrQmKrKkiA
csync.smilewanted.com/set_partner_userid_get/sovrn/ Frame 0904
Redirect Chain
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69633f9792c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:28 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
X-Sovrn-Pod
ad_ap2dca1
G2VucPZH9VEpuxOrQmKrKkiA
csync.smilewanted.com/set_partner_userid_get/sovrn/ Frame 42AE
Redirect Chain
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
0
390 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69633f9712c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:28 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
X-Sovrn-Pod
ad_ap2dca1
gen_204
pagead2.googlesyndication.com/pagead/ Frame 1660 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BayaJ3wSSZPyiN_mXoPwPjJwcAAAAADgB4AQC&bg=!lpWllcHNAAaGYqkwpmI7ADkAdvg8WuchpthSVmWYQKKMgx7Tf-4uWZLmTA41hF8jyLc7c1VV9Bmx7LGq426lWSbrECkYsDUEINoCAAAIj1IAAAAEaAEHmQMF2SQobeFLbgO9enhzh9qdNvvWb5J1lAGsXiiJEZo0Akp3MoT-f2kH2JH0cf8J3QYmqpCWDKke7801FIrVkrvAvLo0z-hLsb_ePdAs1tqIcCMtXaccgEt5PYUIRiMPcU9ZNxjVBFXx7B-pYcUe7caERH-xxv317yc1D_Z2IU9Urgi4SsY_jhbrU4PJMt6ut0KItwqHJJH1CCBFQh5G4COh1OBs_Z_ZwelCTyFSpc4JA33IG8EeRAi-D9Wx7PZrnNEBbPWAVKXq9rYL7KU9dHWrNCtzmg1jq7CTJyNwqE0a-STk_0PNq7FMgA3-HP-cIKaIwHqYWgs6Hg5yZtuLOujuOBQyStq8u-_jqURmL2AI4Mbh5znJsIrHkgiBdbejwn4-y5of8QZWdRaKMObKk4JiVG_fD6BInOE8_iuF1JM8rQZrAxA1p25O6Jwna-4ndcIh_7N1tpFFsSo14hb3oa19mq3HIq6-TPG_9iCYNqieSza3i9VOLHC9ZJyh9sXfnMQK-hD2Zy-UGhBdPvXvgDYg1Vl6aDKCDWxhZqVQKTIXFLM8FBV30etqRl0uyB17_g3WyQGJsOyKt-y0KJ4Q6ObE2xm0HTDDZgdlWWxiZmKSP76FFu68r_-1EkPUnGE4acI9K44PJ-2QDHICh3589qeowDfiaY85kc7lNm8X1zBhFaWrzdGNADqx2Akf4BAMI6Y3KHYtmjNBk3HoQUQyvfss-P5WhltWjkQSoS3pmnnfGeLUZTFy5EEVe6EvYUABb-rcq0zSyUPYwsH-ktL-QmRli8Ej_yx-dIVJWEjO1h_96cCxuZz66Qe-oKRaSAMxiAyD6a5pL7D7QGrfyTVl60byY5xif6Xivf3mprGD20y2sD3BC2NzbQXGgfyLr84UCz232OQaGrnJ5pYKxMGDFdpOBE4mPS490yNsKGDy9Eng_oM7fi6PAaLGNAKcMbhwp9p_632EKuHfUtnTjLw6otXQijH6XLObDBDtyhABr3ZGe9MpWAXIrXseOfDdD29v1MX5_4f1Tjc
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:28 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
drop_cookie_sw.php
csync.smilewanted.com/ Frame 212E 		0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6963368732c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding
drop_cookie_sw.php
csync.smilewanted.com/ Frame 3CA5 		0
112 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6963368742c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding
155.gif
id5-sync.com/k/ Frame 47FA
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1
  • https://id5-sync.com/s/286/9.gif?puid=da00dd86-3202-4e8e-b67f-1zz1687291106&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fsync.richaudience.com%2Fa6c163b098d05a413cd1682e26fae172%2F%3Fuid%3D%7BID5UID%7D
  • https://sync.mathtag.com/sync/img?mt_exid=10089&mt_exuid=ID5-148auFSVvSxCtzl9jqLduUI9OFkslL7ZyIQ64epekQ&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F286%2F3%2F8%2F2.gif%3Fpuid%3D%5BUUID%5D%26gdpr%3D0%26g...
  • https://id5-sync.com/c/286/3/8/2.gif?puid=cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
  • https://match.deepintent.com/usersync/147?redir=https%3A%2F%2Fid5-sync.com%2Fc%2F286%2F987%2F7%2F3.gif%3Fpuid%3D%24%7BDI_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/286/987/7/3.gif?puid=di_d782ad8a5c874f3ebf8d6&gdpr=0&gdpr_consent=
  • https://csync.loopme.me/?redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F286%2F821%2F6%2F4.gif%3Fpuid%3D%7Bdevice_id%7D%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/286/821/6/4.gif?puid=f66eb2fc-b468-4574-8969-c71d03ddbfc2&gdpr=0&gdpr_consent=
  • https://rtd-tm.everesttech.net/upi/pid/dm4ha19W?redir=https%3A%2F%2Fid5-sync.com%2Fc%2F286%2F136%2F5%2F5.gif%3Fpuid%3D%24%7BTM_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/286/136/5/5.gif?puid=ZJIE3AABR7XTlQAz&gdpr=0&gdpr_consent=
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=108&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F286%2F826%2F4%2F6.gif%3Fpuid%3D%7BuserId%7D%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/286/826/4/6.gif?puid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=
  • https://ice.360yield.com/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-148auFSVvSxCtzl9jqLduUI9OFkslL7ZyIQ64epekQ&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F286%2F916%2F3%2F7.gif%3Fpuid%3...
  • https://id5-sync.com/cq/286/916/3/7.gif?puid=cf5fb249-43c2-4293-b0ec-8acb4f767842&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/check_uuid/https%3A%2F%2Fid5-sync.com%2Fc%2F286%2F104%2F2%2F8.gif%3Fpuid%3D%24%7BBSW_UUID%7D%26gdpr%3D0%26gdpr_consent%3D?gdpr=0&gdpr_consent=
  • https://id5-sync.com/c/286/104/2/8.gif?puid=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&gdpr_consent=
  • https://match.prod.bidr.io/cookie-sync/id5?us_privacy=
  • https://id5-sync.com/k/155.gif?id5AccountNum=155&numCascadesAllowed=9&puid=AAEJeE7JJAoAACD7r3WP1g
0
0
1769ab5a-0153-53ab-806e-d191e4fcd575
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame E115
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}&crf=1
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
0
610 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69634ba392c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
/
sync.richaudience.com/6ccbc109824ae3014a36fd8993cc151d/ Frame F6F9
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1
  • https://match.sharethrough.com/universal/v1?supply_id=mmnOOyXZ&gdpr=0&gdpr_consent=
  • https://sync.richaudience.com/6ccbc109824ae3014a36fd8993cc151d/?uid=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44&gdpr=0
95 B
379 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.richaudience.com/6ccbc109824ae3014a36fd8993cc151d/?uid=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.55.233.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.29.233.55.162.clients.your-server.de
Software
nginx/1.14.1 / PHP/8.2.4
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-type
image/png
date
Tue, 20 Jun 2023 19:58:26 GMT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
server
nginx/1.14.1
x-powered-by
PHP/8.2.4

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:58:29 GMT
location
https://sync.richaudience.com/6ccbc109824ae3014a36fd8993cc151d/?uid=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44&gdpr=0
/
sync.richaudience.com/6ccbc109824ae3014a36fd8993cc151d/ Frame 735F
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1
  • https://match.sharethrough.com/universal/v1?supply_id=mmnOOyXZ&gdpr=0&gdpr_consent=
  • https://sync.richaudience.com/6ccbc109824ae3014a36fd8993cc151d/?uid=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44&gdpr=0
95 B
379 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.richaudience.com/6ccbc109824ae3014a36fd8993cc151d/?uid=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.55.233.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.29.233.55.162.clients.your-server.de
Software
nginx/1.14.1 / PHP/8.2.4
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-type
image/png
date
Tue, 20 Jun 2023 19:58:26 GMT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
server
nginx/1.14.1
x-powered-by
PHP/8.2.4

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:58:29 GMT
location
https://sync.richaudience.com/6ccbc109824ae3014a36fd8993cc151d/?uid=5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44&gdpr=0
G2VucPZH9VEpuxOrQmKrKkiA
csync.smilewanted.com/set_partner_userid_get/sovrn/ Frame 3446
Redirect Chain
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6963439c52c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:28 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
X-Sovrn-Pod
ad_ap2dca1
/
sync.richaudience.com/697a8452aebbe5875da0878cfaf3d0d0/ Frame 345F
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1
  • https://x.bidswitch.net/sync?ssp=richaudience&gdpr=0&gdpr_consent=&user_id=da00dd86-3202-4e8e-b67f-1zz1687291106
  • https://ads.betweendigital.com/match?bidder_id=43092&gdpr=0&consent=&callback_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D429%26user_id%3D%24%7BUSER_ID%7D%26ssp%3Drichaudience%26expires%3D3...
  • https://x.bidswitch.net/sync?dsp_id=429&user_id=1769ab5a-0153-53ab-806e-d191e4fcd575&ssp=richaudience&expires=30&user_group=1&gdpr=0&gdpr_consent=
  • https://sync.richaudience.com/697a8452aebbe5875da0878cfaf3d0d0/?uid=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&gdpr_consent=&us_ps=
95 B
379 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.richaudience.com/697a8452aebbe5875da0878cfaf3d0d0/?uid=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&gdpr_consent=&us_ps=
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.55.233.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.29.233.55.162.clients.your-server.de
Software
nginx/1.14.1 / PHP/8.2.4
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-type
image/png
date
Tue, 20 Jun 2023 19:58:27 GMT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
server
nginx/1.14.1
x-powered-by
PHP/8.2.4

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:29 GMT
Location
//sync.richaudience.com/697a8452aebbe5875da0878cfaf3d0d0/?uid=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=0&gdpr_consent=&us_ps=
Server
nginx
G2VucPZH9VEpuxOrQmKrKkiA
csync.smilewanted.com/set_partner_userid_get/sovrn/ Frame D2AD
Redirect Chain
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
0
418 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6963449c92c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:28 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VucPZH9VEpuxOrQmKrKkiA
X-Sovrn-Pod
ad_ap2dca1
RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
sync.targeting.unrulymedia.com/csync/ Frame E7FD
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005&rndcb=6875174845
  • https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=adconductor&bsw_custom_parameter=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=&gdpr_consent=
  • https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=adconductor&bsw_custom_parameter=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=&gdpr_consent=
  • https://x.bidswitch.net/sync?dsp_id=4&user_id=dd2e1a02-8c76-4490-b97b-ff2e506e3120&ssp=adconductor&expires=30&user_group=5&bsw_param=56daf56a-28b1-40e7-a167-b6cb39d3f949
  • https://sync.1rx.io/usersync/bidswitch/56daf56a-28b1-40e7-a167-b6cb39d3f949?gdpr=&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
43 B
435 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.127.204.142 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
keep-alive
Content-Length
43
Date
Tue, 20 Jun 2023 19:58:28 GMT
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Pragma
no-cache
Transfer-Encoding
chunked
7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
csync.smilewanted.com/set_partner_userid_get/bizzclick/ Frame F2D4
Redirect Chain
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
0
403 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696347a052c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
csync.smilewanted.com/set_partner_userid_get/unruly/ Frame B300
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005&rndcb=3544734509
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=adconductor&bsw_param=56daf56a-28b1-40e7-a167-b6cb39d3f949&google_hm=NTZkYWY1NmEtMjhiMS00MGU3LWExNjctYjZjYjM5ZDNm...
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEERQGkhWpu77Bcer9iT4tFM&google_cver=1&ssp=adconductor&bsw_param=56daf56a-28b1-40e7-a167-b6cb39d3f949
  • https://sync.1rx.io/usersync/bidswitch/56daf56a-28b1-40e7-a167-b6cb39d3f949?gdpr=&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-99a076fc-2013-49ba-8081-ddf...
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
0
654 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696356b022c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:28 GMT
ETag
RX99a076fc201349ba8081ddfafa3aaa10005
Location
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Transfer-Encoding
chunked
RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
sync.targeting.unrulymedia.com/csync/ Frame 2965
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005&rndcb=5490865808
  • https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=56daf56a-28b1-40e7-a167-b6cb39d3f949&ssp=adconductor&gdpr=&gdpr_consent=
  • https://x.bidswitch.net/sync?dsp_id=419&user_id=10598588408662670101&ssp=adconductor&gdpr=&gdpr_consent=
  • https://sync.1rx.io/usersync/bidswitch/56daf56a-28b1-40e7-a167-b6cb39d3f949?gdpr=&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
43 B
435 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.127.204.142 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
keep-alive
Content-Length
43
Date
Tue, 20 Jun 2023 19:58:28 GMT
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Pragma
no-cache
Transfer-Encoding
chunked
/
sync.richaudience.com/a939d25b950298d0a5d324cea4fcd3d1/ Frame 73B3
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.richaudience.com%2Fa939d25b950298d0a5d324cea4fcd3d1%2F%3Fuid%3D$UID&gdpr=0&gdpr_consent=
  • https://sync.richaudience.com/a939d25b950298d0a5d324cea4fcd3d1/?uid=3958812064475458525&gdpr=0&gdpr_consent=
95 B
366 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.richaudience.com/a939d25b950298d0a5d324cea4fcd3d1/?uid=3958812064475458525&gdpr=0&gdpr_consent=
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.55.233.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.29.233.55.162.clients.your-server.de
Software
nginx/1.14.1 / PHP/8.2.4
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-type
image/png
date
Tue, 20 Jun 2023 19:58:27 GMT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
server
nginx/1.14.1
x-powered-by
PHP/8.2.4

Redirect headers

AN-X-Request-Uuid
f4a60601-a1a2-465b-948d-e1bc88e488ac
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
Content-Type
text/html; charset=utf-8
Date
Tue, 20 Jun 2023 19:58:29 GMT
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Location
https://sync.richaudience.com/a939d25b950298d0a5d324cea4fcd3d1/?uid=3958812064475458525&gdpr=0&gdpr_consent=
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma
no-cache
Server
nginx/1.21.3
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
sync.targeting.unrulymedia.com/csync/ Frame 818D
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005&rndcb=32955881
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=adconductor&bsw_param=56daf56a-28b1-40e7-a167-b6cb39d3f949&google_hm=NTZkYWY1NmEtMjhiMS00MGU3LWExNjctYjZjYjM5ZDNm...
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEERQGkhWpu77Bcer9iT4tFM&google_cver=1&ssp=adconductor&bsw_param=56daf56a-28b1-40e7-a167-b6cb39d3f949
  • https://sync.1rx.io/usersync/bidswitch/56daf56a-28b1-40e7-a167-b6cb39d3f949?gdpr=&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
43 B
435 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.127.204.142 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
keep-alive
Content-Length
43
Date
Tue, 20 Jun 2023 19:58:28 GMT
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Pragma
no-cache
Transfer-Encoding
chunked
get
choices.trustarc.com/ Frame B7C7 		287 B
628 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=29664373&js=st_2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Mon, 19 Jun 2023 00:08:52 GMT
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P2
age
157776
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
287
x-amz-cf-id
jC0bi86foNOdsHNSMj9Ai6Uk8qOKQ3UH-87xEDtGqolzlNjcO2IS4w==
expires
Wed, 19 Jul 2023 00:08:52 GMT
get
choices.trustarc.com/ Frame B7C7 		739 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-full-tr.png
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=29664373&js=st_2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-93.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Sun, 18 Jun 2023 12:17:59 GMT
via
1.1 baec235d174153a8f2e92ea724643824.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P2
age
200429
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
739
x-amz-cf-id
tyCivVuywd3svJJZ3H8qs18lyDwGXisdpY1SHG73cIATV487H6EQ6w==
expires
Tue, 18 Jul 2023 12:17:59 GMT
partner
sync.search.spotxchange.com/ Frame 8008
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1
  • https://sync.search.spotxchange.com/partner?source=202100&gdpr=0&gdpr_consent=
  • https://sync.search.spotxchange.com/partner?source=202100&gdpr=0&gdpr_consent=&__user_check__=1&sync_id=d389411d-0fa4-11ee-a631-183b8be90103
  • https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_sc&gdpr=0&gdpr_consent=&us_privacy=
  • https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&gdpr_consent=&uid=CAESED63p2kod-w5w6E5j6Hucf0&google_cver=1
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=spotx&ttd_tpi=1&gdpr=0&gdpr_consent=&us_privacy=
  • https://sync.search.spotxchange.com/partner?adv_id=7028&uid=120447a6-30d3-414b-b8f9-7a5eddeefdcd&img=1
  • https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1&gdpr=0&gdpr_consent=&us_privacy=
  • https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZJIE3AABR7XTlQAz&img=1&gdpr=0&gdpr_consent=&us_privacy=
  • https://match.prod.bidr.io/cookie-sync/sx?gdpr=0&gdpr_consent=&us_privacy=
  • https://sync.search.spotxchange.com/partner?adv_id=8304&uid=AAEJeE7JJAoAACD7r3WP1g&gdpr=0
  • https://sync.springserve.com/usersync?redirect_url=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D8876%26uid%3DSS_UUID
  • https://sync.search.spotxchange.com/partner?adv_id=8876&uid=cda85162-9abf-4dc4-9522-07916bc9e508
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=44&gdpr=0&gdpr_consent=&us_privacy=
  • https://sync.search.spotxchange.com/partner?adv_id=7308&uid=3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&gdpr=0&gdpr_consent=
  • https://sync.mathtag.com/sync/img?mt_exid=30&redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6653%26uid%3D%5BMM_UUID%5D&gdpr=0&gdpr_consent=&us_privacy=
  • https://sync.search.spotxchange.com/partner?adv_id=6653&uid=cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
43 B
419 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.search.spotxchange.com/partner?adv_id=6653&uid=cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.35.249.137 Ashburn, United States, ASN11742 (SPOTX-IAD, US),
Reverse DNS
Software
/
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
false
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
content-length
43
content-type
image/gif
date
Tue, 20 Jun 2023 19:58:29 GMT
x-fe
496

Redirect headers

Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:58:29 GMT
Expires
Tue, 20 Jun 2023 19:58:28 GMT
Keep-Alive
timeout=360
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server
MT3 1031 59fd23a master iad iad-pixel-x14 config_version:"1969"
location
https://sync.search.spotxchange.com/partner?adv_id=6653&uid=cb896492-04dd-4900-a8be-bcb5698eda5a&gdpr=0&gdpr_consent=
1769ab5a-0153-53ab-806e-d191e4fcd575
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame A429
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}&crf=1
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69634ba402c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
5407894714181040436
csync.smilewanted.com/set_partner_userid_get/adform/ Frame C40E
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696363bbb2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:58:28 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
server
nginx
1769ab5a-0153-53ab-806e-d191e4fcd575
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame 9080
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}&crf=1
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69634ba3a2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
1769ab5a-0153-53ab-806e-d191e4fcd575
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame 4DF6
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}&crf=1
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69634ba3b2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
sync.targeting.unrulymedia.com/csync/ Frame 3964
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005&rndcb=3495598572
  • https://ads.betweendigital.com/match?bidder_id=43092&gdpr=&consent=&callback_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D429%26user_id%3D%24%7BUSER_ID%7D%26ssp%3Dadconductor%26expires%3D30%...
  • https://x.bidswitch.net/sync?dsp_id=429&user_id=1769ab5a-0153-53ab-806e-d191e4fcd575&ssp=adconductor&expires=30&user_group=1&gdpr=&gdpr_consent=
  • https://sync.1rx.io/usersync/bidswitch/56daf56a-28b1-40e7-a167-b6cb39d3f949?gdpr=&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
43 B
435 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.127.204.142 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
keep-alive
Content-Length
43
Date
Tue, 20 Jun 2023 19:58:28 GMT
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Pragma
no-cache
Transfer-Encoding
chunked
1769ab5a-0153-53ab-806e-d191e4fcd575
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame E646
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}&crf=1
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69634ba382c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
sync.targeting.unrulymedia.com/csync/ Frame D100
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005&rndcb=2722881669
  • https://server.cpmstar.com/usersync.aspx?bsw_custom_parameter=56daf56a-28b1-40e7-a167-b6cb39d3f949&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D440%26ssp...
  • https://x.bidswitch.net/sync?dsp_id=440&ssp=adconductor&user_id=TFQGjrBCa-apPq2BcI-p0
  • https://sync.1rx.io/usersync/bidswitch/56daf56a-28b1-40e7-a167-b6cb39d3f949?gdpr=&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
43 B
435 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.127.204.142 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
keep-alive
Content-Length
43
Date
Tue, 20 Jun 2023 19:58:28 GMT
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://sync.targeting.unrulymedia.com/csync/RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
Pragma
no-cache
Transfer-Encoding
chunked
gen_204
pagead2.googlesyndication.com/pagead/ Frame A186 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BXnzz4ASSZJneD9HMowa0276IDwAAAAA4AeAEAg&bg=!OjmlOW3NAAaGYqkwpmI7ADkAdvg8Wsk1kyBitTWXG2zIAkup46wl7docBWPtkXkUlIwaW-GYGsM67zG_2yaOJYNnSG9fXo7cAVgCAAAGzVIAAAADaAEHmQMdQeZPDfjikzUth0JHtiZdDTM72b_fiKb92n9lTMCoZ04YNM5VycqmvfFSEtiM_kUIHmRYolHRR9aUHZlOoHQ5ICW1R5202IdUoYLGKK-kuP1AmJv1FI93_PLRVHk2BsQPxfFf7-XOSuLAbkr5RmoC6s09Ehd67cTEMIcUqYIQ8cb8bDyEjBbQhhAH3Vb_Dd7h_4yqQmCiC474d5GzaKvycplBpoAmkkrEnhPGSGQCtrLUuROifwH5jL637BumeHcmQcZ89w1BJxI61E7UgyzQQojDWjreXSLsseqi72IXVkne9Hp8U3H1NbBMeU27UrqRWCrlbgYDHZmbwxSk2StGhzwhAeof_jGV3DkLqmDnK-psjzbEW7_pci3ShRGI-w6hq8ljn-pk1GSljIC_uNMW403G5onhVKEs2N1grNW-2s9_T3e6u26MMO9P2sviSxyFcXyGp6sHeXE6R-S-p7TGz-o7jldr_Gf71wXOYTH1OYBGRUqJ-EOxDpicSTyV4znJT9BSK-ZzbWS5E9aG8AhbZ2Y4C23W29mCR_S29TWaw2h2nvuPBhFD_FuxeXXVSBZQbT2XCg7S3SknK7o1qujwrsxzIRGAIXimr4I7QT563sPJY42-OByrC040iBregeXRykF2D2qzEKjIc_MgFYKxPYBXsiGIvMowCRLX7iQ40IB1nwD22KouSzVCCvc1LS3s-cPaSYMBmOI2yX2u68n7Q8uGM5zlha9v4WPqPTCpTSBezt-yr5-wket7dfSaJ_WQxGJZhMH3wzDEHx8sUrMgOChBoQ-y7uDH9mEzh-pzzOBYZrERql1F4j-xRFJUIUigTWBlu_PqWBbf4JmUwS9g2s2tISiLvnh2j-QFYIOjlDZQiYjTOwAdajSfEx4MFMzuM5nBmORgt5RGbAI69ljCb9gRXiWXk2qHUpk209JJXOi35C-QTOTrvbE_CFixc536ajHhGlsqbA_OEMdkMhO4wPFz3xGKx-Sz1GfMWTxO8wlvFPb4zZFCl8Lj-H5ey7yPk2n43bMZOeBjSbOvHBYrhpu6xC4KA-O0fXuu0O8
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:28 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
csync.smilewanted.com/set_partner_userid_get/bizzclick/ Frame 31CE
Redirect Chain
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
0
90 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696349a272c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
3f80f6209b9252ca9426775c7eb8e89
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame 1DB7
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/3f80f6209b9252ca9426775c7eb8e89?gdpr_consent=&gdpr=0
0
455 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/freewheel/3f80f6209b9252ca9426775c7eb8e89?gdpr_consent=&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696350a912c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:28 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/freewheel/3f80f6209b9252ca9426775c7eb8e89?gdpr_consent=&gdpr=0
Pragma
no-cache
Server
nginx
x-sticky-vk
1687291108577074-292
7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
csync.smilewanted.com/set_partner_userid_get/bizzclick/ Frame 5FDC
Redirect Chain
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
0
85 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69634ca5d2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
csync.smilewanted.com/set_partner_userid_get/bizzclick/ Frame C973
Redirect Chain
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69634da692c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
1769ab5a-0153-53ab-806e-d191e4fcd575
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame 2933
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69634ba3c2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
csync.smilewanted.com/set_partner_userid_get/bizzclick/ Frame 6A9A
Redirect Chain
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
0
403 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69634da672c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
1769ab5a-0153-53ab-806e-d191e4fcd575
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame 97D2
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
0
399 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69634ba3e2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/1769ab5a-0153-53ab-806e-d191e4fcd575
5407894714181040436
csync.smilewanted.com/set_partner_userid_get/adform/ Frame 241D
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696363bbe2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:58:28 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
server
nginx
%7BSTX_USER_ID%7D
csync.smilewanted.com/set_partner_userid_get/sharethrough/ Frame 67F6
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
0
404 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69634da662c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:58:28 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
5407894714181040436
csync.smilewanted.com/set_partner_userid_get/adform/ Frame 3EFC
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
0
503 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696363bbd2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:58:28 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
server
nginx
5407894714181040436
csync.smilewanted.com/set_partner_userid_get/adform/ Frame A2C8
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
0
718 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696363bc22c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:58:28 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
server
nginx
7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
csync.smilewanted.com/set_partner_userid_get/bizzclick/ Frame 7115
Redirect Chain
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
0
700 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696350a8f2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
5407894714181040436
csync.smilewanted.com/set_partner_userid_get/adform/ Frame 7E86
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
0
112 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696363bc42c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:58:28 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
server
nginx
7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
csync.smilewanted.com/set_partner_userid_get/bizzclick/ Frame B57D
Redirect Chain
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69634ea792c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
3734a527a69bb6e9ffb5baa565b5b083
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame 5B36
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/3734a527a69bb6e9ffb5baa565b5b083?gdpr_consent=&gdpr=0
0
446 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/freewheel/3734a527a69bb6e9ffb5baa565b5b083?gdpr_consent=&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696354ad72c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:28 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/freewheel/3734a527a69bb6e9ffb5baa565b5b083?gdpr_consent=&gdpr=0
Pragma
no-cache
Server
nginx
x-sticky-vk
1687291108602094-150
953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame 81AE
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
0
487 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696350a9b2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
aad958804afe4ca273405e5673d62eef
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame 1806
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/aad958804afe4ca273405e5673d62eef?gdpr_consent=&gdpr=0
0
440 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/freewheel/aad958804afe4ca273405e5673d62eef?gdpr_consent=&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696356af92c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:28 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/freewheel/aad958804afe4ca273405e5673d62eef?gdpr_consent=&gdpr=0
Pragma
no-cache
Server
nginx
x-sticky-vk
1687291108647067-319
aad958804afe4ca273405e5673d62eef
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame 9A44
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/aad958804afe4ca273405e5673d62eef?gdpr_consent=&gdpr=0
0
449 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/freewheel/aad958804afe4ca273405e5673d62eef?gdpr_consent=&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696355af72c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:28 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/freewheel/aad958804afe4ca273405e5673d62eef?gdpr_consent=&gdpr=0
Pragma
no-cache
Server
nginx
x-sticky-vk
1687291108657031-302
5407894714181040436
csync.smilewanted.com/set_partner_userid_get/adform/ Frame 393A
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
0
104 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696363bc02c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:58:28 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
server
nginx
c38114cf2e856747dcd2252d549fb
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame 7922
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/c38114cf2e856747dcd2252d549fb?gdpr_consent=&gdpr=0
0
465 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/freewheel/c38114cf2e856747dcd2252d549fb?gdpr_consent=&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696356afb2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:28 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/freewheel/c38114cf2e856747dcd2252d549fb?gdpr_consent=&gdpr=0
Pragma
no-cache
Server
nginx
x-sticky-vk
1687291108655036-275
5407894714181040436
csync.smilewanted.com/set_partner_userid_get/adform/ Frame E970
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
0
90 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696363bc12c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:58:28 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/5407894714181040436
server
nginx
%7BSTX_USER_ID%7D
csync.smilewanted.com/set_partner_userid_get/sharethrough/ Frame B66C
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
0
444 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696355af52c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:58:28 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
FOYPqMoXokSCEEaOCmV5
csync.smilewanted.com/set_partner_userid_get/rtbhouse/ Frame D771
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=smilewanted
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
0
450 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69635db5f2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:58:28 GMT Tue, 20 Jun 2023 19:58:28 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
pragma
no-cache
%7BSTX_USER_ID%7D
csync.smilewanted.com/set_partner_userid_get/sharethrough/ Frame 5810
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696356b002c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:58:28 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
%7BSTX_USER_ID%7D
csync.smilewanted.com/set_partner_userid_get/sharethrough/ Frame B1ED
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
0
421 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696356afe2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:58:28 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
99dadd3a4b121d59968c6b86fe6c61e1
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame 9D53
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/99dadd3a4b121d59968c6b86fe6c61e1?gdpr_consent=&gdpr=0
0
448 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/freewheel/99dadd3a4b121d59968c6b86fe6c61e1?gdpr_consent=&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696357b0b2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:28 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/freewheel/99dadd3a4b121d59968c6b86fe6c61e1?gdpr_consent=&gdpr=0
Pragma
no-cache
Server
nginx
x-sticky-vk
1687291108668021-59
%7BSTX_USER_ID%7D
csync.smilewanted.com/set_partner_userid_get/sharethrough/ Frame 6274
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
0
85 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696357b0c2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:58:28 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
4a5ba88d7370bc1ec9f04c856efc52f6
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame 9B45
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/4a5ba88d7370bc1ec9f04c856efc52f6?gdpr_consent=&gdpr=0
0
477 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/freewheel/4a5ba88d7370bc1ec9f04c856efc52f6?gdpr_consent=&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696357b182c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:58:28 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/freewheel/4a5ba88d7370bc1ec9f04c856efc52f6?gdpr_consent=&gdpr=0
Pragma
no-cache
Server
nginx
x-sticky-vk
1687291108665062-287
953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame 4287
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
0
468 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69635ab372c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame 6595
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69635ab3c2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame AEA8
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69635ab3d2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
%7BSTX_USER_ID%7D
csync.smilewanted.com/set_partner_userid_get/sharethrough/ Frame E893
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
0
641 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69635cb512c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:58:28 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame 94FA
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
0
459 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69635cb502c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
%7BSTX_USER_ID%7D
csync.smilewanted.com/set_partner_userid_get/sharethrough/ Frame 39BE
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
0
112 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69635cb562c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:58:28 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
event.png
tpsc-ue1.doubleverify.com/ Frame B4B6 		0
234 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://tpsc-ue1.doubleverify.com/event.png?impid=3a828142688944c1969811856ae037ad&flavor=0&gdpr=&gdpr_consent=&dvp_gdpr_Error=3&dvp_gdv2_Error=3&vdur=166&eoid=14&msrjs=3941&sdf=67108870&vit=2&isvelg=1&rmi=16&tltms=136&tetms=13&msltms=41&vltms=166&sei=290&vetms=735&tuviims=443&tuviems=1344&engms=1&engisel=1&dvp_dtcov=4&msrcanlm=394&msrcannum=4&ee_dp_tmads=3249&ismms=41&isumms=40&nvr=6&elmtp=3&isbxdms=3127&b0=100&b11=3087&adhgt=250&adwdth=300&norwdth=300&norhgt=250&vsos=4&dvp_vsosnmr=16&lftb=3187&sftb=3187&msrdp=2&naral=2&vct=512&vphgt=1200&vpwdth=1600&chgt=250&cwdth=300&scrhgt=1200&scrwdth=1600&strp=0&advisonl=false&isiabvms=1116&isuiabvms=1116&ispmxpms=1116&engalms=40&engscrlms=428&dvp_pageEng=true&dvp_dpr=1&vstsz=754&ee_dp_cvcmeeid=1&metp=1&meeid=1&ttfurm=3929&cbust=1687291108723663
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements3941.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:28 GMT
Cache-Control
max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Expires
06/19/2023 19:58:28
event.png
tpsc-ue1.doubleverify.com/ Frame 89F2 		0
234 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://tpsc-ue1.doubleverify.com/event.png?impid=7e8877dfb8a44f26aba94c9290c309cd&flavor=0&gdpr=&gdpr_consent=&dvp_gdpr_Error=3&dvp_gdv2_Error=3&vdur=148&eoid=14&msrjs=3941&sdf=67108870&vit=2&isvelg=1&rmi=16&tltms=109&tetms=11&msltms=49&vltms=148&sei=290&vetms=739&tuviims=484&tuviems=1371&engms=1&engisel=1&dvp_dtcov=4&msrcanlm=394&msrcannum=4&ee_dp_tmads=3209&ismms=12&isumms=11&nvr=6&elmtp=3&isbxdms=3089&b0=100&b11=3078&adhgt=250&adwdth=300&norwdth=300&norhgt=250&vsos=4&dvp_vsosnmr=16&lftb=3178&sftb=3178&msrdp=2&naral=2&vct=512&vphgt=1200&vpwdth=1600&chgt=250&cwdth=300&scrhgt=1200&scrwdth=1600&strp=0&advisonl=false&isiabvms=1087&isuiabvms=1087&ispmxpms=1087&engalms=10&dvp_dpr=1&vstsz=756&ee_dp_cvcmeeid=1&metp=1&meeid=1&ttfurm=3897&cbust=1687291108733503
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements3941.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:28 GMT
Cache-Control
max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Expires
06/19/2023 19:58:28
event.png
tpsc-ue1.doubleverify.com/ Frame 48CA 		0
234 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://tpsc-ue1.doubleverify.com/event.png?impid=ccc27376a73e4a8a9518277907b34af3&flavor=0&gdpr=&gdpr_consent=&dvp_gdpr_Error=3&dvp_gdv2_Error=3&vdur=71&eoid=14&msrjs=3941&sdf=67108870&vit=2&isvelg=1&rmi=16&tltms=78&tetms=10&msltms=28&vltms=71&sei=290&vetms=722&tuviims=429&tuviems=1222&engms=1&engisel=1&dvp_dtcov=4&msrcanlm=394&msrcannum=4&ee_dp_tmads=3131&ismms=12&isumms=11&nvr=6&elmtp=3&isbxdms=2989&b0=100&b11=2978&adhgt=250&adwdth=300&norwdth=300&norhgt=250&vsos=4&dvp_vsosnmr=16&lftb=3078&sftb=3078&msrdp=2&naral=2&vct=512&vphgt=1200&vpwdth=1600&chgt=250&cwdth=300&scrhgt=1200&scrwdth=1600&strp=0&advisonl=false&isiabvms=1135&isuiabvms=1135&ispmxpms=1135&engalms=11&engscrlms=352&dvp_pageEng=true&dvp_dpr=1&vstsz=756&ee_dp_cvcmeeid=1&metp=1&meeid=1&ttfurm=3801&cbust=1687291108735357
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements3941.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:28 GMT
Cache-Control
max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Expires
06/19/2023 19:58:28
FOYPqMoXokSCEEaOCmV5
csync.smilewanted.com/set_partner_userid_get/rtbhouse/ Frame 2F36
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=smilewanted
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
0
486 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696367bfc2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:58:28 GMT Tue, 20 Jun 2023 19:58:28 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
pragma
no-cache
FOYPqMoXokSCEEaOCmV5
csync.smilewanted.com/set_partner_userid_get/rtbhouse/ Frame 8A6F
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=smilewanted
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
0
90 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696367bfd2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:58:28 GMT Tue, 20 Jun 2023 19:58:28 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
pragma
no-cache
FOYPqMoXokSCEEaOCmV5
csync.smilewanted.com/set_partner_userid_get/rtbhouse/ Frame 1214
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=smilewanted
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
0
489 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696367bff2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:28 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:58:28 GMT Tue, 20 Jun 2023 19:58:28 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
pragma
no-cache
953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame 26A3
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
0
539 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696360b962c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
FOYPqMoXokSCEEaOCmV5
csync.smilewanted.com/set_partner_userid_get/rtbhouse/ Frame B55C
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=smilewanted
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
0
489 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696368c0f2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:58:28 GMT Tue, 20 Jun 2023 19:58:28 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
pragma
no-cache
953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame 7F65
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
0
456 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da696361ba02c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:58:28 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
FOYPqMoXokSCEEaOCmV5
csync.smilewanted.com/set_partner_userid_get/rtbhouse/ Frame 87CA
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=smilewanted
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
0
481 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69636cc562c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:58:28 GMT Tue, 20 Jun 2023 19:58:28 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
pragma
no-cache
FOYPqMoXokSCEEaOCmV5
csync.smilewanted.com/set_partner_userid_get/rtbhouse/ Frame B0C7
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=smilewanted
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da69636dc6a2c07-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:58:29 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:58:28 GMT Tue, 20 Jun 2023 19:58:28 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/FOYPqMoXokSCEEaOCmV5?pi=smilewanted
pragma
no-cache
event.png
tpsc-ue1.doubleverify.com/ Frame 0106 		0
234 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://tpsc-ue1.doubleverify.com/event.png?impid=6205aa094cdf4393b40e93223a5a75e8&flavor=0&gdpr=&gdpr_consent=&dvp_gdpr_Error=3&dvp_gdv2_Error=3&vdur=49&eoid=14&msrjs=3941&sdf=67108870&vit=2&isvelg=1&rmi=16&tltms=20&tetms=29&msltms=30&vltms=49&sei=290&vetms=227&tuviims=482&tuviems=758&engms=1&engisel=1&dvp_dtcov=4&msrcanlm=394&msrcannum=4&ee_dp_tmads=2419&ismms=22&isumms=21&nvr=6&elmtp=3&isbxdms=2395&b0=100&b11=2377&adhgt=250&adwdth=300&norwdth=300&norhgt=250&vsos=4&dvp_vsosnmr=16&lftb=2477&sftb=2477&msrdp=4&naral=2&vct=512&vphgt=1200&vpwdth=1600&chgt=250&cwdth=300&scrhgt=1200&scrwdth=1600&strp=0&advisonl=false&isiabvms=1255&isuiabvms=1255&ispmxpms=1255&engalms=20&engscrlms=181&dvp_pageEng=true&dvp_dpr=1&vstsz=756&ee_dp_cvcmeeid=1&metp=1&meeid=1&ttfurm=3291&cbust=1687291109215561
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements3941.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:58:29 GMT
Cache-Control
max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Expires
06/19/2023 19:58:29
PugMaster
image6.pubmatic.com/AdServer/ Frame ADB7 		573 B
989 B 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=10319114&p=156383&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
49396e4896729f4764a9a42d1a4a25f1850a5ffa9b5e96bbd49d02219a052867

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Tue, 20 Jun 2023 19:58:29 GMT
content-length
573
content-type
text/html; charset=UTF-8
75145
i.liadm.com/s/ Frame ADB7 		43 B
653 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.liadm.com/s/75145?bidder_id=195755&bidder_uuid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.223.184.50 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-184-50.compute-1.amazonaws.com
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:29 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
3
Content-Type
image/gif
qmap
sync.crwdcntrl.net/ Frame ADB7 		49 B
265 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.72.123.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-72-123-193.compute-1.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:29 GMT
server
Jetty(9.4.38.v20210224)
content-type
image/gif
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
*
cache-control
no-cache
x-server
10.40.34.213
content-length
49
expires
0
/
io.narrative.io/ Frame ADB7
Redirect Chain
  • https://io.narrative.io/?companyId=673&id=pubmatic_id:F2EBBF7D-4C79-4F31-B67B-920625C98DEF
  • https://io.narrative.io/?io.narrative.guid.v2=d3d63c70-0fa4-11ee-b039-16c962239a11&companyId=673&id=pubmatic_id:F2EBBF7D-4C79-4F31-B67B-920625C98DEF
0
247 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://io.narrative.io/?io.narrative.guid.v2=d3d63c70-0fa4-11ee-b039-16c962239a11&companyId=673&id=pubmatic_id:F2EBBF7D-4C79-4F31-B67B-920625C98DEF
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
54.205.176.242 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-205-176-242.compute-1.amazonaws.com
Software
nginx/1.22.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:29 GMT
Cache-Control
no-cache
Server
nginx/1.22.1
Connection
keep-alive

Redirect headers

Location
https://io.narrative.io/?io.narrative.guid.v2=d3d63c70-0fa4-11ee-b039-16c962239a11&companyId=673&id=pubmatic_id:F2EBBF7D-4C79-4F31-B67B-920625C98DEF
Date
Tue, 20 Jun 2023 19:58:29 GMT
Server
nginx/1.22.1
Connection
keep-alive
Content-Length
0
p
a.audrte.com/ Frame ADB7
Redirect Chain
  • https://a.audrte.com/match?gdpr=0&gdpr_consent=&p=M1717054901&uid=F2EBBF7D-4C79-4F31-B67B-920625C98DEF
  • https://a.audrte.com/p
68 B
424 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.audrte.com/p
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
3.221.8.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-221-8-21.compute-1.amazonaws.com
Software
nginx/1.18.0 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:58:29 GMT
Server
nginx/1.18.0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
68

Redirect headers

Date
Tue, 20 Jun 2023 19:58:29 GMT
Server
nginx/1.18.0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Access-Control-Allow-Origin
*
Location
https://a.audrte.com:443/p
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
SPug
simage4.pubmatic.com/AdServer/ Frame 205C 		0
128 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=156383&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:30 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
sodar
pagead2.googlesyndication.com/getconfig/ 		14 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202306140101&st=env
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b95d281b5eec08a951b4908f4f22850b5a4a3ac6c4479239a2dbc77af58406c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:31 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11084
x-xss-protection
0
614620065398091
connect.facebook.net/signals/config/ 		300 KB
86 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/614620065398091?v=2.9.107&r=stable
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
4424132c76bd3b942b9a4b0dc628dc4cd5826b75022aca28ad4ae6a696f35437
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Tue, 20 Jun 2023 19:58:31 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
87969
x-xss-protection
0
pragma
public
x-fb-debug
3EOIrrwvd+uyAVV3JXK6RjK6vKtlXBgIMi1aMBz0qOQVSfKc8B72y0vM7PWQapxawKNXMAN2lGs+h2rrwqcNfA==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		188 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-747356055
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:820::2008 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a8e977cdd82a0e8e0528dffd3f95ae42c4ce4bf9664b19f29bf429014597fef8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:31 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
69695
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 20 Jun 2023 19:58:31 GMT
bat.js
bat.bing.com/ 		40 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Tue, 20 Jun 2023 19:58:30 GMT
last-modified
Thu, 11 May 2023 18:08:27 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: B9E9F6248C684C619891AC417E35D3FD Ref B: YMQ01EDGE0409 Ref C: 2023-06-20T19:58:31Z
etag
"80df77953384d91:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
12183
swap.js
cdn.callrail.com/companies/649313642/d272108827995ed1b1b1/12/ 		36 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.callrail.com/companies/649313642/d272108827995ed1b1b1/12/swap.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-83.ewr53.r.cloudfront.net
Software
/
Resource Hash
a54690656b18f041c597eb704cbc6ee95c571db2ed7460392e7c49b899dcc74f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:31 GMT
via
1.1 9d35ce6897d7f02042955443076a54de.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
x-amz-cf-pop
EWR53-P1
x-cache
Miss from cloudfront
x-xss-protection
1; mode=block
x-request-id
f6c7f9c9-f01b-4b29-9761-fae14db70c2d
x-runtime
0.010990
referrer-policy
strict-origin-when-cross-origin
etag
W/"a54690656b18f041c597eb704cbc6ee9"
x-download-options
noopen
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600, public
timing-allow-origin
*
x-amz-cf-id
SMcxmz7gZod2YC9CcwiKsF3rrw0UdGPoIvniibTsN3-yx_jf4dxS4Q==
usermatch.gif
beacon.krxd.net/
Redirect Chain
  • https://insight.adsrvr.org/track/evnt/?adv=64gxdrp&ct=0:6swk5ma&fmt=3
  • https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
  • https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
Protocol
H2
Server
34.238.35.16 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-238-35-16.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-served-by
beacon-n018-ash-prod.krxd.net
date
Tue, 20 Jun 2023 19:58:31 GMT
cache-control
private, no-cache, no-store
x-request-time
D=39 t=1687291111
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
date
Tue, 20 Jun 2023 19:58:31 GMT
x-cache-hits
0
x-age
0
content-length
0
x-cache
MISS
x-served-by
usermatch-a002-ash-prod.krxd.net
usermatch.gif
beacon.krxd.net/
Redirect Chain
  • https://insight.adsrvr.org/track/evnt/?adv=64gxdrp&ct=0:z2z62d3&fmt=3
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
  • https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=krux&ttd_tpi=1&ttd_puid=PoI-Qclx&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
  • https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
0
336 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
Protocol
H2
Server
34.238.35.16 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-238-35-16.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-served-by
beacon-n036-ash-prod.krxd.net
date
Tue, 20 Jun 2023 19:58:32 GMT
cache-control
private, no-cache, no-store
x-request-time
D=22 t=1687291112
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:31 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
227
usermatch.gif
beacon.krxd.net/
Redirect Chain
  • https://insight.adsrvr.org/track/pxl/?adv=64gxdrp&ct=0:1ingnzv&fmt=3
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=120447a6-30d3-414b-b8f9-7a5eddeefdcd&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
  • https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=krux&ttd_tpi=1&ttd_puid=PoI-Qclx&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
  • https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
0
336 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
Protocol
H2
Server
34.238.35.16 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-238-35-16.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-served-by
beacon-n022-ash-prod.krxd.net
date
Tue, 20 Jun 2023 19:58:32 GMT
cache-control
private, no-cache, no-store
x-request-time
D=34 t=1687291112
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:31 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=120447a6-30d3-414b-b8f9-7a5eddeefdcd
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
227
syncframe
gum.criteo.com/ Frame 487E 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:31 GMT
server
Kestrel
server-processing-duration-in-ticks
881215
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
syncframe
gum.criteo.com/ Frame 9EE1 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:30 GMT
server
Kestrel
server-processing-duration-in-ticks
626029
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
vitals
www.foo.software/api/ 		0
95 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.foo.software/api/vitals
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
137.184.240.117 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.25.0 / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:58:31 GMT
server
nginx/1.25.0
x-powered-by
Express
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 20 Jun 2023 19:58:31 GMT
track
dc.services.visualstudio.com/v2/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://dc.services.visualstudio.com/v2/track
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.45.136.42 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,sdk-context
Access-Control-Request-Method
POST
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
access-control-allow-methods
POST
access-control-allow-origin
*
access-control-max-age
3600
content-length
0
date
Tue, 20 Jun 2023 19:58:31 GMT
x-content-type-options
nosniff
track
dc.services.visualstudio.com/v2/ 		98 B
283 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dc.services.visualstudio.com/v2/track
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.45.136.42 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
6cd3cf5f204d9c728f91590d92ce0fd61491617a06a9bbfd9928a6eed3e9088b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
Sdk-Context
appId
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-type
application/json

Response headers

x-ms-session-id
E76B8F4E-7DEE-45C2-BA77-89328AFA1953
strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:58:31 GMT
x-content-type-options
nosniff
access-control-max-age
3600
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Cache-Control, Sdk-Context
content-length
98
98b2a997-ded5-4bcd-9a61-539334cef128
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/98b2a997-ded5-4bcd-9a61-539334cef128
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
b52f1741-a17b-4d2a-b73c-58147f2cda82
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/b52f1741-a17b-4d2a-b73c-58147f2cda82
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
sid
mug.criteo.com/ Frame 9EE1
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=mercurynews.com&sn=ChromeSyncframe&so=3&topUrl=www.mercurynews.com&bundle=1EqRMF9HdTRYOVB6QUF5NmxPZiUyRk1lRXRDcU94Z2Vsc1klMkJBa2pjZWhYdTdE...
  • https://mug.criteo.com/sid?cpp=JJRjK3xsazhSVWE1QjBkSHd6MlZzT0V1d0VMZFNweFc0R2lMMTFvN21Wdm9UVG9pSWVvYWN2cGtleGp3cU9MN1gxTVdsNHI2bXR4TTN0aGZYVzdPbDlsT3JsRUdYdXI1M2JxRkxrYmdtQVF5YUE3VStWWWVIbG5kZVBnMk...
441 B
663 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=JJRjK3xsazhSVWE1QjBkSHd6MlZzT0V1d0VMZFNweFc0R2lMMTFvN21Wdm9UVG9pSWVvYWN2cGtleGp3cU9MN1gxTVdsNHI2bXR4TTN0aGZYVzdPbDlsT3JsRUdYdXI1M2JxRkxrYmdtQVF5YUE3VStWWWVIbG5kZVBnMkY2NVEvUmRJZlorS2NZWGFabEphcGFKK1NoUklwMldRVytvMFA2OFVrOXRhb1QyZ0pSZEZIVXVKc2RMbTJtN0g4TWxpcStjTjN4UmNJdTRpQ00vOWx1V3MxMEVHUVJuN3VQOUJTeGkrb0dUeS82c3BVM1FtSjFkTFdCa1BnUENwUkFHbFVyRXZhSnkvM1pVNXpIc0hJb0k1TWJaRVdTb3FxNUMxbmFIY2FRdVR3cEtSRkJkdz18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e63c46e15e148962820668a59329859371a06429118e264e6d3644904d58a31d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:31 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
875864
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:31 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=JJRjK3xsazhSVWE1QjBkSHd6MlZzT0V1d0VMZFNweFc0R2lMMTFvN21Wdm9UVG9pSWVvYWN2cGtleGp3cU9MN1gxTVdsNHI2bXR4TTN0aGZYVzdPbDlsT3JsRUdYdXI1M2JxRkxrYmdtQVF5YUE3VStWWWVIbG5kZVBnMkY2NVEvUmRJZlorS2NZWGFabEphcGFKK1NoUklwMldRVytvMFA2OFVrOXRhb1QyZ0pSZEZIVXVKc2RMbTJtN0g4TWxpcStjTjN4UmNJdTRpQ00vOWx1V3MxMEVHUVJuN3VQOUJTeGkrb0dUeS82c3BVM1FtSjFkTFdCa1BnUENwUkFHbFVyRXZhSnkvM1pVNXpIc0hJb0k1TWJaRVdTb3FxNUMxbmFIY2FRdVR3cEtSRkJkdz18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
349867
content-length
0
expires
0
sid
mug.criteo.com/ Frame 487E
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=mercurynews.com&sn=ChromeSyncframe&so=3&topUrl=www.mercurynews.com&bundle=1EqRMF9HdTRYOVB6QUF5NmxPZiUyRk1lRXRDcU94Z2Vsc1klMkJBa2pjZWhYdTdE...
  • https://mug.criteo.com/sid?cpp=_rh7W3xuWDBTRHFvWXR0R0NjZysxcUZIeDJtNDRMY1hLeUwvQy9LcHBIWklIdm81Vk1JTEhkbTFPUCtiRU5uRnJVbXZkVkwvTjN6Y3k4ZEFSai93MVFCNXU0Sk9kR3NsOGRnbnFMV1hqTmVSOGovc1Z5S1Y2OUtoSnZWND...
449 B
660 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=_rh7W3xuWDBTRHFvWXR0R0NjZysxcUZIeDJtNDRMY1hLeUwvQy9LcHBIWklIdm81Vk1JTEhkbTFPUCtiRU5uRnJVbXZkVkwvTjN6Y3k4ZEFSai93MVFCNXU0Sk9kR3NsOGRnbnFMV1hqTmVSOGovc1Z5S1Y2OUtoSnZWNDNWSzdKMW9CVFY2dUdubUlHY3VadmQ5bFhOUDB3ejhKOS8xd05Idjh4UEpSNDZ6bmR2MUtRaHdkVEkvSXVIR1NoRHFQTHE2SDE0aUNsUE45WnF5RGcyTkR6cThkZXF5a2dGM2U2aFdFeHl1R280R2NXeS9PUVJpQTVvWVJCM0s4YjN1ZGVSN0NvZkVUenA2ZGt0Y2ZmN3ZJS3ZlK3k3eHNFVUVkN1J6OHRwSDdDZFcxZGtCRT18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
bd8a3e2eebba2e653c520fa58d4190c498feaaf10617786676e2d11dfe90143d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:31 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
5081772
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:31 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=_rh7W3xuWDBTRHFvWXR0R0NjZysxcUZIeDJtNDRMY1hLeUwvQy9LcHBIWklIdm81Vk1JTEhkbTFPUCtiRU5uRnJVbXZkVkwvTjN6Y3k4ZEFSai93MVFCNXU0Sk9kR3NsOGRnbnFMV1hqTmVSOGovc1Z5S1Y2OUtoSnZWNDNWSzdKMW9CVFY2dUdubUlHY3VadmQ5bFhOUDB3ejhKOS8xd05Idjh4UEpSNDZ6bmR2MUtRaHdkVEkvSXVIR1NoRHFQTHE2SDE0aUNsUE45WnF5RGcyTkR6cThkZXF5a2dGM2U2aFdFeHl1R280R2NXeS9PUVJpQTVvWVJCM0s4YjN1ZGVSN0NvZkVUenA2ZGt0Y2ZmN3ZJS3ZlK3k3eHNFVUVkN1J6OHRwSDdDZFcxZGtCRT18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
481106
content-length
0
expires
0
25052057.js
bat.bing.com/p/action/ 		0
119 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/p/action/25052057.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Tue, 20 Jun 2023 19:58:31 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 80DE2DA745044CC4BC0B30948C08D9B1 Ref B: YMQ01EDGE0409 Ref C: 2023-06-20T19:58:31Z
x-cache
CONFIG_NOCACHE
0
bat.bing.com/action/ 		0
362 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=25052057&Ver=2&mid=1ef9df5b-5e7e-43bf-9ea4-a2bcd06b8637&sid=d4eccf800fa411eeae68afe7e22c7ba4&vid=d4edbfb00fa411ee8d087b4035639954&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&p=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&r=&lt=16629&evt=pageLoad&sv=1&rn=14813
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Tue, 20 Jun 2023 19:58:31 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 72B6A452B0604BE8BAEE9EB17006346A Ref B: YMQ01EDGE0409 Ref C: 2023-06-20T19:58:31Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
375497417216748
connect.facebook.net/signals/config/ 		376 KB
107 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/375497417216748?v=2.9.107&r=stable
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
51b9c4f1aa6c3e60906e6dad687a22e11aa9f5e517d748eafcba598b1a683b30
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Tue, 20 Jun 2023 19:58:31 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
109843
x-xss-protection
0
pragma
public
x-fb-debug
SY80up+BAdEK1xkT9UkHrq89m52puQsjW02rgNuHQ3wZAqn1mmDbuSeC0jB94thqqBSvco92gaQJyR+0M+L4qw==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
www.facebook.com/tr/ 		0
185 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=1060502780777063&ev=PageView&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&rl=&if=false&ts=1687291111696&sw=1600&sh=1200&v=2.9.107&r=stable&ec=0&o=30&fbp=fb.1.1687291111691.1514013398&cs_est=true&it=1687291100254&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Tue, 20 Jun 2023 19:58:31 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
/
www.facebook.com/tr/ 		0
31 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=614620065398091&ev=PageView&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&rl=&if=false&ts=1687291111700&sw=1600&sh=1200&v=2.9.107&r=stable&ec=0&o=30&fbp=fb.1.1687291111691.1514013398&it=1687291100254&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Tue, 20 Jun 2023 19:58:31 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
cs.js
sb.scorecardresearch.com/internal-c2/default/
Redirect Chain
  • https://sb.scorecardresearch.com/c2/6035443/cs.js
  • https://sb.scorecardresearch.com/internal-c2/default/cs.js
0
341 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/internal-c2/default/cs.js
Protocol
H2
Server
108.139.47.33 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-47-33.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:51:49 GMT
via
1.1 aa7ca65bca4d95ba9a04dd166671496c.cloudfront.net (CloudFront)
last-modified
Mon, 01 Mar 2021 20:42:20 GMT
server
AmazonS3
x-amz-cf-pop
JFK50-P1
age
403
etag
"d41d8cd98f00b204e9800998ecf8427e"
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-type
application/javascript
accept-ranges
bytes
content-length
0
x-amz-cf-id
Jpffg8RiU4nbZ6xd4LG6VaWTE7-H2ifMujnsc_P8cnFygj6zFz7DZA==

Redirect headers

date
Tue, 20 Jun 2023 19:58:31 GMT
via
1.1 aa7ca65bca4d95ba9a04dd166671496c.cloudfront.net (CloudFront)
accept-ch
UA, Platform, Arch, Model, Mobile
x-amz-cf-pop
JFK50-P1
x-cache
Miss from cloudfront
location
/internal-c2/default/cs.js
content-length
0
x-amz-cf-id
jnw7hRqCPU948lAW4ku8U8hU-jnKVojdGlK7fLEt4icuffwsMhF15w==
SPug
simage4.pubmatic.com/AdServer/ Frame ADB7 		0
48 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=156383&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:30 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
87ed7fb8-2850-447a-b9f5-0a9430fd16ee
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/87ed7fb8-2850-447a-b9f5-0a9430fd16ee
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 8C74 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
57647
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 03:57:44 GMT
expires
Wed, 19 Jun 2024 03:57:44 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame 7CE4 		783 B
534 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
70cc3f4a5c536a962bfd49a892efe43463c0c3491e347f55e232b497e6140126
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-OlVX5oXBMsWmt0_sseqDNA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-length
512
content-security-policy
script-src 'report-sample' 'nonce-OlVX5oXBMsWmt0_sseqDNA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:31 GMT
expires
Tue, 20 Jun 2023 19:58:31 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/747356055/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/747356055/?random=1687291111730&cv=11&fst=1687291111730&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&hn=www.googleadservices.com&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&us_privacy=1---&auid=337517794.1687291097&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
996137f6a3d1b6bb4304905b5e80598bd8549fbeb143f721e38c05ef03fd9f67
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:31 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1435
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/ 		0
31 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=375497417216748&ev=PageView&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&rl=&if=false&ts=1687291111975&sw=1600&sh=1200&v=2.9.107&r=stable&ec=0&o=30&fbp=fb.1.1687291111691.1514013398&cs_est=true&it=1687291100254&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Tue, 20 Jun 2023 19:58:31 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
/
www.facebook.com/tr/ 		0
31 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=375497417216748&ev=ViewContent&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&rl=&if=false&ts=1687291111980&sw=1600&sh=1200&v=2.9.107&r=stable&ec=1&o=30&fbp=fb.1.1687291111691.1514013398&it=1687291100254&coo=false&tm=1&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Tue, 20 Jun 2023 19:58:31 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
sodar
pagead2.googlesyndication.com/pagead/ Frame 7CE4 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202306140101&jk=3467493086232492&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
pagead2.googlesyndication.com/bg/ Frame 8C74 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:35:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
1366
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14698
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:35:46 GMT
/
www.facebook.com/tr/ Frame C041 		0
18 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www.mercurynews.com
Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://www.mercurynews.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:32 GMT
priority
u=0,i
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
/
www.facebook.com/tr/ Frame C820 		0
15 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www.mercurynews.com
Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://www.mercurynews.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:32 GMT
priority
u=0,i
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
generate_204
tpc.googlesyndication.com/ Frame 8C74 		0
10 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?Sl4aSg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:32 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
/
www.facebook.com/tr/ Frame 2678 		0
15 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www.mercurynews.com
Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://www.mercurynews.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:32 GMT
priority
u=0,i
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
/
www.google.com/pagead/1p-user-list/747356055/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/747356055/?random=1687291111730&cv=11&fst=1687287600000&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3180883305&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:32 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.ca/pagead/1p-user-list/747356055/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/pagead/1p-user-list/747356055/?random=1687291111730&cv=11&fst=1687287600000&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3180883305&rmt_tld=1&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:32 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/pagead/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202306140101&jk=3467493086232492&bg=!2dql2o7NAAaGYqkwpmI7ADkAdvg8WnI6THNgAc6nsNtyw0cDtNA0j-beo-rQew9EB-mJxBv14Rd4FR52kbhGnqBahuc0Q5y3H94CAAABCFIAAAAFaAEHCgCEB5AjJyR8hNG7243srTs1nO3fbSWfAlZy6AvOUfdBRaoqtRGcYdqSmqVXE9IQMm_cPg4yUVwOp0sm8HgIfZA0t3epc88ab9QiKJxHNcZnP150bhb8NKOOr_lqH14VWETUqk22qOLYm5Ji4HSDS420wYmW0RDbCu7aOyLElzAgomSyjsKZmQLudwuSE_4XhtPW4dCMA-wWaTyC_sxnYPiiHFyWcWYtzlSF0K9F7Vfnm9LtIhs6lVDL1hNV38SN_lJEHuOt3lEhbsGJ8JC1pQCGCorvKMLVn3u6_NvBE0ZmjMX8aQWg8Kh6Ap8kdNx4va0kPGHkS5d0jkaXJj6LngwQEs8VQ_OjbCnnVqdQJHFtyA7ShoZbRTpLx4ACPwt1fg5WmQIf9ndQtxFk17BMT5gyAMUz3_qgXgEhJUazV3M07-VPoJRgDsmoJ27EvA9Bek90evB2YZvopCEZoUUMaizvAUXBfZjJh9LVLR4wMt7bkLiW-R5pu31VEQDi0rI85-_1qMKC3xlJVt0O1aLNFLMgj5k4XRV88YL_M0NckjO36j_Ef-kTgsjq-QPC8WMpYvz30Tc4-7T8cKaUm7obe5YUZzXXP017wI1kUltA3GyuMijJnPXIzdGc3depeJrP2ROW20l_1KhtOGYjhVEChZyYdVlqK4l5ASqbnItzTIq48Y5fWtMnpk5MOReAB2C0PZ6BOkJftKlIyctpu-KFCPoR-8r_kKxFO6rtWcajz1psWF5lhpKCnNhLMNufVEmkRsuFhJr6eLg7SUZYXQ_HJjtHR2GsW81lu-ymNqpr3GwlBAV3tNoCPH2V-p0WCbhhO6CgQfmbQ_Ms0a61NWiYZDrfdmmS2R6Loh2WNbLclX0jjCido0OdS0wjatsRtcW__8clCd09Z1DBD6rm1ahbq4LrZGaFzeSncqxvfWght-k27dJZ6MMb7PKOg2yhF5qZ_7OhSdux_V0aaCcpzj34g-jajuCskez12ICF_RzDDXPjiQZYtPM3b8NROulh9Oei7vAyONlYTuyvBQF-Mr3BD3a2j3qW3wXcLwSu_ljIIEf1qPA1yHfCPwLs1P9jsWKEozEBtd7blBQ5Tv3stmD2Ex9vjyfD0_OlLzqMQl0XKUCCOZZw1awp03M_xiXpgwt-Cr6HjmEoiBsa8UQz2U00omNeEedyYyaU
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 97F8 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:33 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:58:33 GMT
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 37D1 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:33 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:58:33 GMT
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame BC0F 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:33 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:58:33 GMT
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 8FB1 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:33 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:58:33 GMT
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 2938 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:33 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:58:33 GMT
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 3348 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:33 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:58:33 GMT
syncframe
gum.criteo.com/ Frame 4451 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:33 GMT
server
Kestrel
server-processing-duration-in-ticks
916934
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 97F8 		88 KB
29 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:33 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:58:33 GMT
syncframe
gum.criteo.com/ Frame 781B 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:32 GMT
server
Kestrel
server-processing-duration-in-ticks
589866
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 37D1 		88 KB
29 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:33 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:58:33 GMT
syncframe
gum.criteo.com/ Frame E7D9 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:32 GMT
server
Kestrel
server-processing-duration-in-ticks
1276212
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame BC0F 		88 KB
29 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:33 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:58:33 GMT
syncframe
gum.criteo.com/ Frame C516 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:33 GMT
server
Kestrel
server-processing-duration-in-ticks
1369202
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 8FB1 		88 KB
29 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:33 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:58:33 GMT
syncframe
gum.criteo.com/ Frame ADC6 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:32 GMT
server
Kestrel
server-processing-duration-in-ticks
827073
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 2938 		88 KB
29 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:33 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:58:33 GMT
syncframe
gum.criteo.com/ Frame 46D3 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:58:33 GMT
server
Kestrel
server-processing-duration-in-ticks
1240325
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 3348 		88 KB
29 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:58:33 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:58:33 GMT
sid
mug.criteo.com/ Frame 4451
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0
  • https://mug.criteo.com/sid?cpp=gnbT_3wrTE5RdDNiWS9QVmxoVHBMMnIzQUkwaEtoRGxndzBWUmN6ZTA5SFJNWGZHQkdFZXZCYlNYY2VDMXF2WitOSnZnYmxMYWFXdG1iU1plaHJjVW1yM0trdHI2NnlrMHRzaDFNRzFrV2dCM1N0QTczT0RxYkhBUmtOUW...
433 B
650 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=gnbT_3wrTE5RdDNiWS9QVmxoVHBMMnIzQUkwaEtoRGxndzBWUmN6ZTA5SFJNWGZHQkdFZXZCYlNYY2VDMXF2WitOSnZnYmxMYWFXdG1iU1plaHJjVW1yM0trdHI2NnlrMHRzaDFNRzFrV2dCM1N0QTczT0RxYkhBUmtOUWJoOVd1QzlzckR1RDdCUjBudXNNTjJ0V3dmU090cmM2Z2U4dVdNQ1k1VHo1cnRrck5oSXNLd1ZTNjV4Y0Z1cFlGamdCd090VzdDbWRGcUNKOXVXakZiVks4N2kyeElycXU5R1cyQjZYTzlITExJRVZVUXFSME93Zm5Sc3RuTHAwV05mdG95Y3RVR0dTVjkyYm1GVWQ1RHlRZE0yVndOdjd3dXZVNWxGVVNxaU5helNidktRaz18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
a25889f5ebf9993b4156b809205958474ddd82c1b22fb2bee11725e50b9475db
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:33 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
1752451
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:32 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=gnbT_3wrTE5RdDNiWS9QVmxoVHBMMnIzQUkwaEtoRGxndzBWUmN6ZTA5SFJNWGZHQkdFZXZCYlNYY2VDMXF2WitOSnZnYmxMYWFXdG1iU1plaHJjVW1yM0trdHI2NnlrMHRzaDFNRzFrV2dCM1N0QTczT0RxYkhBUmtOUWJoOVd1QzlzckR1RDdCUjBudXNNTjJ0V3dmU090cmM2Z2U4dVdNQ1k1VHo1cnRrck5oSXNLd1ZTNjV4Y0Z1cFlGamdCd090VzdDbWRGcUNKOXVXakZiVks4N2kyeElycXU5R1cyQjZYTzlITExJRVZVUXFSME93Zm5Sc3RuTHAwV05mdG95Y3RVR0dTVjkyYm1GVWQ1RHlRZE0yVndOdjd3dXZVNWxGVVNxaU5helNidktRaz18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
428371
content-length
0
expires
0
sid
mug.criteo.com/ Frame 781B
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0
  • https://mug.criteo.com/sid?cpp=SKORIHxQcG50eUZ1eUdzYktJcndjc0ZoWVR5NlUxQlJRU0Nod2hZTEFjcTNLTk14OWZ4MndmUFlKZXJUTU5tVCsyRVJmM2pWRVpLZHowazFJZWdrOUpUbDZsaVA0RGpITm1FRGlvQVZac28wVU16ZUw4MENJNEN6dzY1dE...
433 B
655 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=SKORIHxQcG50eUZ1eUdzYktJcndjc0ZoWVR5NlUxQlJRU0Nod2hZTEFjcTNLTk14OWZ4MndmUFlKZXJUTU5tVCsyRVJmM2pWRVpLZHowazFJZWdrOUpUbDZsaVA0RGpITm1FRGlvQVZac28wVU16ZUw4MENJNEN6dzY1dEx6NHI1MlN2eFB1c1kxU3dhMUJrV0V0ZURpSXVEVEpRNmhGWksvVkFTR3FTWnBpSzlkQS9ZT2JkMlZSb2xuRmU2OExyRjdtSWcxWk5uWXNoRVBoa2FBVUtCOUI0UVhRMUNnRnNGN2FkdStVamhzNU9pdytRYS9sSEFHTG0xZHhTdTVBTHFaUndvZmtBbXFJdVlGMmhDUWRSN0dXSFNuOTRPV0NaSis1NlNld1pLWWpEbzdKRT18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
45e53ed5d46fbbcb28c453cc49979df05b44a1ac9667138083ce59e2c3c266eb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:33 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
1280886
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:33 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=SKORIHxQcG50eUZ1eUdzYktJcndjc0ZoWVR5NlUxQlJRU0Nod2hZTEFjcTNLTk14OWZ4MndmUFlKZXJUTU5tVCsyRVJmM2pWRVpLZHowazFJZWdrOUpUbDZsaVA0RGpITm1FRGlvQVZac28wVU16ZUw4MENJNEN6dzY1dEx6NHI1MlN2eFB1c1kxU3dhMUJrV0V0ZURpSXVEVEpRNmhGWksvVkFTR3FTWnBpSzlkQS9ZT2JkMlZSb2xuRmU2OExyRjdtSWcxWk5uWXNoRVBoa2FBVUtCOUI0UVhRMUNnRnNGN2FkdStVamhzNU9pdytRYS9sSEFHTG0xZHhTdTVBTHFaUndvZmtBbXFJdVlGMmhDUWRSN0dXSFNuOTRPV0NaSis1NlNld1pLWWpEbzdKRT18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
304814
content-length
0
expires
0
sid
mug.criteo.com/ Frame E7D9
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0
  • https://mug.criteo.com/sid?cpp=pY8OAnxwR2dvRGxsRjJ3TXhwZWMxdkNPN2NPbGFkbk13Q1VQN3F2OE5aWnlyUnp6dTRxWFRzMHBFOEFNWWc5eE1TNFlhUWhvaDB0R0RWNjhKZHo4OW1JeVoyMEZIQWV4MjZxUjU5Yk9CV09yNXVSY1Q0SDgrOHg5MkJvQV...
444 B
658 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=pY8OAnxwR2dvRGxsRjJ3TXhwZWMxdkNPN2NPbGFkbk13Q1VQN3F2OE5aWnlyUnp6dTRxWFRzMHBFOEFNWWc5eE1TNFlhUWhvaDB0R0RWNjhKZHo4OW1JeVoyMEZIQWV4MjZxUjU5Yk9CV09yNXVSY1Q0SDgrOHg5MkJvQVFmSDhsTGNqN3ljQkdtSlF2Y3RGby9XL2pEMkR1TE5paHpubU5uenZneGZQeWVhZGhBZkt0RGRoVkhYKytEeHFENTBOZkdmQ05PWFFPaUhhUmRSVnF4bU5ObXBvaTZpNHFqSGtaZ2NYQ0VURzBaSlNWZ0VVWlZHZjA1T1ZaOEJjZTZ3eWFzallGcmREYjA3bW1sNTNmUkNLckVGZEhnd3h5NWM3RVBKSmNlTHdXMUlhcks2Yz18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
171ee6dba493728652f0f32fbf589b262e653211a5c1b5a32337d0ee73c1db51
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:33 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
750369
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:32 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=pY8OAnxwR2dvRGxsRjJ3TXhwZWMxdkNPN2NPbGFkbk13Q1VQN3F2OE5aWnlyUnp6dTRxWFRzMHBFOEFNWWc5eE1TNFlhUWhvaDB0R0RWNjhKZHo4OW1JeVoyMEZIQWV4MjZxUjU5Yk9CV09yNXVSY1Q0SDgrOHg5MkJvQVFmSDhsTGNqN3ljQkdtSlF2Y3RGby9XL2pEMkR1TE5paHpubU5uenZneGZQeWVhZGhBZkt0RGRoVkhYKytEeHFENTBOZkdmQ05PWFFPaUhhUmRSVnF4bU5ObXBvaTZpNHFqSGtaZ2NYQ0VURzBaSlNWZ0VVWlZHZjA1T1ZaOEJjZTZ3eWFzallGcmREYjA3bW1sNTNmUkNLckVGZEhnd3h5NWM3RVBKSmNlTHdXMUlhcks2Yz18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
481263
content-length
0
expires
0
sid
mug.criteo.com/ Frame C516
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0
  • https://mug.criteo.com/sid?cpp=E_9HbnxRWlRoMFk0ZTJGN3h4ZkhyR0J6dms1Q2VLYjdaeEdNZWxSQ3lJTVZ0OXZuSlZ4UzhOQllDQk5ObVFZRktxbm9BMkJEZjYxRVk3MFVkTWt5SUpaMElFNTZQbFk0QXY1WHJ3TlFOWmp4SUtra3Q5NlVPNUptdEtuRW...
444 B
658 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=E_9HbnxRWlRoMFk0ZTJGN3h4ZkhyR0J6dms1Q2VLYjdaeEdNZWxSQ3lJTVZ0OXZuSlZ4UzhOQllDQk5ObVFZRktxbm9BMkJEZjYxRVk3MFVkTWt5SUpaMElFNTZQbFk0QXY1WHJ3TlFOWmp4SUtra3Q5NlVPNUptdEtuRWlQWnhpSnk3ZE9wcmNDNzhPNU9ONngyNUllVmdHd2pnc0VUTVE5Z2tNdXlHblpFRTB0d0NhdnVqWnp5UzRlL2VaN2tJSWlLYjdBRWJCUm1TdlE2ck42VXkxdHFNRWN6Sk9WRS9hM0VmdGNEa1BmN2dhSytkbnk3UUZRSEV4NHora0lDS3dEc0NjVlowSTVheDZJRmF5QW5pNUV5TmV2TVVHS1lSYzFGMEVMODY1aSs2OHZxQT18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
cd26f237e390f167f6865ad683caed6c706218559452d463647e95a00f2f3f0c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:33 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
902454
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:33 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=E_9HbnxRWlRoMFk0ZTJGN3h4ZkhyR0J6dms1Q2VLYjdaeEdNZWxSQ3lJTVZ0OXZuSlZ4UzhOQllDQk5ObVFZRktxbm9BMkJEZjYxRVk3MFVkTWt5SUpaMElFNTZQbFk0QXY1WHJ3TlFOWmp4SUtra3Q5NlVPNUptdEtuRWlQWnhpSnk3ZE9wcmNDNzhPNU9ONngyNUllVmdHd2pnc0VUTVE5Z2tNdXlHblpFRTB0d0NhdnVqWnp5UzRlL2VaN2tJSWlLYjdBRWJCUm1TdlE2ck42VXkxdHFNRWN6Sk9WRS9hM0VmdGNEa1BmN2dhSytkbnk3UUZRSEV4NHora0lDS3dEc0NjVlowSTVheDZJRmF5QW5pNUV5TmV2TVVHS1lSYzFGMEVMODY1aSs2OHZxQT18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
241963
content-length
0
expires
0
sid
mug.criteo.com/ Frame ADC6
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0
  • https://mug.criteo.com/sid?cpp=bmu-8XxXQWtVQWdnaEJKbHdsVFNiRitSRURzR3o2blJlT08xR1pQeXBtbFpSeEVXMERTWjBqZUZxRk9zdmlUQ2ZsUU9VMDAzb2hUbVFHSnF2WE5iNVhYMEJ5YlA3bklSakU2bGl2cTYxMVdNMGE0WU5qTFhYeTdFWnkwK2...
428 B
655 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=bmu-8XxXQWtVQWdnaEJKbHdsVFNiRitSRURzR3o2blJlT08xR1pQeXBtbFpSeEVXMERTWjBqZUZxRk9zdmlUQ2ZsUU9VMDAzb2hUbVFHSnF2WE5iNVhYMEJ5YlA3bklSakU2bGl2cTYxMVdNMGE0WU5qTFhYeTdFWnkwK2tPQ1VHcEd3UHNCMERKWWVaUWFhb1BpdjBHcStZMCtnSU5heDFzSU9QOEZWVWFLaHR5NCs2WDF0a3NsWWFZT0hnNExlZjVCUjR3L0FOOVdoRW1jOFJGQ3lWWldZU29ieGpEazRmTDJzUVZHa0lhanFCTVNQcW9KVHlqazhPbTNHd2w2eStsVExxOWRZZ3g5dndZQWw1VTVvUmloWlJURlVicm5CQTNTSnkwTXpUbnMzOEFvWT18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
342034f6a3303f4b800f89c04288036943a4b93226edb5741652ebd43af899d9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:33 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
5231443
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:33 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=bmu-8XxXQWtVQWdnaEJKbHdsVFNiRitSRURzR3o2blJlT08xR1pQeXBtbFpSeEVXMERTWjBqZUZxRk9zdmlUQ2ZsUU9VMDAzb2hUbVFHSnF2WE5iNVhYMEJ5YlA3bklSakU2bGl2cTYxMVdNMGE0WU5qTFhYeTdFWnkwK2tPQ1VHcEd3UHNCMERKWWVaUWFhb1BpdjBHcStZMCtnSU5heDFzSU9QOEZWVWFLaHR5NCs2WDF0a3NsWWFZT0hnNExlZjVCUjR3L0FOOVdoRW1jOFJGQ3lWWldZU29ieGpEazRmTDJzUVZHa0lhanFCTVNQcW9KVHlqazhPbTNHd2w2eStsVExxOWRZZ3g5dndZQWw1VTVvUmloWlJURlVicm5CQTNTSnkwTXpUbnMzOEFvWT18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
214570
content-length
0
expires
0
sid
mug.criteo.com/ Frame 46D3
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0
  • https://mug.criteo.com/sid?cpp=WHQkanw4d3UwVnUzWUs3bmI4eWJiMTU4eCsvS25vTU5NNk1NbVliK09qNDQwY1BpY1JSWkRSQU92aWl1UVM4bXB2ZUZ4YmdWTmtSb050YzdKVHA3VS9oc2dFUzdKK3RNbmFqZkgzZ2FCaG0vNzBRL2JOMldsRklmbDUrdm...
430 B
654 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=WHQkanw4d3UwVnUzWUs3bmI4eWJiMTU4eCsvS25vTU5NNk1NbVliK09qNDQwY1BpY1JSWkRSQU92aWl1UVM4bXB2ZUZ4YmdWTmtSb050YzdKVHA3VS9oc2dFUzdKK3RNbmFqZkgzZ2FCaG0vNzBRL2JOMldsRklmbDUrdm5KY2JTUEUzakZTcmlqcDlHL3g3WHdad3N2aTRMSGJrRHZTM2lFbng5ZDNicUZhbENoSDk2dEtOVE5SdFk4ZzFwaVlsS2w2aFdyc1pBYUxmWmpYeWp5K003NHVrS1lZQlZDQ09EQnQ3K1p0REJpSnBVaTkxSndlVTJrSkhDcFF0QmQwS1hwRmdjaURJRVE4WGYwTFRMdUZxVnlmU3hYdkdyaDNRRUFFVzZsMmRMZ2ZrTDVLdz18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
d4d780ac217b03cad2bf9c36c3d7ee304daf770314e7b04b960be07eab27ee20
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:33 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
4446359
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:58:33 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=WHQkanw4d3UwVnUzWUs3bmI4eWJiMTU4eCsvS25vTU5NNk1NbVliK09qNDQwY1BpY1JSWkRSQU92aWl1UVM4bXB2ZUZ4YmdWTmtSb050YzdKVHA3VS9oc2dFUzdKK3RNbmFqZkgzZ2FCaG0vNzBRL2JOMldsRklmbDUrdm5KY2JTUEUzakZTcmlqcDlHL3g3WHdad3N2aTRMSGJrRHZTM2lFbng5ZDNicUZhbENoSDk2dEtOVE5SdFk4ZzFwaVlsS2w2aFdyc1pBYUxmWmpYeWp5K003NHVrS1lZQlZDQ09EQnQ3K1p0REJpSnBVaTkxSndlVTJrSkhDcFF0QmQwS1hwRmdjaURJRVE4WGYwTFRMdUZxVnlmU3hYdkdyaDNRRUFFVzZsMmRMZ2ZrTDVLdz18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
294983
content-length
0
expires
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6MzAweDUw&v=5&s=v31h3d65um3&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3Nwb25zb3JzaGlwXzEiLCJ5IjowLCJjbyI6MCwicyI6Imh0bGFkLTEtZ3B0In19&cb=999484&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZNekF3ZURVdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiIzMDAiLCJoIjoiNTAifSwid3IiOjJ9
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6OTcweDI1MA==&v=5&s=v31h3d65upa&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3RvcF9sZWFkZXJib2FyZCIsInkiOjAsImNvIjowLCJzIjoiaHRsYWQtMy1ncHQifX0%3D&cb=4700934&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZPVGN3ZURJMU1BPT0iLCJ3ZCI6eyJvIjoyNTI4NjM2ODc2LCJ3IjoiOTcwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0=
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6MzAweDUw&v=5&s=v31h3d6608q&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3Nwb25zb3JzaGlwXzEiLCJ5IjowLCJjbyI6MCwicyI6Imh0bGFkLTEtZ3B0In19&cb=4688198&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZNekF3ZURVdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiIzMDAiLCJoIjoiNTAifSwid3IiOjJ9
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6OTcweDkw&v=5&s=v31h3d660ht&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3RvcF9sZWFkZXJib2FyZCIsInkiOjAsImNvIjowLCJzIjoiaHRsYWQtMy1ncHQifX0%3D&cb=1660940&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZPVGN3ZURrdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiI5NzAiLCJoIjoiOTAifSwid3IiOjJ9
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6MzIweDUw&v=5&s=v31h3d661bp&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3Nwb25zb3JzaGlwXzEiLCJ5IjowLCJjbyI6MCwicyI6Imh0bGFkLTEtZ3B0In19&cb=239829&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZNekl3ZURVdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiIzMjAiLCJoIjoiNTAifSwid3IiOjJ9
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6NzI4eDkw&v=5&s=v31h3d661o0&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3RvcF9sZWFkZXJib2FyZCIsInkiOjAsImNvIjowLCJzIjoiaHRsYWQtMy1ncHQifX0%3D&cb=6584478&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZOekk0ZURrdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiI3MjgiLCJoIjoiOTAifSwid3IiOjJ9
Domain
cdn.8proof.com
URL
https://cdn.8proof.com/ads/assets/fonts/montserrat-v25-latin-800.woff2
Domain
cdn.8proof.com
URL
https://cdn.8proof.com/ads/assets/fonts/montserrat-v25-latin-600.woff2
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6MzAweDUw&v=5&s=v31h3d663qi&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3Nwb25zb3JzaGlwXzEiLCJ5IjowLCJjbyI6MCwicyI6Imh0bGFkLTEtZ3B0In19&cb=5599144&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZNekF3ZURVdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiIzMDAiLCJoIjoiNTAifSwid3IiOjJ9
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6NzI4eDkw&v=5&s=v31h3d6644e&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3RvcF9sZWFkZXJib2FyZCIsInkiOjAsImNvIjowLCJzIjoiaHRsYWQtMy1ncHQifX0%3D&cb=7765793&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZOekk0ZURrdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiI3MjgiLCJoIjoiOTAifSwid3IiOjJ9
Domain
id5-sync.com
URL
https://id5-sync.com/k/155.gif?id5AccountNum=155&numCascadesAllowed=9&puid=AAEJeE7JJAoAACD7r3WP1g

Verdicts & Comments Add Verdict or Comment

403 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| 16 object| 17 object| 18 object| 19 object| 20 object| 21 object| 22 object| 23 object| 24 object| 25 object| 26 object| 27 boolean| credentialless object| onbeforetoggle object| onscrollend object| scriptHelpers function| loadCSS object| _wpemojiSettings object| twemoji object| wp object| htlbid object| MNG_SSO_CONNEXT_EVENT_TIMING_ANALYTICS number| MNG_SSO_TOOLS_GLOBAL_START_TIME function| $ function| jQuery object| MG2 function| PluginInitOverride object| MG2Loader string| loaderVersion string| loaderBuild object| appInsights object| deferredResources function| blmGetIcon object| google function| reactiveElementPolyfillSupport object| reactiveElementVersions object| module$contents$mapsapi$overlay$overlayView_OverlayView function| createAuth0Client function| Auth0Client object| default_gsi object| authentication_config object| entitlements_config object| regeneratorRuntime function| simpleEmailValidation function| validatePhoneNumber object| MNGAuthentication boolean| disableAuth0AuthFlow function| backToStory object| PushlySDK object| dfm_pushly_options object| blueConicPreListeners function| BCClass object| blueConicClient function| Osano function| __gpp function| __tcfapi function| __uspapi function| mg2WidgetAPI object| DFM_AD_MODS_LEVEL object| DFM_AD_MODS_DEBUG object| article_config object| _taboola function| analyticsEvent function| analyticsSocial function| analyticsVPV function| analyticsClearVPV function| analyticsForm object| dataLayer function| closeMobileAdhesionAd function| keyboardHandler object| bloom_meta string| bloom_domain function| blmInit function| blmKeyUp function| blmTrigger function| blmMapLaunch function| blmMapClose function| blmGetMetadata object| bloom_nns boolean| bloom_nns_cookies_enabled object| bloom_nns_remote number| bloom_nns_remote_delay number| bloom_nns_iv_pulse boolean| bloom_amp function| blmSearchInit function| blmSearchLoad function| blmSearchLaunch function| blmSearchInitWindow function| blmSearchIconAction function| blmSearchKeyUp function| blmSearchOpen function| blmSearchClose function| blmSearchGeolocation function| blmSearchGeolocationResponse function| blmSearchLoadRemoteContent function| blmSearchSetLayout function| blmSearchGetLayout function| blmSearchUrlRequest function| blmSearchUrlParamParse function| blmSearchUrlParamModify function| blmSearchSupports function| blmSearchGetUserDistance function| blmSearchSetCookie function| blmSearchGetCookie function| blmSearchDeleteCookie object| runtime object| picturefillCFG function| picturefill object| lazySizesConfig object| lazySizes function| setImmediate function| clearImmediate object| wpParselyHooks object| PARSELY function| _typeof object| google_tag_manager object| google_tag_data object| bc_json355 object| bc_json356 object| AI object| Microsoft function| __extends function| _endsWith object| __G_ID_CLIENT__ object| closure_lm_913329 object| TRC object| _tblConsole string| pm_pgtp undefined| msg object| _comscore boolean| htlbidLoaded object| pbjsChunk object| pbjs object| _pbjsGlobals function| HTLBIDLoader object| googletag object| apstag boolean| dfmCanRunAds object| webpackChunkknowlton function| Headroom function| Hammer string| GoogleAnalyticsObject function| ga string| comscoreID object| _qevents string| ssaUrl object| dfm_viafoura_options object| vfQ object| _stq object| webVitals object| litHtmlVersions object| ggeac object| google_js_reporting_queue function| st_go function| linktracker_init object| wpcom object| bloom_nns_el_button_current object| bloom_nns_el_button_current_label object| bloom_nns_el_header object| bloom_nns_el_header_title object| bloom_nns_el_header_landscape object| bloom_nns_el_header_landscape_balls object| bloom_nns_el_header_landscape_ball object| bloom_nns_el_content object| bloom_nns_el_content_local object| bloom_nns_el_content_local_banner object| bloom_nns_el_content_local_banner_text object| bloom_nns_el_content_local_banner_close object| bloom_nns_el_content_remote object| bloom_nns_el_content_local_intro object| bloom_nns_el_content_local_intro_title object| bloom_nns_el_content_local_intro_options object| bloom_nns_el_content_local_intro_options_button object| bloom_nns_el_content_local_intro_options_search object| bloom_nns_el_content_local_intro_options_search_input object| bloom_nns_el_content_local_intro_options_search_button object| bloom_nns_el_footer object| bloom_nns_el_footer_attribution object| bloom_nns_el_footer_arrow object| bloom_nns_el_footer_arrow_inner object| _rmxd function| quantserve function| __qc object| ezt object| _qoptions function| __trcCopyProps function| __trcFromError function| __trcClientTimestamp function| __trcLog function| __trcError function| __trcDebug function| __trcInfo function| __trcWarn function| __trcWarnUsingBeacon function| __trcDOMWalker function| __trcJSONify function| __trcUnJSONify function| __trcTrim function| __trcGetElementsByClass function| __trcToArray function| __trcObjectCreate function| PageManager function| addHashParam number| trc_debug_level string| trc_article_id object| TRCImpl object| _aps boolean| apstagLOADED object| confiant object| launchPad object| launchPadConfiguration object| node function| __launchpad function| gtag object| GooglebQhCsO object| LoaderConfig object| vfConfig undefined| google_measure_js_timing object| Criteo object| apscustom boolean| htlbidStarted boolean| _tb_dis string| pm_ppy string| _pmep string| _pmep_geo string| _pmpmk boolean| _pmasync boolean| _pmoptimization boolean| _pmoptimizationmanipulation boolean| _pmhp boolean| _pmsb object| pmk object| pmglb object| pmfa object| pmad object| pmdebug_c object| _pmenv object| _pma undefined| _tb_d undefined| _tb_rand object| _pm_ecd function| _pmloadfile function| pmws_request_done function| _tb_getUrlParameter function| InteractionTypeImpl number| taboola_view_id boolean| creativeVendorLibraryLoaded object| gaplugins object| gaGlobal object| gaData string| fpVersion string| fpBuild object| DeviceDetector object| Fingerprint object| g2ExtendInits object| G2Analytics object| G2Insights object| MG2Insights function| onYouTubeIframeAPIReady object| nxtBundle object| webpackJsonpnxtBundle object| NxtInner object| Connext object| CnnXt function| processGoogleToken object| googleToken object| googleIMState number| google_unique_id object| MG2DL function| bt_eval function| bt_parameter function| bt_meta function| bt_cookie function| bt_data function| bt_log function| bt_handle_exception undefined| _bt_url_prefix undefined| _bt_referrer undefined| _bt_site undefined| _bt_mode function| btServe function| bt_data_escaped object| BrightTag object| __uid2SecureSignalProvider object| __uid2 object| _mather object| _mg2q object| _matherq object| tid object| criteo_pubtag object| criteo_identitytag_137 object| Criteo_identitytag_137 object| LI object| __li__evt_bus object| liQ object| liQ_instances undefined| nQuery number| ntvLoadStart object| ntv object| prdom object| onFocusEvents function| ntvjQueryInit function| ntvExtends function| ntvAppendStylesheet function| ntvAppendScript function| ntvGetElementViewability function| ntvArticleTracker function| ntvViewableImpressionTracker object| PostRelease object| ntvToutAds boolean| onFocus function| TBVideoElem function| TBVideoEvents function| TBOptimizationAutoPlayInfoFromXPathAndURL object| _pmk function| TBWidgetVideoPlayer function| TBGenericVideoModule function| TBOtherPlayer function| TBVideoMetaData function| TBVideo function| TBVideoDetectionYoutubeAPI function| TBOptimizationTouchAndClickEventTracker function| TBWidgetStorage object| PMFileLoader object| PMPage object| PMTemplate function| PMTracking function| PMUniversalGA function| PMMdotLabs function| PMComScore function| PMPublisher function| TBOptimization function| PMGlobal function| pmws_getlocation_done object| pmdebug object| pmws object| ji object| _pm_mcg object| COMSCORE object| ns_p object| _bcp object| Mustache function| BlueConicMetaDataService function| RuleService object| bc object| justDetectAdblock function| jwt_decode function| BlueConicEngagement object| bcConnectionUtil function| BlueConicDataLayerUtility function| md5 function| fbq function| _fbq string| nam object| placementData function| confiantDfpWrap function| _____WB$wombat$assign$function_____ function| __WB_pmw object| gPartners object| confiantRefreshSlots object| confiantRefreshSlotsDebug object| criteo_syncframe_state object| bc_json357 object| cmTag function| UET function| UET_init function| UET_push object| _cm_wfCounters object| bc_json358 function| _typeof2 function| __liSync object| bc_json359 object| adpnExecutions object| aliveChecks boolean| adpnLoaded number| lnt_z function| _createForOfIteratorHelper function| _unsupportedIterableToArray function| _arrayLikeToArray object| criteo_pubtag_prebid_135 object| Criteo_prebid_135 object| uetq object| GoogleGcLKhOms object| tbopt object| ueto_62565553ed function| CallTrkSwap function| CallTrk

317 Cookies

Domain/Path Name / Value
www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/ Name: bloom_page_location_address
Value:
www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/ Name: bloom_page_location_latlon
Value: ,
.taboola.com/medianewsgroup-mercurynews/ Name: taboola_session_id
Value: v2_4e2b613193d39d9d4e8bc370cab467bb_cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59_1687291097_1687291097_CNawjgYQtdRXGPPii9ONMSABKAEwJjiJ6AdA6vUHSKfL2QNQ____________AVgAYABosrWxmb6uzo3eAXAB
a869.mercurynews.com/DG/DEFAULT Name: BCSessionID
Value: a1e1be2f-9252-4dd3-870b-4b39b351cd8a
digitalfirstmedia.blueconic.net/DG/DEFAULT Name: BCSessionID
Value: a1e1be2f-9252-4dd3-870b-4b39b351cd8a
.3lift.com/sync Name: sync
Value: CgkIOhDR_4vTjTE=
i6.liadm.com/s Name: _li_ss
Value: CgA
i.liadm.com/s Name: _li_ss
Value: Ck8KBQgKEKwVCgYI3QEQrhUKBQgGEKwVCgYIgQEQrBUKBQgMELYVCgYIogEQrBUKCQj_____BxC2FQoFCAsQrBUKBgiLARCsFQoGCNIBEKwV
.mercurynews.com/ Name: bc_tstgrp
Value: 2
.mercurynews.com/ Name: _pnvl
Value: false
.mercurynews.com/ Name: pushly.user_puuid
Value: xV1xyxR1LjN5s5oRuRV4B0tPUEkgjEa6
.mercurynews.com/ Name: _parsely_session
Value: {%22sid%22:1%2C%22surl%22:%22https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/%22%2C%22sref%22:%22%22%2C%22sts%22:1687291096167%2C%22slts%22:0}
.mercurynews.com/ Name: _parsely_visitor
Value: {%22id%22:%22pid=ddb44230e1c8b1f4357047be7ad79b7d%22%2C%22session_count%22:1%2C%22last_session_ts%22:1687291096167}
www.mercurynews.com/ Name: ai_user
Value: UE8rq|2023-06-20T19:58:16.261Z
.sitescout.com/ Name: ssi
Value: 3e748400-cbec-4516-882b-2bc03b4113d3#1687291096650
.scorecardresearch.com/ Name: UID
Value: 1EEb980f1aba70071bd94371687291096
.viafoura.co/ Name: VfSess
Value: 3pppgvc34nf7eiskc00973k9ua
.viafoura.co/ Name: vfThirdpartyCookiesEnabled
Value: true
.mercurynews.com/ Name: _gcl_au
Value: 1.1.337517794.1687291097
.tapad.com/ Name: TapAd_TS
Value: 1687291097169
.tapad.com/ Name: TapAd_DID
Value: c696eff3-e87b-4a1e-ba21-beda78dea841
www.mercurynews.com/ Name: _vfa
Value: www%2Emercurynews%2Ecom.00000000-0000-4000-8000-c86bf0725f23.50b6f4f5-c151-4f14-97e0-af9264313a9a.1687291097.1687291097.1687291097.2
www.mercurynews.com/ Name: _vfz
Value: www%2Emercurynews%2Ecom.00000000-0000-4000-8000-c86bf0725f23.1687291097.2.medium=direct|source=|sharer_uuid=|terms=
.exelator.com/ Name: EE
Value: "ca4dbc495a1a8b68c16e28fe92cf3b1b"
.teads.tv/ Name: tt_viewer
Value: b8ab3f84-9cf6-4754-81d3-8059193a804f
.viafoura.co/ Name: vfDeviceId
Value: 0ed9ccbf-46a0-455d-86ae-732db4b0c01e
.exelator.com/ Name: ud
Value: "eJxrXxzq6XKLQSE50SQlKdnE0jTRMNEiycwi2dAs1cgiLdXSKDnNOMkwaXFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDQZEl%252BUWb6ImfHxUUpaQyLSopPBR%252FJNQQA43Yqrg%253D%253D"
.mercurynews.com/ Name: osano_consentmanager_uuid
Value: 2e2263f5-683c-4e40-bcdb-a7b72ad66c72
.mercurynews.com/ Name: osano_consentmanager
Value: AkxIJRsqAucLbZoOw_fJZ0-MqPBxo_GyEDlOkNhrO6X8QnSweKY5s9_l-1ve3DbDlzKyjfAD5bjuahsCKuAYhnzELprfd10ypJ10EBe86SPLtE8XxIEoLlNcMZpoFkwZJWkZPU7HJajLX0mdmIxthJROePuuEf2SkwDPUWibTB5G-y2GdCzOJn4cTNldshtueBKB4TCYJDgsXRkbXGSRrwoRtNSR5kc2Z8XhHJyn3x1Ymxv2PAqsgFECKSBcG3gj_OcAv30i9pLMrBOJVEryNcz3aE6i7jERCl5ntHuOt56JruVcENFbVc3HZQ-QWixTG9VI22uITbzenHQLkmdogPU9ZFCV_bpdXG94pHXOkIblfwNhgiQz_JgX80CcCdhuI24UTB7OJdsyA6u-VdYJzgogovdi-W4tObsfwFjuQExAmlTXebmY7XfQzbgPlZtYFdbHD5VI7iTi775OhrSePdS7DJKVOwB0nl3OutkyLOHTj_T-HegupJvujHDpswF4sERGqACLLyt6qAouhftoA6US2PtXwxuy_nCRDvdsypbEK3wchdoDWgGqxAnLv67MI-chjjn0kywnM6IsKqvZCMRTf6BrSmSfuI3kFaLuvIuLn1VWPFVTqVj2JFK1MwD5k9KcFpZ_E3aYYFYzCbwruqz1X3sBcJFy5VWN2_3afml3czG10T2kRl0KmFbmdvbln-WaU9jxyrpuzHjXEAmrRp9FXMR9EHKyTJ8HmXC7GA941vdeiwW0zP6wqgt3Mrh4RIwmvH_wCJQlWMgi3fS5JG93NUxZCsBn
www.mercurynews.com/ Name: _vfb
Value: www%2Emercurynews%2Ecom.00000000-0000-4000-8000-c86bf0725f23.1.10.1687291097....
.demdex.net/ Name: demdex
Value: 56989525436708481334107962681470171677
.adnxs.com/ Name: uuid2
Value: 3958812064475458525
.mercurynews.com/ Name: _gid
Value: GA1.2.2078750920.1687291098
.dpm.demdex.net/ Name: dpm
Value: 56989525436708481334107962681470171677
.rubiconproject.com/ Name: khaos
Value: LJ4PJZ48-27-1JKH
.quantserve.com/ Name: mc
Value: 649204d9-de306-7bdd2-be891
.mercurynews.com/ Name: nxt_last_visit
Value: 1687291098063
.mercurynews.com/ Name: _ml_ses
Value: *
.mercurynews.com/ Name: _matheriSegs
Value: MATHER_U9_INSTANTB_20200203
.mercurynews.com/ Name: _matherSegments
Value: MATHER_U9_INSTANTB_20200203
.taboola.com/ Name: t_gid
Value: cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59
.mercurynews.com/ Name: _li_dcdm_c
Value: .mercurynews.com
.mercurynews.com/ Name: _lc2_fpi
Value: f107d3ac6b63--01h3d65x5a82x2dqp0kjyedmwh
www.mercurynews.com/ Name: ntv_as_us_privacy
Value: 1---
.postrelease.com/ Name: visitor
Value: 78fc1699-f3aa-4bd8-8b36-e847342a78cb
.postrelease.com/ Name: status
Value: 0
.amazon-adsystem.com/ Name: ad-id
Value: AwM33jfOXkO2qkplvxX2VZw
.amazon-adsystem.com/ Name: ad-privacy
Value: 0
.doubleclick.net/ Name: IDE
Value: AHWqTUl4BMoeqOrjvX0rkmyE5CJlywhVV7s38xL5793Xg5EGpwxMcv7ZaIGd6p5tRlY
www.mercurynews.com/ Name: trc_cookie_storage
Value: taboola%2520global%253Auser-id%3Dcd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59
.mercurynews.com/ Name: __qca
Value: P0-2117583683-1687291096997
.mercurynews.com/ Name: __gads
Value: ID=66c307501df181c9:T=1687291098:RT=1687291098:S=ALNI_MYS3ohfCtceNj71Z5MuHLNX5CSDAg
.mercurynews.com/ Name: __gpi
Value: UID=00000c52becd70b0:T=1687291098:RT=1687291098:S=ALNI_MYOkaUD_dpLztX6KsaO9yHoBXDPyw
.liadm.com/ Name: lidid
Value: 5837ff19-efdc-41d5-968d-152ebd725d6e
.mercurynews.com/ Name: _ga_LMTT1ZNHB1
Value: GS1.1.1687291097.1.0.1687291099.0.0.0
www.mercurynews.com/ Name: BCSessionID
Value: a1e1be2f-9252-4dd3-870b-4b39b351cd8a
www.mercurynews.com/ Name: ntvSession
Value: {"id":1332120,"placementID":1028524,"lastInteraction":1687291099591,"sessionStart":1687291099591,"sessionEndDate":1687305600000,"experiment":""}
www.mercurynews.com/ Name: _ntv_uid
Value: 78fc1699-f3aa-4bd8-8b36-e847342a78cb
.postrelease.com/ Name: ver
Value: 1
.smaato.net/ Name: SCM
Value: d854fcfc
.smaato.net/ Name: SCMaps
Value: d854fcfc
.media.net/ Name: visitor-id
Value: 3302926991455551000V10
digitalfirstmedia.blueconic.net/ Name: AWSALBCORS
Value: 8gIkEfBgaWZf1+67WqViH7rEwz4lXDWSXTxjymxk+CRptv8RSqpUqIEEHbxMPOni2AEJV1zfvNBtmvsSM+gC8JMvUUDmdCl7Xh+Cu4Mk3epAWPOrVs7M+5mmwd26
.criteo.com/ Name: uid
Value: 33ce34a0-aa4b-4208-9ad8-c7db1317a38f
.smartadserver.com/ Name: pid
Value: 8231229510999469573
.gumgum.com/ Name: vst
Value: u_5f8a27c9-52a9-4f51-af59-852beb0ad309
.sharethrough.com/ Name: stx_user_id
Value: 5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44
.casalemedia.com/ Name: CMID
Value: ZJIE3OP2OC752A2TKDUZ-AAA
.casalemedia.com/ Name: CMPS
Value: 3712
.casalemedia.com/ Name: CMPRO
Value: 3712
a869.mercurynews.com/ Name: AWSALB
Value: TvjhvxAezDE0bUDKR5WoqgpwQ9hqhrDRnUeEAApY56fysvSwwW3MkLq7KQaGlA5BxLsHA0ZltqCk1ryGTj67aOZsBBS4bkUvtnSY1U/qG98niSdAxshQqt2Yk3F/
a869.mercurynews.com/ Name: AWSALBCORS
Value: TvjhvxAezDE0bUDKR5WoqgpwQ9hqhrDRnUeEAApY56fysvSwwW3MkLq7KQaGlA5BxLsHA0ZltqCk1ryGTj67aOZsBBS4bkUvtnSY1U/qG98niSdAxshQqt2Yk3F/
.mercurynews.com/ Name: _gat_UA-61435456-5
Value: 1
.contextweb.com/ Name: V
Value: sk2jAnLigg03
bh.contextweb.com/ Name: INGRESSCOOKIE
Value: a14522e88bc62cf1
.mercurynews.com/ Name: _ga
Value: GA1.2.1182837468.1687291098
.yellowblue.io/ Name: wrvUserID
Value: -r93yO6tkp_s
www.mercurynews.com/ Name: btpdb.t4tmU86.dGZjLjc1MDQ0Nzc
Value: U0VTU0lPTg
.yieldmo.com/ Name: yieldmo_id
Value: g7eec97c22de0d66b1bd%7C1687291100474%7C0%7C
.3lift.com/ Name: tluid
Value: 3075899752081279888305
.kargo.com/ Name: ktcid
Value: 4c13f24f-5762-042b-5185-6e5a05be41e3
.lijit.com/ Name: ljt_reader
Value: G2VucPZH9VEpuxOrQmKrKkiA
.bidswitch.net/ Name: tuuid
Value: 56daf56a-28b1-40e7-a167-b6cb39d3f949
.bidswitch.net/ Name: c
Value: 1687291100
.bidswitch.net/ Name: tuuid_lu
Value: 1687291100
.lijit.com/ Name: ljtrtbexp
Value: eJyrVjI0U7IyNLOwMDUwMDcw0FGyMEXjo8kbGaPyLU2Q%2BbUAmBsQQg%3D%3D
.openx.net/ Name: i
Value: 95406a9d-fe16-4bb4-8c2a-601e53ae6ed6|1687291100
.33across.com/ Name: 33x_ps
Value: u%3D212147305902640%3As1%3D1687291100639%3Ats%3D1687291100639
.deepintent.com/ Name: CDIUSER
Value: di_d782ad8a5c874f3ebf8d6
.adsrvr.org/ Name: TDID
Value: 120447a6-30d3-414b-b8f9-7a5eddeefdcd
.technoratimedia.com/ Name: tads_uidp_77
Value: Qzx8Fth1lRqwLigKGeiGAZsRaeTFhsG7HikZr4WvlCU
.technoratimedia.com/ Name: tads_uidp_88
Value: 1743599479903761032916
.technoratimedia.com/ Name: tads_uidp_44
Value: LJ2KLSYU-M-2YIM
.technoratimedia.com/ Name: tads_uidp_45
Value: BAD6476E-515C-40EF-942D-693B9AD99B7D
.technoratimedia.com/ Name: tads_uidp_46
Value: 7735810810083502427
.technoratimedia.com/ Name: tads_uidp_79
Value: 00571ff3-3f39-43da-9514-e390b7dc3acc
.technoratimedia.com/ Name: tads_uidp_37
Value: 7450de43-18ca-3cf5-be9e-f2863244ba84
.technoratimedia.com/ Name: tads_uidp_48
Value: 0667b527-98e1-4eaa-bed1-6d356da24ed9
.technoratimedia.com/ Name: tads_uidp_49
Value: AAAMmBzlYZ6qGgM_BcZbAAAAAAA
.technoratimedia.com/ Name: tads_uidp_7
Value: f17bf2de-ebee-45fd-b362-9b3e5115b62a
.technoratimedia.com/ Name: tads_uidp_80
Value: y-V9t4_MNE2uFGJdkBsphjNo7WGJSthR7Y~A
.technoratimedia.com/ Name: tads_uidp_70
Value: 1673948501052-981480834937-007220-006-006384
.technoratimedia.com/ Name: tads_uidp_82
Value: ZJBk1j-vaUyBByDDHLsv5QAA&3272
.technoratimedia.com/ Name: tads_uidp_50
Value: d6b19e7b-da98-4dd9-b521-db2f52543ab5
.technoratimedia.com/ Name: tads_uidp_61
Value: 212189934457817
.technoratimedia.com/ Name: tads_uidp_62
Value: 3302296631454946000V10
.technoratimedia.com/ Name: tads_uidp_64
Value: 2jkah48xKodCAB_zRgLSwfaMrA1pqygk
.technoratimedia.com/ Name: tads_uidp_76
Value: RX-83c05a1d-63bd-431d-a706-1894904d8530-005
.technoratimedia.com/ Name: tads_uid
Value: 16F85AA78ED646369CC5112051089037
.technoratimedia.com/ Name: tads_uid_cd
Value: 20221014204242+0000
.technoratimedia.com/ Name: tads_zora
Value: 2
.yahoo.com/ Name: A3
Value: d=AQABBNwEkmQCECOXee_cvFdP-Uh5YMRBtNQFEgEBAQFWk2SbZAAAAAAA_eMAAA&S=AQAAAqO6BxIyKv0BzLQngj2eHN4
sync.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-aee3e84a-9648-5082-7b18-bc1b6a6da401.e7h%2B%2BdmAV3hD3vVtN%2BTsLhU7i9544YURMkJXlybjRFY
sync.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AruPoSpZIUIJ7GLwbam2kAZU4mbs.OQRX4VcCym59xyafX4dXwu7w7l%2F4XbdkL9zRdjuVTJA
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AruPoSpZIUIJ7GLwbam2kAZU4mbs.OQRX4VcCym59xyafX4dXwu7w7l%2F4XbdkL9zRdjuVTJA
.zemanta.com/ Name: zuid
Value: enfOlcX9S9Dq6ua2mBcD
.mathtag.com/ Name: uuid
Value: cb896492-04dd-4900-a8be-bcb5698eda5a
.ipredictive.com/ Name: cu
Value: d73a5f9f-f848-4ab7-950f-b9fc12a99154|1687291100680
.outbrain.com/ Name: obuid
Value: ff6dbd72-aa22-4814-9b18-f5dbe107d88a
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~ZJIE3AABR7XTlQAz
.admanmedia.com/ Name: admtr
Value: d90855e2-a762-4191-8327-12f7f682caea
.company-target.com/ Name: tuuid
Value: fdc6fea8-0fb1-44f4-8faf-1c49c06a29f1
.company-target.com/ Name: tuuid_lu
Value: 1687291100|ix:0
www.mercurynews.com/ Name: ai_session
Value: 6uM7I|1687291100792.2|1687291100792.2
.360yield.com/ Name: tuuid
Value: cf5fb249-43c2-4293-b0ec-8acb4f767842
.360yield.com/ Name: tuuid_lu
Value: 1687291100
.pubmatic.com/ Name: KADUSERCOOKIE
Value: F2EBBF7D-4C79-4F31-B67B-920625C98DEF
.lijit.com/ Name: _ljtrtb_42
Value: cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59
.go.sonobi.com/ Name: __uis
Value: 7e845585-56d9-415f-9a4c-32558686bff3
.media.net/ Name: data-ris
Value: {{APID}}~~25
.bidr.io/ Name: bito
Value: AAEJeE7JJAoAACD7r3WP1g
.bidr.io/ Name: bitoIsSecure
Value: ok
.bluekai.com/ Name: bku
Value: ikG99B6WAZHgE9xh
.blismedia.com/ Name: b
Value: 649204DD724320703E93322FBLIS
.ads.yieldmo.com/ Name: ptrt
Value: 120447a6-30d3-414b-b8f9-7a5eddeefdcd
.creativecdn.com/ Name: ts
Value: 1687291101
.creativecdn.com/ Name: u
Value: FOYPqMoXokSCEEaOCmV5
.csync.loopme.me/ Name: viewer_token
Value: f66eb2fc-b468-4574-8969-c71d03ddbfc2
.mfadsrvr.com/ Name: tuuid
Value: 1a2b4bb9-5661-4d14-97cd-37d814131325
.mfadsrvr.com/ Name: c
Value: 1687291101
.mfadsrvr.com/ Name: tuuid_lu
Value: 1687291101
.ads.yieldmo.com/ Name: ptrc
Value: CAESEH5G4iZmJxbVRw473ZzSapI
.ads.yieldmo.com/ Name: consentrc
Value: 1
.ads.yieldmo.com/ Name: rptr
Value: rc%3D1172569%7Cunl%3D1688499360000%7Cc%3D1688499360000%7Ct%3D1688499360000%7Ctapad%3D1688499360000%7Cpub%3D1688499360000
.adscale.de/ Name: uu
Value: df6e617353214db49e68936a344cacdd
.admixer.net/ Name: am-uid
Value: a03df4b2a76b43d09cb62f7d043a0456
.adform.net/ Name: C
Value: 1
.lijit.com/ Name: _ljtrtb_85
Value: AAEJeE7JJAoAACD7r3WP1g
.lijit.com/ Name: _ljtrtb_16
Value: 3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341
.mfadsrvr.com/ Name: ssh
Value: !taboola,1687291101
.socdm.com/ Name: SOC
Value: ZJIE3cCo8YMAANUleG8AAAAA
.adscale.de/ Name: cct
Value: 1687291101371
.rezync.com/ Name: zync-uuid
Value: eebba6c9-87bf-4ef6-b3de-dcca9f36a268:1687291101.4033356
.adform.net/ Name: uid
Value: 5407894714181040436
.bttrack.com/ Name: GLOBALID
Value: 2uKlc8-sIBd987FnJwTAZ-aAg4oCp1b98nQ45QgyJLt2PUBqCInCqYTL4BmrnY8rJWr2WS-jkpQC4TM1
.adx.opera.com/ Name: UID
Value: OPU8e00f3f7eb6845d180b32a7645f83d04
.lijit.com/ Name: ljtrtb
Value: eJwNzLEOAiEMgOF3YbZJSwsUN3LewuTmfIXG0cSck%2FHdZf7y%2F99AOVwDexEVRBjmAyRRBtVoEG0gmxDxZMhSI8pUEBYKl6Bpla3t3ffSe3u1tt3Kmx93ei6VuHTMilPdobKtb2GHwyOCp4rmxxxoCudnnKamR6rh9wcYjSV4
.lijit.com/ Name: _ljtrtb_86
Value: FOYPqMoXokSCEEaOCmV5
.ads.yieldmo.com/ Name: ptrrc
Value: LJ4PJZ48-27-1JKH
.turn.com/ Name: uid
Value: 8818067066479886686
.rfihub.com/ Name: euds
Value: H4sIAAAAAAAA_wXBwRGAMAgEwI_t4IQQD7CbQKAQK3f3u7QqYiOdTKNpVYNCTtHJ3N6CPWEvw3Q68-B7DRF58APv7TT-OgAAAA
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAA_-MSsjQ3MDY0MTMxMDMwNDMxNDA3FeIz1PUt9TcuTHP3964MCwcAwzBWNiQAAAA
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAA_-MSsjQ3MDY0MTMxMDMwNDMxNDA3FeIz1PUt9TcuTHP3964MCwcAwzBWNiQAAAA
.rfihub.com/ Name: eud
Value: H4sIAAAAAAAA_9vEyGtoZmFuZGloaGBoaWQ5Sdg8NTUpKdEs2VLXwjwpTdckNc1MN8k4JVU3JTk50TLN2CzRyMzCCqFJz8TA2NjY1GyWMJJJ5iYGi1D5hgD-dA1QagAAAA
.pubmatic.com/ Name: KRTBCOOKIE_18
Value: 22947-970314640601641075
.pubmatic.com/ Name: KRTBCOOKIE_377
Value: 6810-120447a6-30d3-414b-b8f9-7a5eddeefdcd&KRTB&22918-120447a6-30d3-414b-b8f9-7a5eddeefdcd&KRTB&22926-120447a6-30d3-414b-b8f9-7a5eddeefdcd&KRTB&23031-120447a6-30d3-414b-b8f9-7a5eddeefdcd
.pubmatic.com/ Name: KRTBCOOKIE_80
Value: 16514-CAESEHV_B9BYoUzouEElUHMVC7Y&KRTB&22987-CAESEHV_B9BYoUzouEElUHMVC7Y&KRTB&23025-CAESEHV_B9BYoUzouEElUHMVC7Y&KRTB&23386-CAESEHV_B9BYoUzouEElUHMVC7Y
.pubmatic.com/ Name: KRTBCOOKIE_22
Value: 14911-8818067066479886686&KRTB&23150-8818067066479886686
.simpli.fi/ Name: suid
Value: 28F7D4B9C0A54A32B1BE3A0226AC86D4
.thrtle.com/ Name: mc
Value: eyJpZCI6IjlmNzcxZmFlLWI3YzEtNDgwOS05NzRiLTBmODcwOTRjODY0YiIsImwiOjE2ODcyOTExMDIwNTIsInQiOjF9
.linkedin.com/ Name: bcookie
Value: "v=2&869e2e1b-34df-41ae-8967-9ecdf1b8f6db"
.linkedin.com/ Name: lidc
Value: "b=TGST01:s=T:r=T:a=T:p=T:g=3085:u=1:x=1:i=1687291102:t=1687377502:v=2:sig=AQFh-MjCdb9qNJnvuan4NkYgfmZzQe_J"
.addthis.com/ Name: na_id
Value: 2023062019582100023801397603
.addthis.com/ Name: na_tc
Value: Y
.addthis.com/ Name: uid
Value: 649204dd1cc0e624
.addthis.com/ Name: ouid
Value: 649204dd00019e9cbd74791e4ba3ebbc8a64c5c722d660a45e4d
live.rezync.com/ Name: sd-session-id
Value: .eJwNykkOgzAMAMC_-EwqmwRn-QzK4khRS1oReini7-U40pywfmTfYpd-QDj2r0yQX-3WgHDCaL9NnhDAW9Rk2CAjsSG0C1wTDBmjvfvayl1EUoqcvXI2VWWkskq6iCo5R181x5ldIHZ29kRID4Na64Xh-gPJuyau.ZJIE3g.XAv3KE1lPXI57eQHC92jZWyJ5RQ
.pubmatic.com/ Name: KRTBCOOKIE_148
Value: 19421-uid:28F7D4B9C0A54A32B1BE3A0226AC86D4&KRTB&23489-uid:28F7D4B9C0A54A32B1BE3A0226AC86D4
.rubiconproject.com/ Name: audit
Value: 1|i7WLabMcVxJU48PQWoQLOu1WuCoMxA8a+JUixCbOKdqHbG77vviNX/963LXgkutBe95dAwEwyCpVQ4XeDu51Hj79QniQXr/U4WXUF1ge4XjTiK5tDBF3EN1PNrebWf4YpmvllXEtYN4=
.tapad.com/ Name: TapAd_3WAY_SYNCS
Value: 1!4123-2!4123
.targeting.unrulymedia.com/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005%22%7D
.ads.yieldmo.com/ Name: ptrunl
Value: RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
.smartadserver.com/ Name: vs
Value: 563381=5504878
.smartadserver.com/ Name: sasd2
Value: q=%24qc%3D1308948106%3B%24ql%3DHigh%3B%24qpc%3D28700%3B%24qt%3D124_1509_77271t%3B%24dma%3D0&c=1&l=1501522464&lo=384595258&lt=638228879025517891&o=1
.smartadserver.com/ Name: sasd
Value: %24qc%3D1308948106%3B%24ql%3DHigh%3B%24qpc%3D28700%3B%24qt%3D124_1509_77271t%3B%24dma%3D0
.dlx.addthis.com/ Name: na_sc_x
Value: 1
.mercurynews.com/ Name: _pnlspid
Value: 10402
.mercurynews.com/ Name: _pnss
Value: dismissed
.mercurynews.com/ Name: _pnpdm
Value: true
.mercurynews.com/ Name: anonDeviceId
Value: 23c7b2911e37a18862bb7d8d9656a1d8
.adnxs.com/ Name: icu
Value: ChgIiNJ7EAoYAiACKAIw34nIpAY4AkACSAIKGQipr4gBEAoYASABKAEw3InIpAY4AUABSAEKGQiYrooBEAoYASABKAEw2YnIpAY4AUABSAEQ34nIpAYYAw..
.go.sonobi.com/ Name: HAPLB8S
Value: s87151|ZJIE4
.semasio.net/ Name: SEUNCY
Value: 711CE39FE8077C48
.sojern.com/ Name: cid
Value: b500035e-6fe8-cee6-f5fb-24fdef28b1ad#1687219200000
.sojern.com/ Name: gid
Value: CAESEKMIFEnDhnzgGyi2BRUnuRU
.adnxs.com/ Name: anj
Value: dTM7k!M4/8D>6NRF']wIg2GU'sv@5m!]Gzi#MOY-PlZ[C[-kX-`4Rgt
.analytics.yahoo.com/ Name: IDSYNC
Value: "19c8~2cbv:18z8~2cbv"
.dotomi.com/ Name: DotomiTest
Value: 6f33179dc0e205ef
.pubmatic.com/ Name: KRTBCOOKIE_1251
Value: 23269-di_d782ad8a5c874f3ebf8d6
.pubmatic.com/ Name: KRTBCOOKIE_57
Value: 22776-3958812064475458525&KRTB&23339-3958812064475458525
.pubmatic.com/ Name: KRTBCOOKIE_27
Value: 16735-uid:cb896492-04dd-4900-a8be-bcb5698eda5a&KRTB&16736-uid:cb896492-04dd-4900-a8be-bcb5698eda5a&KRTB&23019-uid:cb896492-04dd-4900-a8be-bcb5698eda5a&KRTB&23114-uid:cb896492-04dd-4900-a8be-bcb5698eda5a
.bfmio.com/ Name: __187_cid
Value: F2EBBF7D-4C79-4F31-B67B-920625C98DEF
.bfmio.com/ Name: __io_cid
Value: 3927dc42baf5465cd5c4eb209d8415c17acf824b
.contextweb.com/ Name: pb_rtb_ev
Value: 3-1l9q|4is.0.CAESEBMsIDSDWrdjerDZZjGKunc|7TY.0|2N.0.AAACG66zQrJ-VQNny_ryAAAAAAA|3oy.0|7bq.0.1|5Ql.0.cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59|7dN.0.AAEJeE7JJAoAACD7r3WP1g
.pubmatic.com/ Name: KRTBCOOKIE_699
Value: 22727-AAEJeE7JJAoAACD7r3WP1g
.pubmatic.com/ Name: KRTBCOOKIE_279
Value: 22890-d73a5f9f-f848-4ab7-950f-b9fc12a99154&KRTB&23011-d73a5f9f-f848-4ab7-950f-b9fc12a99154&KRTB&23355-d73a5f9f-f848-4ab7-950f-b9fc12a99154
.taptapnetworks.com/ Name: SONATA_ID
Value: csonata_b302fbb7-fdbb-4009-9633-f71c8aea77c7
.pubmatic.com/ Name: KRTBCOOKIE_32
Value: 11175-AAAB5mRHm03IoAMPllOYAAAAAAA&KRTB&22713-AAAB5mRHm03IoAMPllOYAAAAAAA&KRTB&22715-AAAB5mRHm03IoAMPllOYAAAAAAA
.pubmatic.com/ Name: KRTBCOOKIE_466
Value: 16530-56daf56a-28b1-40e7-a167-b6cb39d3f949
.audrte.com/ Name: arcki2
Value: g68XsZxgD-7SfOZ6spF7ykyaA!20220908!1687291106119!ip#149.56.153.187
.rqtrk.eu/ Name: browser_id
Value: 1:88818f86-7b13-4366-afde-89b94549ec7f
.www.mercurynews.com/ Name: sub_nxt_upd_ac_DFM_BANGWPPRODWAB_PROD
Value: 1
.audrte.com/ Name: arcki2_ddp2
Value: g68XsZxgD-7SfOZ6spF7ykyaA!20220908!1687291106671
.smaato.net/ Name: SCMsas
Value: d854fcfc
.admanmedia.com/ Name: ac_r
Value: CS71|CS159
.omnitagjs.com/ Name: ayl_visitor
Value: 757349f6dab79002613d93ce22427ff9
.adfarm1.adition.com/ Name: UserID1
Value: 7246860123398011025
.www.mercurynews.com/ Name: sub_nxt_DFM_BANGWPPRODWAB_PROD
Value: {%222%22:{%22104000%22:{%22ac%22:1%2C%22ac_d%22:1%2C%22s%22:1687291106527}%2C%22104103%22:{%22ac%22:0%2C%22ac_d%22:0%2C%22s%22:1687291106470}%2C%22_ac_d%22:1%2C%22_ac%22:1%2C%22_acnv%22:%22104000%22}}
.adotmob.com/ Name: uid
Value: 093922040744add39d31a086
.adotmob.com/ Name: uuid
Value: 093922040744add39d31a086
.adotmob.com/ Name: partners
Value: SMA%3A1687291107338
.audrte.com/ Name: arcki2_adform
Value: 5407894714181040436!20220908!1687291107471
.pubmatic.com/ Name: SyncRTB3
Value: 1688428800%3A104_240_220_13_231_48_250_166_233_56_99_214_3_249_81_165_5_234_239_238_7_46_21_176_71_8_55_96_204_54_22_178_243%7C1688083200%3A63%7C1687824000%3A223_2_15_38%7C1692403200%3A69%7C1689811200%3A224%7C1688515200%3A35
.audrte.com/ Name: arcki2_smart
Value: 8231229510999469573!20220908!1687291108098
.mercurynews.com/ Name: _ml_id
Value: db7bf053-61e0-4111-899e-812311da85ef.1687291098.1.1687291108.1687291098
.quantserve.com/ Name: d
Value: EMgBEgGjKfijCP_8EA
.pubmatic.com/ Name: KRTBCOOKIE_153
Value: 1923-neYIRJvmVU-GtlRFm-QcQcm2VUSGsFROkuPGfL6_&KRTB&19420-neYIRJvmVU-GtlRFm-QcQcm2VUSGsFROkuPGfL6_&KRTB&22979-neYIRJvmVU-GtlRFm-QcQcm2VUSGsFROkuPGfL6_&KRTB&23462-neYIRJvmVU-GtlRFm-QcQcm2VUSGsFROkuPGfL6_
.crwdcntrl.net/ Name: _cc_dc
Value: 0
.crwdcntrl.net/ Name: _cc_id
Value: b72f6c5451814dc260c453a17262237b
.rlcdn.com/ Name: rlas3
Value: cs4X1ZwWEY9BTZR59HHJWsrv3XQqWSQQ5xJVy7DmHmI=
.rlcdn.com/ Name: pxrc
Value: CN6JyKQGEgUI6AcQABIFCOhHEAYSBgi66gEQAA==
.pubmatic.com/ Name: KRTBCOOKIE_391
Value: 22924-5407894714181040436&KRTB&23263-5407894714181040436&KRTB&23481-5407894714181040436
.pubmatic.com/ Name: KRTBCOOKIE_860
Value: 16335-ruPoSpZIUIJ7GLwbam2kAZU4mbs&KRTB&23334-ruPoSpZIUIJ7GLwbam2kAZU4mbs&KRTB&23417-ruPoSpZIUIJ7GLwbam2kAZU4mbs&KRTB&23426-ruPoSpZIUIJ7GLwbam2kAZU4mbs
.ctnsnet.com/ Name: cid_9e31b39f89f34ec3929749d5114ce1cf
Value: 1
.acuityplatform.com/ Name: auid
Value: 792503744794
.acuityplatform.com/ Name: aum
Value: "OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqANvqNdXNlck1hdGNoaW5nSWTMkWxhc3REcm9wVGltZU1pbGxpcyUBRDZMMWCymGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAUQ2TDFgso90aGlyZFBhcnR5VXNlcklkIfv7hnZlcnNpb27C+w=="
.w55c.net/ Name: wfivefivec
Value: G7IN0PJx1QbHuI5
.adgrx.com/ Name: ADGRX_UID
Value: d2fde370-0fa4-11ee-b2e6-13cc15e39a1e
ads.playground.xyz/ Name: connect.sid
Value: s%3AgzZeOsUv7crkeUPpIVcVMHgNyTi-Fz3k.sZts21dGXNKceu0V6IUbNF6EM2iBIJPGBraBNzflXls
.mxptint.net/ Name: mxpim
Value: R33645_104947644_BB9C7463.1.0000000000000000649204E4
.pubmatic.com/ Name: KRTBCOOKIE_469
Value: 8273-792503744794&KRTB&23428-792503744794
.w55c.net/ Name: matchpubmatic
Value: 5
.pubmatic.com/ Name: KRTBCOOKIE_188
Value: 3189-3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341&KRTB&23418-3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341
.adgrx.com/ Name: ADGRX_CM_PUBMATIC_BRIDGED
Value: 1
.pubmatic.com/ Name: KRTBCOOKIE_1305
Value: 23413-F2EBBF7D-4C79-4F31-B67B-920625C98DEF&KRTB&23479-F2EBBF7D-4C79-4F31-B67B-920625C98DEF&KRTB&23408-F2EBBF7D-4C79-4F31-B67B-920625C98DEF
.pubmatic.com/ Name: KRTBCOOKIE_107
Value: 1471-uid:G7IN0PJx1QbHuI5&KRTB&23421-uid:G7IN0PJx1QbHuI5
.pubmatic.com/ Name: KRTBCOOKIE_594
Value: 17105-RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005&KRTB&17107-RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005
.pubmatic.com/ Name: KRTBCOOKIE_1003
Value: 22761-d2fde370-0fa4-11ee-b2e6-13cc15e39a1e&KRTB&23275-d2fde370-0fa4-11ee-b2e6-13cc15e39a1e
.inmobi.com/ Name: idsp_c
Value: e7dec152-414a-4f0d-b405-72cafd61690d
.pubmatic.com/ Name: KRTBCOOKIE_52
Value: 22772-R33645_104947644_BB9C7463&KRTB&23092-R33645_104947644_BB9C7463
.pippio.com/ Name: did
Value: RrsDaa1bQH-OnHM_
.pippio.com/ Name: didts
Value: 1687291108
.pippio.com/ Name: nnls
Value:
.pubmatic.com/ Name: KRTBCOOKIE_1278
Value: 23329-085b959a-8ada-4bf5-97c1-bd2b77bb3e82&KRTB&23340-085b959a-8ada-4bf5-97c1-bd2b77bb3e82&KRTB&23498-085b959a-8ada-4bf5-97c1-bd2b77bb3e82
.us.ck-ie.com/ Name: CID
Value: 2ff1503e25c6ba4f3b8d35bfdf2feb671e8d1751
.betweendigital.com/ Name: dc
Value: was1
.betweendigital.com/ Name: ss
Value: 1
.betweendigital.com/ Name: tuuid
Value: 1769ab5a-0153-53ab-806e-d191e4fcd575
.tribalfusion.com/ Name: ANON_ID
Value: afnseFmge06ousnA7ffEi5ZdovgZclWSbG8YNrariGtGZbcr1YsvRAs570Oohj4FuvpVyyAbuRJFHy2XH36xUlr
beacon.lynx.cognitivlabs.com/ Name: UID
Value: 6ccaab0f-ffa7-4439-8116-1e07fa5d9ca4
beacon.lynx.cognitivlabs.com/ Name: ss
Value: 3zIsYq52V%2F%2Fe1wz%2BvtBAvs6MP1NeebIoB%2FF%2FcCXzG8%2Ft287CuG5cf4L7tLjwecCjwvgc0WPB9BiQzeWQ4Ud9lA%3D%3D
.adsby.bidtheatre.com/ Name: __kuid
Value: c6c815c7-1cf2-483a-9a6d-c792c2e0047e.456505108
.creative-serving.com/ Name: tuuid
Value: dd2e1a02-8c76-4490-b97b-ff2e506e3120
.creative-serving.com/ Name: c
Value: 1687291108
.creative-serving.com/ Name: tuuid_lu
Value: 1687291108
.pippio.com/ Name: pxrc
Value: COSJyKQGEgQIAhAAEgYI7OsBEAA=
.mookie1.com/ Name: id
Value: 10598588408662670101
.mookie1.com/ Name: mdata
Value: 1|10598588408662670101|1687291108621
.mookie1.com/ Name: ov
Value: f38acbe299b565652943ddb18b3b42d7
.1rx.io/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-99a076fc-2013-49ba-8081-ddfafa3aaa10-005%22%2C%22nxtrdr%22%3Afalse%7D
.owneriq.net/ Name: p2
Value: pmc
.owneriq.net/ Name: si
Value: Q7405775081198469329P
.owneriq.net/ Name: pmc
Value: 1
.server.cpmstar.com/ Name: USER_ID
Value: LT%06%8e%b0Bk%e6%a9%3e%ad%81p%8f%a9
.linksynergy.com/ Name: rmuid
Value: 5be19df6-7853-4bd9-8606-e81139b4cea9
.linksynergy.com/ Name: icts
Value: 2023-06-20T19:58:28Z
.richaudience.com/ Name: pdid
Value: da00dd86-3202-4e8e-b67f-1zz1687291106
.c.appier.net/ Name: _auid
Value: tAdeHa1cC-S_ZuUT5ASSZA
.pubmatic.com/ Name: KRTBCOOKIE_904
Value: 16787-tAdeHa1cC-S_ZuUT5ASSZA
.pubmatic.com/ Name: PugT
Value: 1687291109
.betweendigital.com/ Name: ut
Value: ZJIE5QAD_3AdWWMZue8VOnoEXdyU1Sjnsu1tsQ==
.spotxchange.com/ Name: audience
Value: d38940c1-0fa4-11ee-a631-183b8be90103
.richaudience.com/ Name: avcid-sht-uid
Value: 5e0ca44b-e15d-4379-b8d0-9c8c6ffd9b44
.smartadserver.com/ Name: csync
Value: 32:8818067066479886686|107:cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59|127:AAEJeE7JJAoAACD7r3WP1g|135:TAM_OK|139:0|150:0
.richaudience.com/ Name: avcid-apn-uid
Value: 3958812064475458525
.smilewanted.com/ Name: sw_user_params_infos
Value: 6GFc1zAIh%2BMdj25VdAII4u76a%2FVOpkaXVp6MCNmFEHd79qb32Bt20yw%2FhriUrzPhOI1dlvDZ%2B3XfmcmU3cqKebhfa4ZRpeeg6eQEijKULDuMcAUgQ8dMS0wjNn3e5SY2DscVP6kmB7HD3voF2y7FSRU%2Fwz98vv9OxSk3jXAjlBhRCWqSQMWHAICiIixAWAmjl1BRqPz0TLCEpwHVSs7ezQ4W%2FZ5THP66FBBa0tXICNjldM1p%2Ft5nCwCTOuWh2xubJKiWqHShMBLMHPuAN3aHtuE5FjA7wejz6QpzAcHfLmdp%2FlMsXm7QsU9kETOBgzN8sbjIVxRz4E6yDFhTmVYRug%3D%3D
match.sharethrough.com/ Name: AWSALBCORS
Value: WgV2gS00/0DUBei7N1w2PYR1tRtAod/GB4KDo8kNToXVUyISqLq50qEwF2sAvyW1V9beguL6ZYpLMbFHup7X+q+ex6Qy9QEeyZjdOhapd0LhEhZpYaZDZXKjdMuI
.richaudience.com/ Name: avcid-bsw-uid
Value: 56daf56a-28b1-40e7-a167-b6cb39d3f949
.id5-sync.com/ Name: id5
Value: 7fb3f241-2fb4-7f6b-a368-dac340365ffa#1687291101150#3
.id5-sync.com/ Name: callback
Value: https%3A%2F%2Fsync.richaudience.com%2Fa6c163b098d05a413cd1682e26fae172%2F%3Fuid%3D%7BID5UID%7D
.deepintent.com/ Name: CDIPARTNERS
Value: %7B%22141%22%3A%2220230620%22%2C%22147%22%3A%2220230620%22%7D
.pubmatic.com/ Name: chkChromeAb67Sec
Value: 6
.pubmatic.com/ Name: DPSync3
Value: 1688428800%3A255_259_245_263_256_258_236_260_201_235_262_261%7C1687824000%3A248_252_253%7C1688256000%3A257
.ads.pubmatic.com/ Name: pubsyncexp
Value: 1687312709703
.sitescout.com/ Name: _ssuma
Value: eyIzNCI6MTY4NzI5MTA5NjY4MCwiNDUiOjE2ODcyOTExMDgzNzMsIjIiOjE2ODcyOTEwOTY2ODAsIjQiOjE2ODcyOTEwOTY2ODAsIjQ4IjoxNjg3MjkxMTAxMTE2LCIzOSI6MTY4NzI5MTA5NjY4MCwiNyI6MTY4NzI5MTA5NjY4MCwiMjkiOjE2ODcyOTExMDk3NDV9
.spotxchange.com/ Name: sl
Value: eyJnIjpmYWxzZSwicyI6IjIwMjEwMCIsInNwIjo3LCJpIjp0cnVlLCJscCI6NjY1MywidXBzIjoiIiwiZ2NzIjoiIiwicGwiOltdLCJzaWQiOiJkMzg5NDExZC0wZmE0LTExZWUtYTYzMS0xODNiOGJlOTAxMDMiLCJzb2wiOjcsInNsIjowfQ==
.audrte.com/ Name: arcki2_pubmatic
Value: F2EBBF7D-4C79-4F31-B67B-920625C98DEF!20220908!1687291109766
io.narrative.io/ Name: io.narrative.guid.v2
Value: d3d63c70-0fa4-11ee-b039-16c962239a11
.pubmatic.com/ Name: SPugT
Value: 1687291110
.360yield.com/ Name: um
Value: !313,hVQjyT-as8uO3xwZPo093kwY-cRePJZCyBEdO43resBEMT8bLGmUB.GiC69UmtHU-Dci3KcHuwHfA9AX,1695067110
.360yield.com/ Name: umeh
Value: !313,0,1749499110,-1
.id5-sync.com/ Name: cf
Value: gif
.id5-sync.com/ Name: cip
Value: 286
.id5-sync.com/ Name: gdpr
Value: 0|
.id5-sync.com/ Name: 3pi
Value: 2#1687291103058#2025107861#3958812064475458525|3#1687291109588#1391651019#cb896492-04dd-4900-a8be-bcb5698eda5a|264#1687291102648#-623942228#120447a6-30d3-414b-b8f9-7a5eddeefdcd|136#1687291110265#-845727174|104#1687291110668#897371712#56daf56a-28b1-40e7-a167-b6cb39d3f949|108#1687291103461#-1362751847|429#1687291102284#-20399361#F2EBBF7D-4C79-4F31-B67B-920625C98DEF|464#1687291101554#-1004275538#cd90d8ee-93bc-473e-ae20-e590beadc0b8-tuctb8b8a59|112#1687291104147#-475152111#711CE39FE8077C48|434#1687291103667#1636872692|916#1687291110530#-1404859777|821#1687291110109#549393167|441#1687291102074#1088158210#u_5f8a27c9-52a9-4f51-af59-852beb0ad309|826#1687291110396#-909511125#3e748400-cbec-4516-882b-2bc03b4113d3-649204d8-4341|987#1687291109717#-330794078|155#1687291110796#-2070772122#AAEJeE7JJAoAACD7r3WP1g|286#1687291109453#-644991155
.id5-sync.com/ Name: cnac
Value: 0
.id5-sync.com/ Name: car
Value: 10
.mercurynews.com/ Name: _uetsid
Value: d4eccf800fa411eeae68afe7e22c7ba4
.mercurynews.com/ Name: _uetvid
Value: d4edbfb00fa411ee8d087b4035639954
.mercurynews.com/ Name: calltrk_referrer
Value: direct
.mercurynews.com/ Name: calltrk_landing
Value: https%3A//www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
.bing.com/ Name: MUID
Value: 2C45797DEEA36E5F3F5F6A4BEF756F4C
.bat.bing.com/ Name: MR
Value: 0
.mercurynews.com/ Name: _fbp
Value: fb.1.1687291111691.1514013398
.krxd.net/ Name: _kuid_
Value: PoI-Qclx
.mercurynews.com/ Name: cto_bundle
Value: m8_3wV9HdTRYOVB6QUF5NmxPZiUyRk1lRXRDcU1WJTJGJTJCdFY2SFNmJTJCUFVJbEdaUEJSelVLMkk5aVNYWXo1JTJGU1VFZTV0TFBhOEswblJ3ZHRCWDAwZjgyVUliU3dBREhwUWpLbm8zdnFMbkNOaUN3NlNIbVJBNyUyRjVNUmU1QUtsSHZFb1NYeGZHVnZKSmlwbGpWV3c2JTJCVFlRdUk5UmJ4USUzRCUzRA
.adsrvr.org/ Name: TDCPM
Value: CAESFAoFdGFwYWQSCwiKj66w1_T4OxAFEhYKB3N2eDl0NTASCwj07au01_T4OxAFEhkKCmxpdmVpbnRlbnQSCwjE26y31_T4OxAFEhYKB3J1Ymljb24SCwj6psa31_T4OxAFEhcKCHB1Ym1hdGljEgsIzt-Iutf0-DsQBRISCgNhYW0SCwja__e0nsLtOxAFEhMKBGtydXgSCwjeleKZ2PT4OxAFGAEgASgCMgsI3o3lxu70-DsQBTgBWgRrcnV4YAI.

48 Console Messages

Source Level URL
Text
javascript warning URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js(Line 1)
Message:
Failed to execute 'write' on 'Document': It isn't possible to write into a document from an asynchronously-loaded external script unless it is explicitly opened.
network error URL: https://sync.adkernel.com/user-sync?zone=181093&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dmdp%26i%3D%5BUID%5D&gdpr=0&gdpr_consent=&ccpa=
Message:
Failed to load resource: the server responded with a status of 400 (Bad Request)
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
network error URL: https://ssbsync.smartadserver.com/api/sync?callerId=4
Message:
Failed to load resource: the server responded with a status of 503 ()
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
other warning URL: https://www.googletagservices.com/dcm/impl_v96.js(Line 77)
Message:
Unrecognized feature: 'attribution-reporting'.
other warning URL: https://www.googletagservices.com/dcm/impl_v96.js(Line 77)
Message:
Unrecognized feature: 'attribution-reporting'.
other warning URL: https://www.googletagservices.com/dcm/impl_v96.js(Line 77)
Message:
Unrecognized feature: 'attribution-reporting'.
other warning URL: https://www.googletagservices.com/dcm/impl_v96.js(Line 77)
Message:
Unrecognized feature: 'attribution-reporting'.
javascript error URL: https://8proof.com/app/rtbmarkup/5111?id=515477663289&ctd=110096&crid=1178&ap=ZJIE3wACLGsKs_uOAAd70dmLTSCv8aULrQ7qBg
Message:
Access to font at 'https://cdn.8proof.com/ads/assets/fonts/montserrat-v25-latin-600.woff2' from origin 'https://8proof.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://cdn.8proof.com/ads/assets/fonts/montserrat-v25-latin-600.woff2
Message:
Failed to load resource: net::ERR_FAILED
other warning URL: https://www.googletagservices.com/dcm/impl_v96.js(Line 77)
Message:
Unrecognized feature: 'attribution-reporting'.
javascript error URL: https://8proof.com/app/rtbmarkup/5111?id=515477663289&ctd=110096&crid=1178&ap=ZJIE3wACLGsKs_uOAAd70dmLTSCv8aULrQ7qBg
Message:
Access to font at 'https://cdn.8proof.com/ads/assets/fonts/montserrat-v25-latin-800.woff2' from origin 'https://8proof.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://cdn.8proof.com/ads/assets/fonts/montserrat-v25-latin-800.woff2
Message:
Failed to load resource: net::ERR_FAILED
other warning URL: https://www.googletagservices.com/dcm/impl_v96.js(Line 77)
Message:
Unrecognized feature: 'attribution-reporting'.
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
network error URL: https://sync.tidaltv.com/genericusersync.ashx?dpid=3157&gdpr=0&gdpr_consent=
Message:
Failed to load resource: the server responded with a status of 404 ()
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
network error URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7405775081198469329
Message:
Failed to load resource: the server responded with a status of 502 ()
network error URL: https://cs.iqzone.com/e9d4ff858b5e32317e843f5ed11b2659.gif?puid=u_5f8a27c9-52a9-4f51-af59-852beb0ad309&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diqz
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob: wss://realtimeeventfeeds.viafoura.co wss://sub.viafoura.co; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000;includeSubdomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

7fbecb8c41f53187a0329ee4b1b7f617.safeframe.googlesyndication.com
8proof.com
a.audrte.com
a.tribalfusion.com
a869.mercurynews.com
aax-eu.amazon-adsystem.com
aax.amazon-adsystem.com
accounts.google.com
acdn.adnxs-simple.com
acdn.adnxs.com
ad.360yield.com
ad.doubleclick.net
ad.mrtnsvr.com
ad.turn.com
ads.betweendigital.com
ads.creative-serving.com
ads.playground.xyz
ads.pubmatic.com
ads.stickyadstv.com
ads.yieldmo.com
adservice.google.com
adx.adform.net
ajax.googleapis.com
amazon-tam-match.dotomi.com
ams-pageview-public.s3.amazonaws.com
ap.lijit.com
api-mg2.db-ip.com
api.viafoura.co
az416426.vo.msecnd.net
b-code.liadm.com
b1sync.zemanta.com
bat.bing.com
bcp.crwdcntrl.net
beacon.krxd.net
beacon.lynx.cognitivlabs.com
beacon.sojern.com
bh.contextweb.com
bidder.criteo.com
bpi.rtactivate.com
bttrack.com
c.amazon-adsystem.com
c1.adform.net
cab8f91dab2ae86994d940713ed884d0.safeframe.googlesyndication.com
cdn.8proof.com
cdn.adnxs.com
cdn.auth0.com
cdn.callrail.com
cdn.confiant-integrations.net
cdn.czx5eyk0exbhwp43ya.biz
cdn.doubleverify.com
cdn.id5-sync.com
cdn.jsdelivr.net
cdn.jwplayer.com
cdn.p-n.io
cdn.parsely.com
cdn.pranmcpkx.com
cdn.prod.uidapi.com
cdn.taboola.com
cdn.viafoura.net
cds.taboola.com
ce.lijit.com
choices.trustarc.com
choices.truste.com
cm.adform.net
cm.adgrx.com
cm.g.doubleclick.net
cmp.osano.com
cms.quantserve.com
connect.facebook.net
consent.api.osano.com
contextual.media.net
core.iprom.net
crb.kargo.com
creativecdn.com
cs-server-s2s.yellowblue.io
cs.admanmedia.com
cs.iqzone.com
cs.media.net
cs.yellowblue.io
csync.loopme.me
csync.smilewanted.com
d.adroll.com
d.turn.com
dc.services.visualstudio.com
digitalfirstmedia.blueconic.net
dis.criteo.com
dmp.adform.net
dpm.demdex.net
dsp.adfarm1.adition.com
dsum-sec.casalemedia.com
dsum.casalemedia.com
eb2.3lift.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
fp-cdn.azureedge.net
g2insights-cdn.azureedge.net
geo.privacymanager.io
gocm.c.appier.net
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
gum.criteo.com
hb.adpone.com
hbopenbid.pubmatic.com
htlb.casalemedia.com
htlbid.com
i.clean.gg
i.liadm.com
i.viafoura.co
i6.liadm.com
ib.adnxs.com
ice.360yield.com
id.rlcdn.com
id5-sync.com
idsync.rlcdn.com
ih.adscale.de
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
image8.pubmatic.com
images.taboola.com
imprnjmp.taboola.com
insight.adsrvr.org
inv-nets.admixer.net
io.narrative.io
ipac.ctnsnet.com
jadserve.postrelease.com
js.matheranalytics.com
js.moatads.com
k.p-n.io
launchpad-wrapper.privacymanager.io
launchpad.privacymanager.io
live.rezync.com
load77.exelator.com
loader-cdn.azureedge.net
loadm.exelator.com
maps.googleapis.com
match.adsby.bidtheatre.com
match.adsrvr.org
match.deepintent.com
match.prod.bidr.io
match.sharethrough.com
match.taboola.com
matching.truffle.bid
mug.criteo.com
mweb.ck.inmobi.com
nym1-ib.adnxs.com
odr.mookie1.com
onetag-sys.com
p.rfihub.com
p1.parsely.com
pagead2.googlesyndication.com
paywall-ad-bucket.s3.amazonaws.com
pippio.com
pips.taboola.com
pixel-sync.sitescout.com
pixel-us-east.rubiconproject.com
pixel.quantserve.com
pixel.rubiconproject.com
pixel.sitescout.com
pixel.sojern.com
pixel.tapad.com
pixel.wp.com
player-files.remixd.com
pm-widget.taboola.com
pm.w55c.net
pmp.mxptint.net
polyfill.io
pr-bh.ybp.yahoo.com
prebid.smilewanted.com
prg.smartadserver.com
prod-dfm-proxy-connext.azurewebsites.net
prodmg2.blob.core.windows.net
protected-by.clarium.io
pubcast-files.remixd.com
pubmatic-match.dotomi.com
pulsepoint-match.dotomi.com
px.ads.linkedin.com
px.owneriq.net
rp.liadm.com
rp4.liadm.com
rtb-csync.smartadserver.com
rtb.adentifi.com
rtb.gumgum.com
rtb.mfadsrvr.com
rules.quantcount.com
s.ad.smaato.net
s.amazon-adsystem.com
s.btstatic.com
s.company-target.com
s.ntv.io
s.thebrighttag.com
s.tribalfusion.com
s.w.org
s0.2mdn.net
sb.scorecardresearch.com
secure-assets.rubiconproject.com
secure.adnxs.com
secure.quantserve.com
securepubads.g.doubleclick.net
server.cpmstar.com
session.mercurynews.com
simage2.pubmatic.com
simage4.pubmatic.com
sli.mercurynews.com
sonata-notifications.taptapnetworks.com
sopalk.com
ssbsync-us.smartadserver.com
ssbsync.smartadserver.com
ssc-cms.33across.com
ssum-sec.casalemedia.com
stags.bluekai.com
static.criteo.net
static.smilewanted.com
stats.g.doubleclick.net
stats.wp.com
sync-amz.ads.yieldmo.com
sync-t1.taboola.com
sync-tm.everesttech.net
sync.1rx.io
sync.adkernel.com
sync.adotmob.com
sync.bfmio.com
sync.crwdcntrl.net
sync.go.sonobi.com
sync.ipredictive.com
sync.mathtag.com
sync.outbrain.com
sync.richaudience.com
sync.search.spotxchange.com
sync.springserve.com
sync.srv.stackadapt.com
sync.taboola.com
sync.targeting.unrulymedia.com
sync.teads.tv
sync.technoratimedia.com
sync.tidaltv.com
synchroscript.deliveryengine.adswizz.com
t.adx.opera.com
tags.rd.linksynergy.com
tags.remixd.com
tg.socdm.com
thrtle.com
tlx.3lift.com
token.rubiconproject.com
tpc.googlesyndication.com
tps.doubleverify.com
tpsc-ue1.doubleverify.com
tr.blismedia.com
trace.mediago.io
trc.taboola.com
u.openx.net
uipglob.semasio.net
um.simpli.fi
ums.acuityplatform.com
unpkg.com
ups.analytics.yahoo.com
us-match.taboola.com
us-trc-events.taboola.com
us-u.openx.net
us-vid-events.taboola.com
us.ck-ie.com
usermatch.krxd.net
usersync.gumgum.com
vidstat.taboola.com
visitor.omnitagjs.com
wt.rqtrk.eu
www.facebook.com
www.foo.software
www.google-analytics.com
www.google.ca
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.i.matheranalytics.com
www.mercurynews.com
x.bidswitch.net
x.dlx.addthis.com
cdn.8proof.com
id5-sync.com
protected-by.clarium.io
104.127.84.215
104.18.25.185
104.22.68.131
104.36.115.111
104.36.115.113
104.45.136.42
107.178.244.119
107.178.250.234
107.178.254.65
108.138.106.60
108.138.107.138
108.139.29.93
108.139.47.33
124.146.215.50
13.225.214.18
13.33.60.66
13.35.93.111
13.85.16.224
134.122.57.34
137.184.240.117
141.226.224.32
141.226.224.48
142.250.64.70
142.250.80.34
142.251.40.98
143.204.146.34
143.204.146.97
15.197.193.217
15.235.42.104
151.101.129.44
151.101.194.49
151.101.65.108
157.90.40.26
162.19.138.119
162.248.18.34
162.248.18.37
162.55.233.29
172.105.235.90
172.67.75.166
173.231.178.82
174.137.133.32
18.164.101.60
18.164.107.227
18.164.116.107
18.164.116.84
18.164.96.113
18.195.69.47
18.224.253.134
184.28.206.17
185.167.164.37
185.184.8.90
192.0.66.2
192.0.76.3
192.0.77.48
192.132.33.46
192.35.249.137
192.40.39.223
195.244.31.10
195.5.165.20
198.148.27.140
199.127.204.142
199.38.167.130
2.22.1.179
20.60.62.4
20.85.134.6
204.62.13.72
207.198.113.205
207.198.113.87
216.22.16.0
216.22.16.5
23.105.12.173
23.197.21.62
23.198.216.24
23.235.251.211
23.44.133.37
23.47.144.133
23.49.100.28
23.49.101.144
23.7.4.170
23.77.172.245
23.77.173.155
23.77.173.8
23.92.190.74
2600:1400:9000::6875:b612
2600:1f18:1c96:4102:4bd7:5264:40b8:b37
2600:1f18:44f0:4851:acd5:7304:ba6b:1c44
2600:1f18:4e9:5a05:3fdd:1e3f:2ebe:5c68
2600:1f18:61c0:2204:b513:b8fc:2d8f:8df9
2600:1f18:730:b150:2f0a:ae34:6b51:61cf
2600:1f18:ed:550e:4578:8034:184b:4f8b
2600:9000:21dd:4800:8:2ae1:d740:93a1
2600:9000:21dd:e400:6:44e3:f8c0:93a1
2600:9000:2209:cc00:1:a3fa:7cc0:93a1
2600:9000:2209:e800:1b:5138:8a40:93a1
2600:9000:23cb:4200:8:8845:1500:93a1
2600:9000:2510:f400:3:b7e:8940:93a1
2600:9000:2511:8000:a:e047:753:be1
2600:9000:2511:a00:10:474e:104a:2961
2602:803:c002:300::99
2603:c020:400d:3000:67b7:1059:7283:c690
2606:2800:11f:17a5:191a:18d5:537:22f9
2606:2800:11f:1cb7:261b:1f9c:2074:3c
2606:4700:10::ac43:266a
2606:4700:20::ac43:49e4
2606:4700:4400::6812:220a
2606:4700::6810:7aaf
2606:4700::6812:19ad
2606:ae80:1471:16::760
2607:f8b0:4004:c08::9b
2607:f8b0:4006:80a::200a
2607:f8b0:4006:80b::2002
2607:f8b0:4006:80d::2002
2607:f8b0:4006:80f::2002
2607:f8b0:4006:80f::200a
2607:f8b0:4006:817::2001
2607:f8b0:4006:817::200e
2607:f8b0:4006:81c::2004
2607:f8b0:4006:81c::200a
2607:f8b0:4006:81d::200d
2607:f8b0:4006:820::2003
2607:f8b0:4006:820::2008
2607:f8b0:4006:822::2003
2607:f8b0:4006:824::2002
2607:f8b0:4006:824::2006
2620:100:a001::18
2620:100:a001::4
2620:100:a001::c
2620:112:f002:bbbb::21
2620:112:f002:bbbb::23
2620:116:800b:21:a021:b886:81cc:55cf
2620:1ec:21::14
2620:1ec:c11::200
2a02:6ea0:c400::12
2a03:2880:f012:10c:face:b00c:0:3
2a03:2880:f112:182:face:b00c:0:25de
2a04:4e42:600::300
2a04:4e42::282
2a04:4e42::485
3.12.100.41
3.217.98.147
3.221.8.21
3.222.255.203
3.223.184.50
3.224.103.82
3.225.218.10
3.226.65.198
3.227.148.228
3.228.62.117
3.233.112.95
3.5.10.155
34.102.163.6
34.102.253.54
34.111.113.62
34.117.228.201
34.170.123.2
34.197.223.55
34.199.123.15
34.204.156.95
34.229.3.43
34.235.229.58
34.238.35.16
34.95.69.49
34.96.105.8
34.96.71.22
34.98.67.3
35.186.193.173
35.190.38.143
35.190.60.146
35.190.90.30
35.207.24.140
35.208.249.213
35.211.178.172
35.214.170.123
35.244.159.8
37.157.5.84
38.91.45.7
38.98.69.175
44.193.243.239
44.208.128.231
44.209.177.129
50.57.31.206
51.222.39.185
52.0.201.47
52.1.59.237
52.116.53.150
52.200.130.143
52.205.167.202
52.223.22.214
52.45.73.233
52.46.151.131
52.6.180.113
52.6.79.203
52.72.123.193
52.85.61.58
52.85.61.61
52.85.61.83
52.94.223.167
54.149.73.110
54.162.81.74
54.164.127.24
54.165.35.122
54.204.174.60
54.205.17.152
54.205.176.242
54.205.191.114
54.205.93.130
54.208.104.226
54.218.39.135
54.229.88.75
54.231.171.65
54.87.127.173
63.251.28.234
63.251.86.50
64.202.112.223
67.202.105.21
68.67.160.186
68.67.179.155
68.67.181.211
69.166.1.10
69.90.254.78
70.42.32.159
74.119.119.139
74.119.119.150
74.121.140.211
8.2.108.194
8.2.111.13
8.28.7.82
8.28.7.83
8.43.72.97
8.43.72.98
80.77.87.166
82.145.213.8
85.114.159.118
96.46.183.20
0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5
012a69ca45064c59cd497a10a916a6100805aa44c6f9a4297deb131d6de49ed8
0152a088a37330522c1458229707cbc27e42f802e1ba385d887b8a0069927618
01d6389de5581a2a3eb0cd4d6a05cb136bf07d221306f89173a080c73a38e392
03d9c6282533912a324c1d6f7c0c06583bed3f2c3a4a2331a6c36df3602faf52
041f41b6b98e101febe7d24b8d7fdd9fd696dabad0fbe296c978272491c2a791
04819970a784f5b35e5618e45433e7813caeabefca573681b08b4efe83a1c2f1
0525b14fcdbbea04789e242eb030aa5e3afbd5f91337c1571f6bd29973b318e1
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
0722c4b986cba2d0469918ef6c01e21bc9c1ec2f6f9c956034c661b66194f06b
076f2e88a9bf8677685af29386cd2303bcbcb6e3fea6e5d750ffd17bcd2786f6
080ad8b5d6dbbb1c8760424bf5cf690b492117512a8593405f40a22b97ee19e9
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5
0920d1b752bb81c97a4c069e057baba5e374276e3e083c76480493f594379c07
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0df040d8905696581aef6d13820ef1247a4bc3dd834c8d018717f9b7ca8da9c9
0e8e9fab28b24199f9d2b90a2b0996495b9d68cbe71550e5c4780bbf7028296f
0e964e7f290a0bc0a3e2e463b0b157fa3dc58f1d5d9cca75dedbc790ad8d42aa
0f27b15848fb3a09df5fa1ba8e2ae9a80ca73faca61455767cd28318fd3c2c6b
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8
123830b3c1bb951b81bee61657d5ff2d7061c67316a4210df730462d093b0a23
124f165a1243b48bd2ac21cebd8852c818c5deb7692fbfb5c80f5d5b72625da9
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
12b5eaccd8a9d81a6a12512566d2b72aa7c100b4a261a08ee6aae4679a9e36b4
12f6b13444fa341ce86121f27aae27f4e5cc214a6d55117c5669114cce37af75
1313e544d95566c0ed767f40117a8287940c2856fb450d6a4224b8db33a97902
136a576886a9ae3b5d55278a3e69a1fcc0a2189dfbf77ec41787742f260e5526
1399a208de4c491883a4af4dccf806555c8120282126f3935a25b9b1e6bcfcac
13c76ad5d0b5e7433f0c010b2f2c0b179682d1682b157cf9ca997cc42b047697
146ce9984266770e5e96199e4e59ca1fb5fede14f70758bcbf87654dac300667
14e71be3ff5aa2e7773210530b6f25ac38218c1833c4efec611f8c89e650db52
14f3a2330f6d02bcd5407635a03c7ab8ed1aa494914c05881137c5e86ae20acf
15b6c9e16fbb45357885cc0c935ea6546b4ddbec62e22f432871f0019e76ccf0
171ee6dba493728652f0f32fbf589b262e653211a5c1b5a32337d0ee73c1db51
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
182abb62bdb40059dbda691bf6631cf6b471499a85971a5fd04832453d7b4141
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
189b8ed64093b12937354b2ef71ccf1df59690d90432241a10fe1cb25000acba
19cf62598d79a5aefd372b5a0d49e5d8707bf9466b18582822fb1d00206c4ca3
19cf792a649556b6e99d788a69b1e501dc0748c010896e4fd4081eca8ab0983c
1aee66e2e24e851039801c0dace90f3efb7a1a17b033f7d5bbc12ca7c1d19432
1b18243b0fdaf9606ab14ee6891cb75119a94eff82eb28aae9a99044e73c67c7
1c4e7e389d73c6acf7f19cc812514e71230740791fde8a018c1d7edccf1590ae
1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903
1daff9b550fa13c5747e554b1913fd7da9c8c52a504ab47b1ed0f63e08fae8dd
20678c305b50c0988193d64cb34f41e2dcb6f2fa48353106436ea301e07ce70a
20c6f265ea521fc93792a5a13c5ab229fb6cc9d4aabf69eef36227e1a412880e
21b580c0e786d0ff2b8ef69d2808f19c17e9106f4effdf1771475ac870c81ea1
24999918b7aa7fd5adeca29162085186c3e7cdee5914709c9a927b46b48f05b9
25cfa100e98d444ccd37bdc5481f7af9ec68876226f8b718fe8c75d20675b1e0
270fb1f5320e32a7e0b8af9d3102063d8eb8950f4feb0ce3bb6c00536c1daa60
276faeaf9d33ceb5423b609ba36b6d9652353977c61458b8e9130d059870f7b6
27e29a5aebbbc2d82b6f7d9dbbf03ced7ecaf592adf68338a02aff332b3e7bd5
2943a138fb8248f4ef8d8ac14a988ef46f8bb5d3aa964ff227082c1651e46dbf
2a8bef1574342093b7a1f8057984f7e606eac758d05d1d08ec9ff728e97c53e4
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2aa50c9706f2175ff0a141b65a82f4c0a8907f75779f00d9d29d31a09c58121f
2ba9f6db8197931985739a30b9452a0f226ccfc1d2661912f84bc2aedbc4c74c
2c2c784f3e7e2763223d246c1d7b3a2e2b98bd5c005c5f585042da5c2b7259fe
2c95bbac8e167a1fd9297768d9c45d1f50db54733b750ae889b3a5efd2fae8fa
2d199b9d8dc7886837cbfd12c9e8ddae7e28f5c375d564b31bf732a320921435
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2f218961fc995f27f5868268ca3f765d4e7066eb6144139ce5b9eefe9b9ad443
2f218987261e49e368f7f85f9e5bf66f49f62032e96bb064c43064df8fc4e2fd
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
2f857dafdd9e3ffc93f414d1f032d980451560631d4ba2b9db1f7cf169f2647e
30dd4d046ee0a560951014c2c3f71fb0b620af27279bd7c5ff8b4ac877214291
31c86114d8c9683bade57e627634f040284e99a601deb292b961108e5d831415
320a526c59206598fcf37bc7e6950aa443a2d576bb2667a6bad7517d756f438c
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
342034f6a3303f4b800f89c04288036943a4b93226edb5741652ebd43af899d9
3542791df1565c5c4aff131de65e61fe174c1f11fc569812d5f8e6912a3d3129
359a049d00d909bccf224dd3a9abffdd44e3e11d2813a05deffffbd3b4b06477
35c21208c49b0522829345f46b651128b91ebd172add45203896265b49ba85b0
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
36ed4c503d280b26964aeb735d6345fe6f6b1a39a853045dca583c608185a024
375e907fa992d07dba30677afb1ddb2649f19b69945754a4edc524acd6630da2
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
3916390d4395ed16641c0e23d5e5a1bef9de6ce71b02c3941c0ee6f2d899c806
392c32f20b9f867852a946a6ed1c5e21476df9619083548b6585d80a3b5f9bd4
39b076e4bb4fab9b8a142499cf6155f8c128464974691a04de7e764f71b72618
3bfc649225cbc08df009bc048827f361f7dd9c718c575c9dcf3257c6639d3717
3cef1864f3b4a587c446729a5ee0eb8ae906ec76154e956b797e467c653d0024
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3d7a16ff1ffd8d8507acd6f1ac3f27609a4e979b0a8e37474d3e0ba43e20fe3c
3e7d49f24d56db02c7baca8ae3a17555c2e527571450e8c24c77b453407e267a
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
4375c83a59eca46627f11e4513026fd80535068b573548197485469ac700ebdc
4424132c76bd3b942b9a4b0dc628dc4cd5826b75022aca28ad4ae6a696f35437
44e66d26c636e0035f575e54c62db3e563f04b4530428c5794b597403f09e459
458c6aaf0d95748b153f982ffc22b9422a7628a3f1b488d0738ddc5419c6d7b0
45e53ed5d46fbbcb28c453cc49979df05b44a1ac9667138083ce59e2c3c266eb
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655
4639393dcd0ab58ce405486125e2696f793b0ce54c16b4f7a9831cc3a4c1cd6f
463b965e90a6c1e92161047e09f18a7b0c5bfe39c59de875536a744922f18285
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b
47837a16e7b231cca39151ae124c3cb8ad0fb875a78fb39ef15725f9bd7a8870
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
49396e4896729f4764a9a42d1a4a25f1850a5ffa9b5e96bbd49d02219a052867
4a214c63879acd030f5a7ca1de923bda71c3f122fd8903171ac921971faa1b1c
4a7cc3810e9012a315f69d1dc6a4089e5b1e8db39f1707d3dd4d22c67462bb51
4c216860f82a201e909b917ff2eca53e9787b05ec1fe5a69a0d4b994d95781c5
4ca18c247df52dd22650bd7f72f71d7c98102243b0ec474f683c6a279ad3a668
4d04e98fa76e2cdba4b0b45b0b206b13de39ff72f6371b7d97ed515e21646722
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
4fa898d9bdc34304905c4b165e561c8dc3fe452b0bdd7259140e1aa530a42136
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
50629fbe7dd47a2baa94f1b35db2ebf4db8493a978ec9c4832a9318a945bcefe
50be14a91ffbdf3c61032b2928cf5428487d098c95a77b05a4a7e4e968e257e5
51b9c4f1aa6c3e60906e6dad687a22e11aa9f5e517d748eafcba598b1a683b30
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
5313599a7ba29aa471cb611b901320d1c88c96a5e0524c1e92a71db0309d61eb
534e7aaabe61c7ae11f88d1333b1e55502401eec2127286a1f5d04eadb531172
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
564f6c7148cc692048ab0045cf24addc4a0db126afd08a5099dedbc2198b3793
58a07739b05fec4d319e4d5c6b1fa4ac79e2a625e08ab3f303929b77fde5bdf4
58e49f6c07c16c606b5def937eb4634c21a1d0ddc13343e5654b9e0c9395035d
5ad96953ed9f09eb237595f0947c8a02ebc9b14131cd128fecdfc16bf91297ba
5af7f54e4682da1be1484f658f9b15a84537085a4081cef229704a6d8e4ceb71
5b70d8eb19ca32d244e29e759e816c343be893232978532c9d5943f838e60e0b
5c2b76989e49a2bd8c651a35634fd43081b13bde1a6385fb8e36dccc1d0d42d8
5ce0cb7f558c1aca9c6e94c7d85d76db859218132923c039b7ef7b38a29f8dfd
5d7c5d22a81ee3d27800eb5d20b5f160efb6cf98d51dd1f0cca7485442f2c5f4
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
6020e58617f93875554a133f107b287c97dd12c8d8b6c0eb3f46f2d04a722be4
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
64816ef42196992f1120608cafa36df8e03c81064551abb6f23bc00f69bf6727
679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d
69008835f2aaaefd424c308c3e726d6ad4897186ce73fdce8b612c225e86dd39
6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7
6996ebcbbdb6064d3bc98f0822f185efe1fc4a2b771c7a3d0ab7e29a14e4177c
69a53fcf3211dade6aa649c3997d535142fe9eeee467952fa52ce847cea7605d
6a0b02c47df560d2d8a1c0b7f30caf6efcae920125e396d4e7d6960d68a4284c
6a71ac78889985a1f137d5c3045277ed1c699f0bed1bbdea4c8a298d46760e1f
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6cd3cf5f204d9c728f91590d92ce0fd61491617a06a9bbfd9928a6eed3e9088b
6cdf5b8d8528713b5a7b3fae738d27e6107afa0cc3a8e691a9d612303f6dfd7a
6ffeafdd2d5299330f3309269caf27336266ee44f677c88132458a06462d623c
70cc3f4a5c536a962bfd49a892efe43463c0c3491e347f55e232b497e6140126
70fd869f92915eb3c9f85d2d2b5a473ba45239ae463b35267642335337c46f06
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48
72fd07e085058fb4525cae979b256d00a8a5daa16ea4732d38915d183e573b25
735bbd15020c8fee03453f0c214734b19a34091290333905a1e628c8706c83e6
743fab9929b06e6ea08ee7296b84d0068d27d9fe7552b69f351a3298b968910a
74c0349fc386a4f27375a8f7f98c7867ce1f72ba65b9f040993a2bc8c6229ed0
75e752bf99299219069a5af90f61408be1ab85af71df9aea097bc70e9075c122
76506e128f2b47b7179f5037bd885a1674455ffeb6b5093cdb4c7eefbf436ce8
76bcae4994da8290d3a0fcf27ae859d958bc4916065051e21e1d667088d774e3
781b3e8726a42112cd2192dd9654cf6eaf79525c7780e3c4fd8469125cc99563
7921a6035cc8a0981a5dee737dd3d29b150ddd48407717d3fca4b6376f2b0e70
7a291479495fbb281655d5e870c6d118dc6b7ed18e8c235aef5974c1e9de4e6c
7a6e593f715545a4262c0d9a90d157b6b18ae0900ca6ddf3c6d568134310fc2f
7bd8b3e8c5d0f5c0a1c5ed3b69c09e4ae5edb40519ad8a1882b007ac3bf91901
7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80
7c459e92c840c50324355d1abc3515f9d88783fa297a5a32ec321faae98bcc11
7c46d9a954829d09583e3af58d09df0ab2773f37dc1e3ad593d382c2234fed47
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
7c9c80a6c32c0619d61c28f28723e68c5f8f75163e77ee5cf64c39e640e0d71e
7d36e30ddc7fac7fea357014c5e349ea9b553f85bda1a56d84d78bd1cc3e5667
7ec3afc5719abdc2b576bcc46186598c08f56c4b38e95aae295aaa9e1e436bdd
7f5d73c848836745a93ff7aa540a8f83f9899e3668628f42e9ba0cc6ef5e0b32
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
80fcbd06bbf276b74b41aa77405ffd52243587afb254d1efa88027c33fbba932
81cf69699c0d25e95029c3c986dda4e5e40dcf7983247704cc7b59178d5488fd
820bbf383e1e212ca7bd59f29af6ab490ea9da86e84d61ed3322b9c77ac2fc6c
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1
82759af516a4637540c242c907743840fd5ef5409ae76b8a456d317cb7802e07
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
839c424b188a9bdafd46e5b643a2c5afb4b7df5e51f0321ffafd5f23b118e259
83ae7ba0370974e803fb70ffffd92deb797d08198ed6310e207ba7d75b72029e
843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f
84b393cf7797232dc29d4fc9fc4c40fd9599a9dca8b42d3dfc44b565aabdc152
856ed99804bf5b83c5c70314917f7b561f06bfb50cc10ed5430a8fca2c40f246
8618b7faa3860c9994a18e59bec9c2f152b798e26b657990f466e7e9bb8594e2
8685554b355858b7ad6e0bc503213f89d6612b378719637bd032bf3912d1e79f
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
86b06208bcdc285fff5c59efc35df7900ba8690e816c54bd21d178ff70661d52
89fd4881bd0643ba125b564e9c436e642d94fe9e485e1b94627287d952145e2c
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a3814b54ebad0a60fe9e422bbfeb58847ea0fafc34984e232118c453de8ed15
8b8afd8f60833ca51907899d4a3279cdfd355282858ba8a73cd1034d2a1e31ff
8ef928fdfb8f3eeb4227af511515120e98219ce1326c45212eaecdad5cc8ae7a
8f5b3f7177261796d36de2d220664c09162d3877eb2e3868406c27ac952520a1
8f5f1bdf5f885e2067bfadab47400a17837840c9752225204c8005eb1bb441ab
91bcc65a1a6bb4755e48576889ae27c2f620e49d126b8127dd16c1a99945b9d5
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
933ff38629199ba200d23e1a3afda3ca9cae06352169926a4609942ab4d3742b
945cb43e5f380aa7de1193b7db86ff334c715527497b26018f0d59e1132613bc
94793d1f283d7310c7e6af2df264ab2500a74f48b4d20e48c01e8b855b7ba079
94e650b60acf6e50be7e802f67da8498ab9045196885d191095e5e255ed49c3b
95b1a4f10a67530bf1dcc8d046add868fdca02845b8fd809997a0373a6dc6d02
968e70b795f2e2dbddb5a2f72ecb21dea793e8e83fff6bbdb7596a81904212c2
986ccecb5ddec6d653cdb03022cbb35af07301b752cad8ac1d6c7aa66a11e661
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
996137f6a3d1b6bb4304905b5e80598bd8549fbeb143f721e38c05ef03fd9f67
99c47758a036d48e79e2e9eecf9c9d6ffd5c6774b1c8a853b6ea04181349e60e
9acbf281eb40cf5cfe6f99004de5947dde55323b73244206ef2003aa7114380f
9b011aa3ebe78455e2384c17b0bd9abbd8b603582d0be286af5d497ebb8715d7
9b2b625993442a83fec803465a134e64eb5b3a3b792db5c113cb6181084970a4
9bd6d9c253dccd4b71b6081a9464bc0a05bf0bc494b5ba5bcb248cffa690233a
9c6bbd3ccfb7769c5995831c6c1d9fd73c42c92b85f263dbacc57fcd5039d84a
9c90f89738ccfabcf8efe982431cb34af8b0799ffc773b917a9030c4c15b3008
9e1dae23d3ad3212f67d09ca79a50003c32953c36bab976f634c9b38d8a8c6dc
9f2692b4c971b6a04ef943de0878ddeeca750e7f009fc85b7eaa646bccbb5290
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1b053b5e005612a140e8a725c0dcdc5393c15d3c4cc45164fece0f9e8f2cbd4
a25889f5ebf9993b4156b809205958474ddd82c1b22fb2bee11725e50b9475db
a28efcd4ff69a326484b26ac0e2fa77215c8ed8f2d1e80763bf5c506f6980126
a41b806e591339f4357460a85a5c04b8f473f1c80ef3a1c3e3e14cf76f4471d4
a48b96eb4dbabdf7d10b4a7667062cd55b7c1f9aab381f05c916798ec4308f68
a48d87c0b7d5650d51384f76278057edda56531367bd8258baaa9c944f5a65c2
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e
a54690656b18f041c597eb704cbc6ee95c571db2ed7460392e7c49b899dcc74f
a63284d0b07236a49f89dd197f9aa2ea595e314e750b5d42834fbda2f7cba411
a66d49bc3e3826c00383689d422a6ba78dc03d534fd1bc96bc50027b97f78c47
a6911b93d58f69e12e4de2a4d9367553d6ec3cde022316d36e3884255d21e625
a695b8b12c7d88355d0b1b33d6c643a7913bcfbeae91553bd7560019188b1032
a800be47e589df526eee6a11643f60c0fbdb2f8d76428a4cd727a95be85959c6
a832c721859e66024092445300431d52b19ce96eb53588ad13954e78be2a8580
a8e977cdd82a0e8e0528dffd3f95ae42c4ce4bf9664b19f29bf429014597fef8
a9b8757ef83403b67a3f6d10da0c8f4259179fe48a775020aeb65ab9e1791cc3
ab7ff044ec2e95bca736f374cf86af08c260384fbcf871032bd54e2b4ef509a9
ab8517f3d5171dd42a8b9c22af6a2f944b41d00e7ea54ba02b4ed71a6c59e543
abe6d535e85eb415042aa3dcaac597d0e3d77ca7a5f7f7b2c59330f592305927
ac888a811086e5e08352c3dc0d0b704206641c37f78b1932c3ca956367aed497
acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a
ad06738da02c7ce4be4eb368611d30a80b63bccb7c5d5c382bf4951a40aa7eeb
ae7035fc79c92988ad3abf6bbcd7fffb307e0e5c76c140efe0b899bd4380bfb7
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
aee4051a20e975b9bb6fdc20984a091eb1f55c35ea87abe441db4cdbe8c116d0
af791f4ecfb200dd519a03dc1760721fd4fc36cd3ef9f0b5caf592f9a3d49b91
aff8084000d2c0e029860444700f6c44b5d0124101ae9f87a9bb7d6b574fe24e
b0d0d8d4d905ad8cf5c26b2f074de1b2ad84074a222065a512f51b3298494371
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5
b34b500b4fe4d4f0be72fcb5b7c582c472495b1498072d19a1aaac0dc2022195
b36d838681171ab6906d3206d2fd6cc17a7a7a5867213c7595fe0865aeb9e969
b4d8b4da9350b936073ac3daf82910803670c88f6a5c25887d771f1423baf771
b626c96f7181810eea07b9923387a2180b444b4c11afd95e97727990d1eb62f0
b95d281b5eec08a951b4908f4f22850b5a4a3ac6c4479239a2dbc77af58406c7
b9635dbf46ae9928791d0cb10f66f32b67936e42157d6c237db3c2bce0c417ff
ba5a6577ef04a324ae8a4af890e1e26d341ac85bc5c49ad9be1678a61fcc3168
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bc82310d2b82f3aa74a269e8f679359bda827c649adb41486fd1af268a026ac1
bd8a3e2eebba2e653c520fa58d4190c498feaaf10617786676e2d11dfe90143d
bf7da55ef6be4cdd0d0932dd1e689a423b9b04c68e3cc9b083d4c099bf0e0ec9
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c2242c272fff953716d39aa11fa0641d72c1665ad340d3a8d203a60a9a5f3fab
c38bc51d1b1c8db7f2037ae18da46d0fb6733d3e7bee635e160eb73f870d5a6e
c39f52b470f03d5420edf48b5920e0b572de669ef780e8aa5b763761a29318f3
c479ded7110d7875b380d38d7ce1c4a621dd98454ee982c7b93e7e028e8f504e
c540cdeba4eb897beea1c93c6452269a4de7b86a2e670b5b0ad37f9bbfc78c53
c5993f8467dfbb45dfd3f751abd48089b840da8105caca380d0bc0f8ec387b11
c5cf2d8a000a59f5ca421f8cbe9cc0d82a45ba2f8d995fa16621c0f354eae1f7
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
c6038de77c2fca2f75327c1e7ec4751a8d45cc3737395a2abe403ac6d8e98144
c624e866cbaa055c978d2fe5ea4b50c49f3ee600553ada6d8dc76b9020c36911
c65deba56ff3d2973b7770c8f88617751f286efefc1373918171d50a11606c38
c9a5de87df1a5954c5cdae18f6fc369eb606102c6410bc789452c3275f0a6b19
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ca87576c6d1999cc17e5d414e32426414a2aa7d37411254b1c85e8bd6ced98f9
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cbaa97c65cc434cc1e1af32d1d79ffa851b696d709b4a523d304cbcf07c74810
cbccc935557398179deeef044a5ab2353e97ca4961f313793c8ba03964c43e93
cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7
cce6681da3f7d009656fff2e5519d4114821d0ca4d46bff322e363185a0644e2
cd0b7385c8a691d9b2e7af11f3fbe1e7b1f42ecf11531882594908bf4a1b830e
cd26f237e390f167f6865ad683caed6c706218559452d463647e95a00f2f3f0c
cdd102d71e33401eb5ebadb19f1732edafa44df8800da6d33f29329c3ed9baef
ce02a171fe79c0155c0e09b826d4e6542ab09be711d05cf4d75d569622a9d24c
ce06fb43716decbbd5182b120b5f1190987489a47a06c14f2d7da24d72a01338
ce0b2808278fa694a3c6c1f14a34b316b59cc54bd6d344d5b055ebd671ae9b18
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfa0f62e6945357df2151c78ce2c2f6083267f272f1f3e50256df685024e13af
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
d06f7ba64204195da21d80f059716697760715dbf3156c0d712407369204bea0
d11c890775a394156175e04ecc45e9b4a963c04d145f5da14c024f99cd364040
d1919bf0d2b3e6b6515a0859dfb9966d76ca96e9ff27ddbfb6c3c8f252223012
d2943288882559692f85ae8d29de8bf78c448aed6c6990bca2a7290b32661335
d2cf823ebd1e2d7b0649b99673b599eda7de0e6f83e2ef0d09531576709b0ec8
d3110f199d22d9d122a62c288cca3b3c80edccdb2979c02bcbfa0602a7b88039
d4d780ac217b03cad2bf9c36c3d7ee304daf770314e7b04b960be07eab27ee20
d563298c3ede28f01a71384931c619cda9aadce1007034f284f3c0f0316303f0
d5e889f775032de008372506f023edce28f84ca96ee75bed29e61f53ffea661d
d623d4148afe3958f8cf929fccf8a2661b93a30e7f0550fd26f478dca78ab492
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc
d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838
d7f817255acac24d24766a420471f23c0796b5228b84f8432bf70570ed870b72
d8b0939d4ad62069a09916859d301d5a0d9c00e9174ad682c53bc122a35bf80e
d9f2778c47db32b56109a39c8c3393b7e213095aa043df32153367708a50dcd0
dace6cab302ff281cc680642030b526bdddbe24130e1bdd495997bf632fdae7d
db1be639c6bb1d11edb8c716a629847c3e0f5492de69797d3619b34ddd34e878
dc0da2082ec514b4250ffe29a176826c3aef94d4ca0f887586528add66a99f16
dccc8000ccab06caefaa66f54be07443950b7de66c0caead3361d719a744820d
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
ddade1a46b9718110f9f2da49a59af2692a32689553f8e9a1ace3fe5c426b2b7
de39a860f34cfc161a6c88b3acd18a5a113114e00d5f2a6bbb0b51a47401e48d
dead1f4e72e8cf849bdac46b95a197af4af11ed48877c2db53f38c3b7f43e545
def2c0929f78f2e330fc17831944b2a5c243d24dc5fec1b450316cb4ac51a9bc
df3ac0dbcf2d632d347eedf170353a58fe7d9b6076fea9394ad9858a38b49bd9
e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3
e23decabee8464b650d1d0241283ba0c469806e14a2199efc5bb41771cb673c1
e290f9c19dfad3c2315c85940a7a71eaf7c05a66339b46cdcd4aa35a757122a9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3b9d318b3157ccbfc3bb00e82a446613294f9a592c01537662386bd848882b7
e4283c0e9297a08c5f3c75005c1f15b5c640066bca050c74137c011ec0b79a5c
e42869601ae87a83476b74dbfb615c3acde329931afc04beea4bd387f3703c7e
e5477888a979c7b864fafa6a3de860371886602af3e9d0be3f838e7c10dd5500
e561b7eb91282aba0090eb6b74465305f2dbfd9c5ff885d344ec2721fe6f978f
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e63c46e15e148962820668a59329859371a06429118e264e6d3644904d58a31d
e70ff8ef92586d3efeec1e4e340a94e9e51263be5056883e3ed0777054b9c78d
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
e803cd8c5031ac6b0d099a2d96ba1c3ee44782649a7f7c6f0d09b6410d93e216
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
e985202d7b74f3bee4ed6174b6fd0d49dc03f51a8d0b36c0c4a2b8fe32364310
eabc0f4a5b76ceb76d11713e56e77dc230f3672c9df4c43a79089fa69b056033
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
ebe1af001ddd00d6acfa7e96e0fd29c8f5ba7de6edc2f50705c348b92cb95fd6
ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a
eccd3e6ef939c2a2e18a7c4bc6a4f386da8b4c131ae3d4b8c1647d8c73999142
ee004e19a65d9657ccfd05c3c15ed2a49fafecb011b8dc60c799da2fc606fdcf
ef13b0253a986d36b9de961b9d657b6735fc409299b451d1e9a1454f66ce2fec
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f12d6fbc698a86e031a02ec633dbb80274af370c201d2fe6fe9b1ee1fbbdbfaa
f243d14902455008e5e263bd756f90991b996db063d9100441da64c55aa3c5c0
f2c1ab05d66fb469c9cc80f596c91b0bf30b021f24cfe463935a093fb1c6c467
f383b3a7fb8f61a6d02aaf4f4f1708e114500e0e42576eca74f63392e41b52ed
f3988a8a95c5faec9bb5307667596b220a12d277072950244393b5f33091e2fb
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f42437392991256301d04a743ae9c380aae62faef9a5bb0d4dde967ae9681df9
f63b683b181032b37e4b8a3fe5d001edc0b40a8df47c66b7966e2e7242f0226d
f67c1dae64731f037f0dcd7598af600024c9546bbdeed1c9f7185b027ef65bb4
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9
f6d8894bccb6968f9c55a23894a63a454f3425a7a4c19251ba01d9e3493084a0
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f8e60fa507399273a3862f6ca5b4daf3df1b225801d641c564a10336e84773e5
f9c4ffcfab2c93ba07bd2d4a2dd53a1d23faace457ade18c52c3f4ea67b8ea68
f9d24c71e954513157a412b5339112437e013cf99070b258e445101f16747500
f9e7478a7ceb5f02339cda0af1f0df3c8f3d108b1f9d5323b962017919ae555f
fa6c9a57d2b1b4f5b343af93f462f46895bdef76492379b49c33d39a3ff61a07
fd705313149bd84c7cb7b012cae41688c028a08c8c120560b9a888ff35c68cd1
feb0e7f17014201ea9124f23e3f63965411385abf0103fc682595d0674087a0c
ffb5be291b495f1911e27e992160ade6b35159ba682a4d0a3d5575026ab8037a