www.wintersexpress.com Open in urlscan Pro
192.104.182.109 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.wintersexpress.com/
Submission: On November 25 via api (November 25th 2024, 7:53:26 am UTC) from CA — Scanned from CA

Summary HTTP 238 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 61 IPs in 3 countries across 43 domains to perform 238 HTTP transactions. The main IP is 192.104.182.109, located in United States and belongs to LEE-ASN, US. The main domain is www.wintersexpress.com.
TLS certificate: Issued by WR1 on October 26th 2024. Valid for: 3 months.

This is the only time www.wintersexpress.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 10	192.104.182.109 192.104.182.109	10668 (LEE-ASN) (LEE-ASN)
49	104.16.132.24 104.16.132.24	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4004:c08::5f	15169 (GOOGLE) (GOOGLE)
13	142.251.16.156 142.251.16.156	15169 (GOOGLE) (GOOGLE)
8	2600:9000:219... 2600:9000:2199:d000:18:a82e:7180:93a1	16509 (AMAZON-02) (AMAZON-02)
2	37.19.207.34 37.19.207.34	60068 (CDN77 Dat...) (CDN77 Datacamp Limited)
3	2607:f8b0:400... 2607:f8b0:4004:c21::61	15169 (GOOGLE) (GOOGLE)
3	108.138.70.84 108.138.70.84	16509 (AMAZON-02) (AMAZON-02)
6	142.251.167.94 142.251.167.94	15169 (GOOGLE) (GOOGLE)
1	18.160.10.17 18.160.10.17	16509 (AMAZON-02) (AMAZON-02)
1	104.94.117.85 104.94.117.85	16625 (AKAMAI-AS) (AKAMAI-AS)
2	3.167.69.118 3.167.69.118	16509 (AMAZON-02) (AMAZON-02)
3	104.18.29.101 104.18.29.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:10:... 2606:4700:10::6816:34ad	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:10:... 2606:4700:10::ac43:266a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	3.167.98.152 3.167.98.152	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:4004:c08::8a	15169 (GOOGLE) (GOOGLE)
3	99.84.208.21 99.84.208.21	16509 (AMAZON-02) (AMAZON-02)
1 15	2606:4700:10:... 2606:4700:10::6816:445	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	35.244.193.51 35.244.193.51	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	142.250.31.97 142.250.31.97	15169 (GOOGLE) (GOOGLE)
5	99.86.191.237 99.86.191.237	16509 (AMAZON-02) (AMAZON-02)
1	3.227.77.161 3.227.77.161	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:9000:219... 2600:9000:2199:6400:a:e047:754:f4a1	16509 (AMAZON-02) (AMAZON-02)
1	2620:100:a00b::4 2620:100:a00b::4	19750 (AS-CRITEO) (AS-CRITEO)
1	34.102.146.192 34.102.146.192	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	34.96.70.87 34.96.70.87	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a04:4e42::485 2a04:4e42::485	54113 (FASTLY) (FASTLY)
1	2607:f8b0:400... 2607:f8b0:4004:c21::84	15169 (GOOGLE) (GOOGLE)
5	2606:4700:10:... 2606:4700:10::ac43:17ea	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2001:4860:480... 2001:4860:4802:36::181	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c17::9c	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c19::9d	15169 (GOOGLE) (GOOGLE)
1	142.251.16.94 142.251.16.94	15169 (GOOGLE) (GOOGLE)
1	162.19.138.83 162.19.138.83	16276 (OVH OVH SAS) (OVH OVH SAS)
1	35.81.219.226 35.81.219.226	16509 (AMAZON-02) (AMAZON-02)
2 2	68.67.160.184 68.67.160.184	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	35.244.159.8 35.244.159.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	8.28.7.83 8.28.7.83	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	69.173.151.100 69.173.151.100	26667 (RUBICONPR...) (RUBICONPROJECT)
3 3	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
3 3	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	172.253.63.155 172.253.63.155	15169 (GOOGLE) (GOOGLE)
1 1	2620:112:f008... 2620:112:f008:200::101	26120 (RHYTHMONE) (RHYTHMONE)
1 1	2607:f350:3:2... 2607:f350:3:2569:0:10:0:c	27630 (AS-XFERNET) (AS-XFERNET)
1	35.190.39.111 35.190.39.111	15169 (GOOGLE) (GOOGLE)
2	2600:9000:230... 2600:9000:2305:a800:8:4487:bd00:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:230... 2600:9000:2305:a600:8:4487:bd00:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:4004:c1f::66	15169 (GOOGLE) (GOOGLE)
2	162.19.138.117 162.19.138.117	16276 (OVH OVH SAS) (OVH OVH SAS)
1	35.163.144.222 35.163.144.222	16509 (AMAZON-02) (AMAZON-02)
18	142.250.31.155 142.250.31.155	15169 (GOOGLE) (GOOGLE)
14	172.66.42.247 172.66.42.247	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 8	2607:f8b0:400... 2607:f8b0:4004:c17::84	15169 (GOOGLE) (GOOGLE)
1	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	142.251.111.100 142.251.111.100	15169 (GOOGLE) (GOOGLE)
1	2600:9000:207... 2600:9000:2073:6000:1c:2afd:fb00:93a1	16509 (AMAZON-02) (AMAZON-02)
1	18.67.76.20 18.67.76.20	16509 (AMAZON-02) (AMAZON-02)
1 2	2600:9000:207... 2600:9000:2073:3600:1b:6b7d:2300:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2620:100:a00b... 2620:100:a00b::12	19750 (AS-CRITEO) (AS-CRITEO)
1	2607:f8b0:400... 2607:f8b0:4004:c1f::5f	15169 (GOOGLE) (GOOGLE)
1	54.164.90.29 54.164.90.29	14618 (AMAZON-AES) (AMAZON-AES)
3	172.253.122.156 172.253.122.156	15169 (GOOGLE) (GOOGLE)
2	64.233.180.155 64.233.180.155	15169 (GOOGLE) (GOOGLE)
4	2607:f8b0:400... 2607:f8b0:4004:c06::84	15169 (GOOGLE) (GOOGLE)
2	172.253.115.105 172.253.115.105	15169 (GOOGLE) (GOOGLE)
1 1	2600:1f18:730... 2600:1f18:730:b110:1eec:45ae:7d5c:c1ff	14618 (AMAZON-AES) (AMAZON-AES)
1	23.20.101.159 23.20.101.159	14618 (AMAZON-AES) (AMAZON-AES)
238	61

10 192.104.182.109 (United States) 1 redirects

ASN10668 (LEE-ASN, US)
PTR: cms.us-midwest-1.vip.tn-cloud.net

www.wintersexpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

49 104.16.132.24 (None, )

ASN13335 (CLOUDFLARENET, US)

bloximages.chicago2.vip.townnews.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c08::5f (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 142.251.16.156 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f156.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:2199:d000:18:a82e:7180:93a1 (United States)

ASN16509 (AMAZON-02, US)

discovery.evvnt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.19.207.34 (Ashburn, United States)

ASN60068 (CDN77 Datacamp Limited, GB)
PTR: 37-19-207-34.bunnyinfra.net

s3.tradingview.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.tradingview-widget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4004:c21::61 (Washington, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 108.138.70.84 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-70-84.iad12.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.251.167.94 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: ww-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.160.10.17 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-160-10-17.iad12.r.cloudfront.net

config.aps.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.94.117.85 (Ashburn, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-94-117-85.deploy.static.akamaitechnologies.com

secure.cdn.fastclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.167.69.118 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-167-69-118.iad61.r.cloudfront.net

tags.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.29.101 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn-ima.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:34ad (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.hadronid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::ac43:266a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.167.98.152 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-167-98-152.iad55.r.cloudfront.net

aax.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c08::8a (Washington, United States)

ASN15169 (GOOGLE, US)

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 99.84.208.21 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-208-21.iad79.r.cloudfront.net

discovery.evvnt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2606:4700:10::6816:445 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

id.hadron.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ids.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
proton.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.244.193.51 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 51.193.244.35.bc.googleusercontent.com

lexicon.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.31.97 (United States)

ASN15169 (GOOGLE, US)
PTR: bj-in-f97.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 99.86.191.237 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-191-237.iad79.r.cloudfront.net

cdn.segment.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.227.77.161 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-227-77-161.compute-1.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2199:6400:a:e047:754:f4a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.prod.uidapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:100:a00b::4 (United States)

ASN19750 (AS-CRITEO, US)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.146.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.146.102.34.bc.googleusercontent.com

oa.openxcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.70.87 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 87.70.96.34.bc.googleusercontent.com

invstatic101.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c21::84 (Washington, United States)

ASN15169 (GOOGLE, US)

846d83c2930c516597075cc9390fed92.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:10::ac43:17ea (United States)

ASN13335 (CLOUDFLARENET, US)

a.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixels.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
seg.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:36::181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c17::9c (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c19::9d (Washington, United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.16.94 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f94.1e100.net

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.19.138.83 (Frankfurt am Main, Germany)

ASN16276 (OVH OVH SAS, FR)
PTR: ns31532338.ip-162-19-138.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.81.219.226 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-81-219-226.us-west-2.compute.amazonaws.com

ids4.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.160.184 (Colonia, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.159.244.35.bc.googleusercontent.com

u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 8.28.7.83 (United States) 2 redirects

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.151.100 (United States)

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 15.197.193.217 (Seattle, United States) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.111.113.62 (Kansas City, United States) 3 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.63.155 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f155.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:112:f008:200::101 (United States) 1 redirects

ASN26120 (RHYTHMONE, US)

d.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f350:3:2569:0:10:0:c (United States) 1 redirects

ASN27630 (AS-XFERNET, US)

sync.go.sonobi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.39.111 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 111.39.190.35.bc.googleusercontent.com

esp.rtbhouse.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2305:a800:8:4487:bd00:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.prod.discovery.evvnt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2305:a600:8:4487:bd00:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.prod.promo.evvnt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c1f::66 (Washington, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.19.138.117 (Frankfurt am Main, Germany)

ASN16276 (OVH OVH SAS, FR)
PTR: ns31533568.ip-162-19-138.eu

lb.eu-1-id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.163.144.222 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-163-144-222.us-west-2.compute.amazonaws.com

api.segment.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 142.250.31.155 (United States)

ASN15169 (GOOGLE, US)
PTR: bj-in-f155.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 172.66.42.247 (United States)

ASN13335 (CLOUDFLARENET, US)

resources.infolinks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
router.infolinks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rt3060.infolinks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2607:f8b0:4004:c17::84 (Washington, United States) 2 redirects

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 142.251.111.100 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: bk-in-f100.1e100.net

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2073:6000:1c:2afd:fb00:93a1 (United States)

ASN16509 (AMAZON-02, US)

d-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.67.76.20 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-67-76-20.iad89.r.cloudfront.net

api.intentiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2073:3600:1b:6b7d:2300:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

sync.intentiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:100:a00b::12 (United States)

ASN19750 (AS-CRITEO, US)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c1f::5f (Washington, United States)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.164.90.29 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-164-90-29.compute-1.amazonaws.com

idx.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.253.122.156 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f156.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.233.180.155 (United States)

ASN15169 (GOOGLE, US)
PTR: on-in-f155.1e100.net

ep1.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c06::84 (Washington, United States)

ASN15169 (GOOGLE, US)

ep2.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.115.105 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f105.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b110:1eec:45ae:7d5c:c1ff (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.20.101.159 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-20-101-159.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
49	townnews.com bloximages.chicago2.vip.townnews.com — Cisco Umbrella Rank: 26052	654 KB
27	googlesyndication.com 2 redirects 846d83c2930c516597075cc9390fed92.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 110 tpc.googlesyndication.com — Cisco Umbrella Rank: 173	1 MB
21	ad.gt 1 redirects id.hadron.ad.gt — Cisco Umbrella Rank: 1519 a.ad.gt — Cisco Umbrella Rank: 1619 p.ad.gt — Cisco Umbrella Rank: 1714 ids.ad.gt — Cisco Umbrella Rank: 1557 ids4.ad.gt — Cisco Umbrella Rank: 2415 pixels.ad.gt — Cisco Umbrella Rank: 1708 seg.ad.gt — Cisco Umbrella Rank: 1984 proton.ad.gt — Cisco Umbrella Rank: 4167	21 KB
20	doubleclick.net securepubads.g.doubleclick.net — Cisco Umbrella Rank: 218 stats.g.doubleclick.net — Cisco Umbrella Rank: 135 td.doubleclick.net — Cisco Umbrella Rank: 182 cm.g.doubleclick.net — Cisco Umbrella Rank: 284 googleads.g.doubleclick.net — Cisco Umbrella Rank: 43	213 KB
15	google.com fundingchoicesmessages.google.com — Cisco Umbrella Rank: 695 analytics.google.com — Cisco Umbrella Rank: 142 www.google.com — Cisco Umbrella Rank: 3	76 KB
14	infolinks.com resources.infolinks.com — Cisco Umbrella Rank: 6954 router.infolinks.com — Cisco Umbrella Rank: 2853 rt3060.infolinks.com — Cisco Umbrella Rank: 79517	140 KB
14	evvnt.com discovery.evvnt.com — Cisco Umbrella Rank: 33744 cdn.prod.discovery.evvnt.com — Cisco Umbrella Rank: 42601 cdn.prod.promo.evvnt.com — Cisco Umbrella Rank: 60893	524 KB
10	wintersexpress.com 1 redirects www.wintersexpress.com	109 KB
7	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	615 KB
6	adtrafficquality.google ep1.adtrafficquality.google — Cisco Umbrella Rank: 389 ep2.adtrafficquality.google — Cisco Umbrella Rank: 403	32 KB
6	33across.com 1 redirects cdn-ima.33across.com — Cisco Umbrella Rank: 1329 lexicon.33across.com — Cisco Umbrella Rank: 1453	14 KB
6	gstatic.com fonts.gstatic.com	142 KB
5	segment.com cdn.segment.com — Cisco Umbrella Rank: 1935	43 KB
5	amazon-adsystem.com c.amazon-adsystem.com — Cisco Umbrella Rank: 347 config.aps.amazon-adsystem.com — Cisco Umbrella Rank: 687 aax.amazon-adsystem.com — Cisco Umbrella Rank: 468	93 KB
4	liadm.com 1 redirects d-code.liadm.com — Cisco Umbrella Rank: 3414 idx.liadm.com — Cisco Umbrella Rank: 1368 rp.liadm.com — Cisco Umbrella Rank: 966 rp4.liadm.com — Cisco Umbrella Rank: 5689	49 KB
3	intentiq.com 1 redirects api.intentiq.com — Cisco Umbrella Rank: 2238 sync.intentiq.com — Cisco Umbrella Rank: 1052	3 KB
3	tapad.com 3 redirects pixel.tapad.com — Cisco Umbrella Rank: 470	1 KB
3	adsrvr.org 3 redirects match.adsrvr.org — Cisco Umbrella Rank: 377	2 KB
3	id5-sync.com cdn.id5-sync.com — Cisco Umbrella Rank: 1004 id5-sync.com — Cisco Umbrella Rank: 533	58 KB
3	crwdcntrl.net tags.crwdcntrl.net — Cisco Umbrella Rank: 1010 bcp.crwdcntrl.net — Cisco Umbrella Rank: 1026	26 KB
2	eu-1-id5-sync.com lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 946	587 B
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 36
2	pubmatic.com 2 redirects image2.pubmatic.com — Cisco Umbrella Rank: 886	677 B
2	openx.net 2 redirects u.openx.net — Cisco Umbrella Rank: 761	763 B
2	adnxs.com 2 redirects secure.adnxs.com — Cisco Umbrella Rank: 495	2 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29 imasdk.googleapis.com — Cisco Umbrella Rank: 506	147 KB
1	criteo.com gum.criteo.com — Cisco Umbrella Rank: 450
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 225	4 KB
1	segment.io api.segment.io — Cisco Umbrella Rank: 1510	179 B
1	rtbhouse.com esp.rtbhouse.com — Cisco Umbrella Rank: 4214	442 B
1	sonobi.com 1 redirects sync.go.sonobi.com — Cisco Umbrella Rank: 915	667 B
1	turn.com 1 redirects d.turn.com — Cisco Umbrella Rank: 1126	443 B
1	rubiconproject.com token.rubiconproject.com — Cisco Umbrella Rank: 500	1 KB
1	google.ca www.google.ca — Cisco Umbrella Rank: 11557	63 B
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 318	898 B
1	creativecdn.com invstatic101.creativecdn.com — Cisco Umbrella Rank: 2700	1 KB
1	openxcdn.net oa.openxcdn.net — Cisco Umbrella Rank: 2357	8 KB
1	criteo.net static.criteo.net — Cisco Umbrella Rank: 793	13 KB
1	uidapi.com cdn.prod.uidapi.com — Cisco Umbrella Rank: 4220	4 KB
1	hadronid.net cdn.hadronid.net — Cisco Umbrella Rank: 1791	12 KB
1	fastclick.net secure.cdn.fastclick.net — Cisco Umbrella Rank: 1120	17 KB
1	tradingview-widget.com www.tradingview-widget.com — Cisco Umbrella Rank: 27723
1	tradingview.com s3.tradingview.com — Cisco Umbrella Rank: 16886	5 KB
238	43

	Domain	Requested by
49	bloximages.chicago2.vip.townnews.com	www.wintersexpress.com
18	pagead2.googlesyndication.com	securepubads.g.doubleclick.net pagead2.googlesyndication.com blank www.wintersexpress.com
13	securepubads.g.doubleclick.net	www.wintersexpress.com securepubads.g.doubleclick.net pagead2.googlesyndication.com imasdk.googleapis.com
11	fundingchoicesmessages.google.com	securepubads.g.doubleclick.net
11	discovery.evvnt.com	www.wintersexpress.com discovery.evvnt.com
10	www.wintersexpress.com	1 redirects www.wintersexpress.com
9	ids.ad.gt	1 redirects www.wintersexpress.com
8	tpc.googlesyndication.com	2 redirects securepubads.g.doubleclick.net www.wintersexpress.com
7	resources.infolinks.com	www.wintersexpress.com router.infolinks.com resources.infolinks.com
7	www.googletagmanager.com	www.wintersexpress.com www.googletagmanager.com p.ad.gt
6	fonts.gstatic.com	fonts.googleapis.com
5	cdn.segment.com	www.wintersexpress.com cdn.segment.com
4	ep2.adtrafficquality.google	pagead2.googlesyndication.com ep2.adtrafficquality.google securepubads.g.doubleclick.net
4	rt3060.infolinks.com	resources.infolinks.com
3	googleads.g.doubleclick.net	pagead2.googlesyndication.com
3	router.infolinks.com	resources.infolinks.com
3	pixel.tapad.com	3 redirects
3	match.adsrvr.org	3 redirects
3	p.ad.gt	a.ad.gt p.ad.gt
3	lexicon.33across.com	1 redirects www.wintersexpress.com cdn-ima.33across.com
3	cdn-ima.33across.com	www.wintersexpress.com securepubads.g.doubleclick.net resources.infolinks.com
3	c.amazon-adsystem.com	www.wintersexpress.com c.amazon-adsystem.com
2	www.google.com	ep2.adtrafficquality.google
2	ep1.adtrafficquality.google	pagead2.googlesyndication.com www.wintersexpress.com securepubads.g.doubleclick.net
2	sync.intentiq.com	1 redirects www.wintersexpress.com
2	lb.eu-1-id5-sync.com	cdn.id5-sync.com
2	www.google-analytics.com	www.googletagmanager.com
2	seg.ad.gt	p.ad.gt
2	cdn.prod.discovery.evvnt.com	www.wintersexpress.com
2	cm.g.doubleclick.net	www.wintersexpress.com
2	image2.pubmatic.com	2 redirects
2	u.openx.net	2 redirects
2	secure.adnxs.com	2 redirects
2	analytics.google.com	www.googletagmanager.com
2	a.ad.gt	cdn.hadronid.net p.ad.gt
2	id.hadron.ad.gt	cdn.hadronid.net
2	cdn.id5-sync.com	www.wintersexpress.com securepubads.g.doubleclick.net
2	tags.crwdcntrl.net	www.wintersexpress.com securepubads.g.doubleclick.net
1	rp4.liadm.com	www.wintersexpress.com
1	rp.liadm.com	1 redirects
1	idx.liadm.com	d-code.liadm.com
1	imasdk.googleapis.com	resources.infolinks.com
1	gum.criteo.com	static.criteo.net
1	api.intentiq.com	resources.infolinks.com
1	d-code.liadm.com	resources.infolinks.com
1	proton.ad.gt	p.ad.gt
1	cdnjs.cloudflare.com	bloximages.chicago2.vip.townnews.com
1	api.segment.io	cdn.segment.com
1	pixels.ad.gt	p.ad.gt
1	cdn.prod.promo.evvnt.com	www.wintersexpress.com
1	esp.rtbhouse.com	invstatic101.creativecdn.com
1	sync.go.sonobi.com	1 redirects
1	d.turn.com	1 redirects
1	token.rubiconproject.com	www.wintersexpress.com
1	ids4.ad.gt	www.wintersexpress.com
1	id5-sync.com	cdn.id5-sync.com
1	www.google.ca	www.wintersexpress.com
1	td.doubleclick.net	www.googletagmanager.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	846d83c2930c516597075cc9390fed92.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	cdn.jsdelivr.net	securepubads.g.doubleclick.net
1	invstatic101.creativecdn.com	securepubads.g.doubleclick.net
1	oa.openxcdn.net	securepubads.g.doubleclick.net
1	static.criteo.net	securepubads.g.doubleclick.net
1	cdn.prod.uidapi.com	securepubads.g.doubleclick.net
1	bcp.crwdcntrl.net	tags.crwdcntrl.net
1	aax.amazon-adsystem.com	c.amazon-adsystem.com
1	cdn.hadronid.net	www.wintersexpress.com
1	secure.cdn.fastclick.net	www.wintersexpress.com
1	config.aps.amazon-adsystem.com	c.amazon-adsystem.com
1	www.tradingview-widget.com	s3.tradingview.com
1	s3.tradingview.com	www.wintersexpress.com
1	fonts.googleapis.com	www.wintersexpress.com
238	73

This site contains links to these domains. Also see Links.

Domain
adclick.g.doubleclick.net
mniiservices.newscyclecloud.com
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
www.instagram.com
www.tradingview.com
www.microsoft.com
www.google.com
www.mozilla.org
bloxcms.com
bloxdigital.com

Subject Issuer	Validity	Valid
wintersexpress.com WR1	`2024-10-26` - `2025-01-24`	3 months	crt.sh
bloximages.chicago2.vip.townnews.com GeoTrust TLS RSA CA G1	`2024-03-12` - `2025-04-12`	a year	crt.sh
upload.video.google.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
discovery.evvnt.com Amazon RSA 2048 M02	`2024-02-12` - `2025-03-11`	a year	crt.sh
*.tradingview.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-11-11` - `2025-11-10`	a year	crt.sh
*.google-analytics.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
c.amazon-adsystem.com Amazon RSA 2048 M03	`2024-11-19` - `2025-12-18`	a year	crt.sh
*.gstatic.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.tradingview-widget.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-30` - `2025-03-19`	8 months	crt.sh
config.aps.amazon-adsystem.com Amazon RSA 2048 M02	`2024-01-21` - `2025-02-19`	a year	crt.sh
secure.cdn.fastclick.net DigiCert TLS RSA SHA256 2020 CA1	`2024-08-07` - `2025-08-07`	a year	crt.sh
*.crwdcntrl.net Amazon RSA 2048 M02	`2024-09-07` - `2025-10-07`	a year	crt.sh
*.33across.com Sectigo RSA Domain Validation Secure Server CA	`2024-09-05` - `2025-09-30`	a year	crt.sh
hadronid.net WE1	`2024-11-22` - `2025-02-20`	3 months	crt.sh
id5-sync.com WE1	`2024-09-30` - `2024-12-29`	3 months	crt.sh
alt1-3ps.amazon-adsystem.com Amazon RSA 2048 M03	`2024-03-29` - `2025-04-28`	a year	crt.sh
*.google.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
id.hadron.ad.gt WE1	`2024-11-18` - `2025-02-16`	3 months	crt.sh
*.segment.com Amazon RSA 2048 M02	`2024-10-15` - `2025-11-14`	a year	crt.sh
cdn.prod.uidapi.com Amazon RSA 2048 M03	`2024-11-20` - `2025-12-20`	a year	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-09-24` - `2024-12-21`	3 months	crt.sh
oa.openxcdn.net WR3	`2024-11-13` - `2025-02-11`	3 months	crt.sh
invstatic101.creativecdn.com WR3	`2024-10-15` - `2025-01-13`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
a.ad.gt WE1	`2024-10-05` - `2025-01-03`	3 months	crt.sh
*.doubleclick.net WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.google.ca WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
p.ad.gt WE1	`2024-10-08` - `2025-01-06`	3 months	crt.sh
ids.ad.gt WE1	`2024-11-13` - `2025-02-11`	3 months	crt.sh
*.ad.gt Amazon RSA 2048 M02	`2024-03-10` - `2025-04-08`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2024-07-30` - `2025-04-03`	8 months	crt.sh
esp.rtbhouse.com WR3	`2024-10-22` - `2025-01-20`	3 months	crt.sh
cdn.prod.discovery.evvnt.com Amazon RSA 2048 M02	`2024-08-01` - `2025-08-30`	a year	crt.sh
pixels.ad.gt WE1	`2024-11-03` - `2025-02-01`	3 months	crt.sh
seg.ad.gt WE1	`2024-11-03` - `2025-02-01`	3 months	crt.sh
eu-1-id5-sync.com R11	`2024-11-11` - `2025-02-09`	3 months	crt.sh
*.segment.io Amazon RSA 2048 M03	`2024-11-13` - `2025-12-13`	a year	crt.sh
infolinks.com WE1	`2024-10-08` - `2025-01-06`	3 months	crt.sh
tpc.googlesyndication.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-09-28` - `2024-12-27`	3 months	crt.sh
proton.ad.gt WE1	`2024-11-05` - `2025-02-03`	3 months	crt.sh
*.liadm.com Amazon RSA 2048 M02	`2024-10-31` - `2025-11-28`	a year	crt.sh
lexicon.33across.com WR3	`2024-11-02` - `2025-01-31`	3 months	crt.sh
*.intentiq.com Amazon RSA 2048 M03	`2024-03-26` - `2025-04-24`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-09-24` - `2024-12-25`	3 months	crt.sh
adtrafficquality.google WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh

This page contains 21 frames:

Primary Page: https://www.wintersexpress.com/
Frame ID: D35EE2A8E3DCBDE292CB44B2352E574B
Requests: 191 HTTP requests in this frame

Frame: https://www.tradingview-widget.com/embed-widget/market-overview/?locale=en
Frame ID: B006E0E68EEE02A9035195C99479121A
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: 9A8C17D9EDFC3F49C31407B7905AD8B7
Requests: 1 HTTP requests in this frame

Frame: https://846d83c2930c516597075cc9390fed92.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: EC208AAF907FCC337D5C91CC2100811F
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-4T2EB147B8&gacid=1130602829.1732521198&gtm=45je4bk0v887101457z8861227858za200zb861227858&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102077855~102081485&z=1487293689
Frame ID: 57635091C95C8301B7B04E05432D8D83
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssw94Xixmgq22mLGrP77nm_No5mn9nBx7Sp9aZp3L4vdkLCnNQj4NMvQS9FLbbrdI6LYeQ1RfMI8D3TOmDohEiVrVS0Tlp4-jDW3FDsx_wKDUJTxFSGH4WPae8zpEUP5EMp1l_Sy_QXYRTnvWmp8QhzV6_bXTbq_latabcjOndpUVk7tAwMHJPwbkBkA4FpoFAT2AbCx4JpNjxaAPyaEcXexYwaJgvg8Yn4eBwnks-GgDEYjGd1YfT9lQxREnHG9fqjdwQkkh1zZ_h4zAm57fB0SNCdgriZRZkCdCrl3tEH4idfHbipM4kSd2HW6u6HYfKokDTp1SMw1i91gdn2i1QRtNinTdk67f3sx37KEekz6TgVAmWDNSEANC32nTQbmEyYg3Ujfm-UwXxUAyjVJDcSQj8Pkzy5bQ6IElpIl1FkU4cOAYAG&sai=AMfl-YQ1aHShv4-tHRwk-njnM2dw9cbQZuMetowMda7_izcW2rl7oy_qHnPgHUR4kn9MTMVM2W1P_9W437eiQZ6VWCz65jxHSVFfCiisLatlPbxF86Q_gBfIGEsOC8KMGlwciyg2cedURHUmZjaZvgKW&sig=Cg0ArKJSzLC-KH2z1s72EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: F1FE2C80E4BA18D1D5FD4B7CB01685EC
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsul3BQlTVHvDvYV6_MT-TLg7eOK4MI5t9j00jQ-0RXft5oUR-yLXDT4m9Ilfv_VXAovZwR4anJ2JbCN8PEy62UY4KLCm-w5oBVqUhWcWqABlIKQ54HJLUpCDyty1WM6_SbFZv5PPP6x-AWFkC-bDIRK_h__me1KmTGXPb189f3LfmgxYLBPjiNDF_0xHfDI1pLa_DIfctgXGwV345I1qqEE6OIU8HnutNJyTxun6zrKYqkW0j23bJ0VSDnxOVDryJnVi1veI9wBLDst4GrL4112wZjhHhHRha2LMFi9NQeyR3t6j4LajpKBfy1VVNxnNev4orZmSJ6AVzdK7Boaxf7QErD0uCBgQp7mR_v8T4CQTJCqsM0pwivUhB15apubVVZjOjJ7Km6DsaDdiIPxIKSgACRdRf7gIJt_funlqwDWdA&sai=AMfl-YQAhJaNYRZhFDyFD5qbZ1NSnyr2NbHpcNZLzWxcji8BaXHwwea1zQc1OujDERu8qM7cOyZGoKRA05rQHtwsLi2acmgw6NwU9PH957TirvqaDntbzl-qS87KbCh8vIqPPTIe3xaA3gGMHQCEfIR6&sig=Cg0ArKJSzPwA2OijCvjjEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: 5124296F05C958C9B942C12CBD6CBB86
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstQuX3oujy6xSYZPCcJeLvisml7AZxpXVGyJQd1QYxzJTitvzaTH0VRHbTbvALswRwnQhsLYHS6dBvq-Z_JnlZ_Rx5FDVqHI2fscx1E15lCliG1gmxNqTEUi5uXkkvcbIhv0ztBTFurNk1GGN2cyDUVJstRhLxTI2k8letXWgkf-UbvDT2iIeYNbmWCKVRy8OjIjmTz4HdxpALBEl7ZbMpgr5SWJl3HEPZ7QadZ1YdcQtLCBWKHGcaAR0So-wKBSntzr9L-X9pX5bLXATis8izPRdvhwE7SfdEYIgIaQDwduPnEzSvknXrKbWz9dC0dnsH2sIHgJcHT1JLUZ3xfitAgwH0Ig6ApCRcHMjct8M4gAPHHgegD5t9auXJoH2GoRmF2WsevfrmZ0EGxyafhH5-rQKP6t7xA7fxawjp65VJdvRBomfxbV6xg6IKB1E_tLCC-v4pv6mLN&sai=AMfl-YSELuxdOrInzoPtr1bBDIHg9t45fapfFJYVAEdDXmiTTbTOsSsJ2Y9XBXG7Mus_bFCojYYd-YSDXdAD1wzFjyQLWkbfNoAtQ7omGHkBRrDCvu-17-E67Re3bpjjhnKDtMm-SOmALeSquACm4uk1&sig=Cg0ArKJSzIcPNzTDcdNUEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 77A71FC8364C731D659FBC71D6DB2612
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssO4C1VYwYCYcId80eArd8dFPK9uFq7uKOeDVXJ2pZ9fN3PnPzK4DAhGRWlPDnV2nZWazF_Kmj_8f-hrA8YbZAiuoIMSBzypGeQ9YZQW2yBy2kKZQTsBWN6U5tIvlJt9SxlStsU2UHx-lqXEuOitJl-SXXMNfxp1bGeKCIx5hjOb5JcAQf9tM9S3cxnjUU4ulktRS7SPvRVWdLz4SW3yLNPxLxW6xlI4zstSRi6rnGEJsieQwKj_PFgsi6doXLzgN_AHB3_Kb380uNv_DwYJcGUgd_o62lUVIiggXQv-V1pAP5DU_airdNQP69kT7cIYxusvWUe0BiJZjiyAIese4UCdtXFkTlVpTbVpt997JlawoiTfpD_W1L6ROzkV4JpwFyav0tESGJXbgjl68vyq69u_qXFX4rBNjER6QMydrQKY_pMsq-ffrnKmAlXSqp0K-3jsCWymx8M&sai=AMfl-YReg1hpze7LNcH_CGHD_4n9Ho78OoyTwOW1Jl9C3RGy_vo0-bbrjskRq3YdLJA5C0xnTrvs0NEQMpbiHBV_i51aL-3qBKgIw4PX-OAhTRJBTVAqDADRICKbsyb6hFFmIJ6G5Nc_acM_QMQKlFgQ&sig=Cg0ArKJSzEM9ej24OtOSEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: CDD2A6CEABD418D689E89C807E773220
Requests: 8 HTTP requests in this frame

Frame: https://proton.ad.gt/join-ad-interest-groups.html
Frame ID: B0469170AEE187847C02DAE64BF417D3
Requests: 1 HTTP requests in this frame

Frame: https://router.infolinks.com/usync/manage?pid=3119781&wsid=0&pdom=www.wintersexpress.com&purl=https%3A%2F%2Fwww.wintersexpress.com%2F
Frame ID: AC4686E3E642836E9E2013C89366A59A
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.wintersexpress.com&gdpr=0&gdpr_consent=&gpp=&gpp_sid=-1
Frame ID: 0D6EA7EEFF81CFA03E409EE13A88BE03
Requests: 1 HTTP requests in this frame

Frame: https://resources.infolinks.com/static/container-4.0.html
Frame ID: FA6F226BB164B857F70E679FF4DCAE66
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Frame ID: BDC8550B4037F6BE1E53612AD7679BB8
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20241120/r20190131/zrt_lookup_fy2021.html
Frame ID: 5C57923B74C6753D863EE67011B6101F
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-6373315980741255&output=html&h=90&slotname=2794737922&adk=1445061518&adf=2751417949&pi=t.ma~as.2794737922&w=728&abgtt=1&rdp=false&format=728x90&url=https%3A%2F%2Fwww.wintersexpress.com%2F&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1732521199668&bpp=4&bdt=88&idt=107&shv=r20241120&mjsv=m202411140101&ptt=9&saldr=aa&correlator=317168216463&frm=23&ife=1&pv=2&nhd=1&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=95347445%2C95345967%2C95347755&oid=2&pvsid=3379807540127882&tmod=1451389138&uas=0&nvt=1&loc=https%3A%2F%2Fwww.wintersexpress.com%2F&fc=640&brdim=120%2C120%2C120%2C120%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=1.melcpinstbof&fsb=1&dtd=151
Frame ID: 2919B70D432948308484E74D793B0427
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-6373315980741255&output=html&adk=1812271804&adf=480832070&abgtt=1&plat=1%3A16777216%2C2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=188x675_l%7C212x675_r&rdp=false&format=0x0&url=https%3A%2F%2Fwww.wintersexpress.com%2F&pra=7&wgl=1&aihb=0&aiof=3~4&asro=0&ailel=1~2~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aiael=1~2~3~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aicel=33~38&aifxl=29_18~30_19&aiixl=29_5~30_6&aiict=1&aiapm=0.3221&aiapmi=0.33938&aiombap=1&aief=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1732521199668&bpp=2&bdt=88&idt=113&shv=r20241120&mjsv=m202411140101&ptt=9&saldr=aa&prev_fmts=728x90&nras=1&correlator=317168216463&frm=23&ife=1&pv=1&nhd=1&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=95347445%2C95345967%2C95347755&oid=2&pvsid=3379807540127882&tmod=1451389138&uas=0&nvt=1&fsapi=1&loc=https%3A%2F%2Fwww.wintersexpress.com%2F&fc=640&brdim=120%2C120%2C120%2C120%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32772&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=2.2phn293giqv0&fsb=1&dtd=155
Frame ID: 6D8F73295D5CFC2326F4D429EAE1B315
Requests: 1 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html
Frame ID: 62C9D05BF795E87855188C64677E9BCD
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 806225B8AF3BA89710B5A6FE65674A6F
Requests: 1 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html
Frame ID: 1B40E8CB10B8BDE5D68B098B6ED4031D
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 5B16EA582927B015189D6C2F6FDDD5A5
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

wintersexpress.com | Winters Express

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Segment (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.segment\.com/analytics\.js

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

238
Requests

92 %
HTTPS

40 %
IPv6

43
Domains

73
Subdomains

61
IPs

3
Countries

4300 kB
Transfer

10719 kB
Size

173
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjsv1gk8bGu57tb1582maV13JdsIaiWtom3VUnaZIF8KPzFsTvClv4fw4HLMTBnjqjUAerEOej8Fwlhvuv-icmAIzmOU-ucf61FOaJnT3l6ZO5AkdJiNHSTE7DAbvMGJ0puDmo6w1dj-tpRJkPUxi1aGDvOqRuIU84xhLjXOOcbAts71m1sbjeKIFC0J0xjBxxZapvEIQXUjC50M_MMBTb7ZlzzvK3zmZ6ybVRd6VH-mtkpEq840n1TeZe1gcFUqnJ-8yRyVGjhNkakeTwLSm554TiIK2hXrShHtRzkZVwslbD7qi8ABTaYJPwj1vFWvi7UUnyUIUdhi5EznCBTccyHJZutomS5W2XnWuB-BZ3UyaSxS15FZj0pltP6p3v7k6Ffjaug1iAc0nwJ2y4GOehQ&sai=AMfl-YT9LHXrdVoHNjq7Hd_DcqcGkO4UCjr6sBSntc6jo1TEYcgcmsXLi2kAC2DMiwTN7zqu73naMME-l6920Ve8nPcf2DsEST8YeCopbMp2Gm77lA16xqvwKdEZ1Dmc3hGcnvkSvb7rzOr5jQQhOAJ4&sig=Cg0ArKJSzG5yTZX4NX2yEAE&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&adurl=https%3A%2F%2Ffarmsteadatdixon.com%2F

Search URL Search Domain Scan URL

URL: https://mniiservices.newscyclecloud.com/cmo_mni-c-cmdb-01/subscriber/web/startoffers.html?siteId=WE
Title: Account Services

Search URL Search Domain Scan URL

URL: https://www.facebook.com/WintersExpress
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/wintersexpress
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/wintersexpress/
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCcEu29TMOEzDmrt9ak3tzjA
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.instagram.com/wintersexpressnews/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.tradingview.com/?utm_source=www.wintersexpress.com&utm_medium=widget_new&utm_campaign=market-overview
Title: Market Data by TradingView

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/edge
Title: Microsoft Edge

Search URL Search Domain Scan URL

URL: https://www.google.com/chrome/
Title: Google Chrome

Search URL Search Domain Scan URL

URL: https://www.mozilla.org/en-US/firefox/
Title: Firefox

Search URL Search Domain Scan URL

URL: https://bloxcms.com/
Title: BLOX Content Management System

Search URL Search Domain Scan URL

URL: https://bloxdigital.com/
Title: BLOX Digital

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 21

https://www.wintersexpress.com/tncms/media/winters/ HTTP 302
https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/media/0/9e/09ed333a-6eba-11ee-8536-971babcb4835/65318aac6fde3.image.png?resize=1333%2C356

Request Chain 86

https://lexicon.33across.com/v1/envelope?pid=0010b00002XdhehAAB&src=aps&ver=1.14.0 HTTP 307
https://lexicon.33across.com/v1/envelope?pid=0010b00002XdhehAAB&src=aps&ver=1.14.0&b=1&tp=v0Y8YcFCaTkRSvkI3jkVsq8YAXNP44pUOpX%2BcdHYCtg%3D

Request Chain 124

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001732521198-UPABSCL4-DAUN&adnxs_id=$UID&gdpr=0 HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fmatch%3Fid%3DAU1D-0100-001732521198-UPABSCL4-DAUN%26adnxs_id%3D%24UID%26gdpr%3D0 HTTP 302
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001732521198-UPABSCL4-DAUN&adnxs_id=3248038131172656463&gdpr=0

Request Chain 125

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001732521198-UPABSCL4-DAUN%26auid%3DAU1D-0100-001732521198-UPABSCL4-DAUN HTTP 302
https://u.openx.net/w/1.0/cm?cc=1&id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001732521198-UPABSCL4-DAUN%26auid%3DAU1D-0100-001732521198-UPABSCL4-DAUN HTTP 302
https://ids.ad.gt/api/v1/openx?openx_id=598f9492-e17e-481e-9400-ae635b82dd46&id=AU1D-0100-001732521198-UPABSCL4-DAUN&auid=AU1D-0100-001732521198-UPABSCL4-DAUN

Request Chain 126

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001732521198-UPABSCL4-DAUN HTTP 302
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001732521198-UPABSCL4-DAUN HTTP 302
https://ids.ad.gt/api/v1/pbm_match?pbm=7B9D21CE-6374-4E40-BAC4-EDE54204A2D4&id=AU1D-0100-001732521198-UPABSCL4-DAUN

Request Chain 128

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001732521198-UPABSCL4-DAUN&gdpr=0 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001732521198-UPABSCL4-DAUN&gdpr=0 HTTP 302
https://ids.ad.gt/api/v1/t_match?tdid=20fe83ce-9e2a-40f5-8b28-9316079689d8&id=AU1D-0100-001732521198-UPABSCL4-DAUN

Request Chain 129

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001732521198-UPABSCL4-DAUN&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001732521198-UPABSCL4-DAUN%26tapad_id%3D%24%7BTA_DEVICE_ID%7D HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001732521198-UPABSCL4-DAUN&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001732521198-UPABSCL4-DAUN%26tapad_id%3D%24%7BTA_DEVICE_ID%7D HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=c71235e1-47ee-4579-a4bc-a625aaea868a%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fid%25253DAU1D-0100-001732521198-UPABSCL4-DAUN%252526tapad_id%25253Dc71235e1-47ee-4579-a4bc-a625aaea868a%252C&gdpr=0&gdpr_consent= HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=20fe83ce-9e2a-40f5-8b28-9316079689d8&ttd_puid=c71235e1-47ee-4579-a4bc-a625aaea868a%2Chttps%253A%252F%252Fids.ad.gt%252Fapi%252Fv1%252Ftapad_match%253Fid%253DAU1D-0100-001732521198-UPABSCL4-DAUN%2526tapad_id%253Dc71235e1-47ee-4579-a4bc-a625aaea868a%2C HTTP 302
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001732521198-UPABSCL4-DAUN&tapad_id=c71235e1-47ee-4579-a4bc-a625aaea868a

Request Chain 131

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Famo_match%3Fturn_id%3D%24!%7BTURN_UUID%7D%26id%3DAU1D-0100-001732521198-UPABSCL4-DAUN HTTP 302
https://ids.ad.gt/api/v1/amo_match?turn_id=2807572217573817762&id=AU1D-0100-001732521198-UPABSCL4-DAUN

Request Chain 132

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001732521198-UPABSCL4-DAUN&uid=[UID]&gdpr=0 HTTP 302
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001732521198-UPABSCL4-DAUN&uid=31226daa-0c5f-4e81-b7a2-63101a171f28&gdpr=0

Request Chain 133

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001732521198-UPABSCL4-DAUN HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTczMjUyMTE5OC1VUEFCU0NMNC1EQVVO

Request Chain 168

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgODnm4DkywEQARgBMghtplB7comKlA HTTP 301
https://tpc.googlesyndication.com/simgad/10093456834737784039

Request Chain 169

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgODn69_ZLxABGAEyCGEAWlolSaX7 HTTP 301
https://tpc.googlesyndication.com/simgad/11758019229478185904

Request Chain 207

https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=947664&iiqidtype=2&iiqpcid=15f3f662-9e6f-467d-9855-bc0f4b623a32&iiqpciddate=1732521198878&tsrnd=633_1732521198879&fbp=2809319783&jsver=5.36&abtp=100&abtg=A HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=947664&iiqidtype=2&iiqpcid=15f3f662-9e6f-467d-9855-bc0f4b623a32&iiqpciddate=1732521198878&tsrnd=633_1732521198879&fbp=2809319783&jsver=5.36&abtp=100&abtg=A&ckls=true&ci=ia5HfE7Op8&nc=false&trid=114197131

Request Chain 233

https://rp.liadm.com/j?dtstmp=1732521200158&did=did-004d&se=e30&duid=42717b9848f5--01jdh4z1hkxpsj5yegcgx9mrbg&tv=v3.5.0&pu=https%3A%2F%2Fwww.wintersexpress.com%2F&ext__pubcid=d626cdd5-8985-42a5-b989-850150d0bda4&ext_ajs_user_id=null&us_privacy=1---&wpn=lc-bundle&wpv=v3.5.0&gpp_as=-1&cd=.wintersexpress.com&c=PG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IiI-PHRpdGxlPndpbnRlcnNleHByZXNzLmNvbSB8IFdpbnRlcnMgRXhwcmVzczwvdGl0bGU-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vd3d3LndpbnRlcnNleHByZXNzLmNvbS8iPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0xIj5BcnRpY2xlIHdpdGggaW1hZ2VzPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMiI-QXJ0aWNsZSB3aXRoIGltYWdlczwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTMiPkFydGljbGUgd2l0aCBpbWFnZXM8L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS00Ij5BcnRpY2xlIHdpdGggaW1hZ2VzPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNSI-QXJ0aWNsZSB3aXRoIGltYWdlczwvdGl0bGU-&pv=e6e63354-e2ed-4538-af49-8f955caef108 HTTP 302
https://rp4.liadm.com/j?dtstmp=1732521200158&did=did-004d&se=e30&duid=42717b9848f5--01jdh4z1hkxpsj5yegcgx9mrbg&tv=v3.5.0&pu=https%3A%2F%2Fwww.wintersexpress.com%2F&ext__pubcid=d626cdd5-8985-42a5-b989-850150d0bda4&ext_ajs_user_id=null&us_privacy=1---&wpn=lc-bundle&wpv=v3.5.0&gpp_as=-1&cd=.wintersexpress.com&c=PG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IiI-PHRpdGxlPndpbnRlcnNleHByZXNzLmNvbSB8IFdpbnRlcnMgRXhwcmVzczwvdGl0bGU-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vd3d3LndpbnRlcnNleHByZXNzLmNvbS8iPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0xIj5BcnRpY2xlIHdpdGggaW1hZ2VzPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMiI-QXJ0aWNsZSB3aXRoIGltYWdlczwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTMiPkFydGljbGUgd2l0aCBpbWFnZXM8L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS00Ij5BcnRpY2xlIHdpdGggaW1hZ2VzPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNSI-QXJ0aWNsZSB3aXRoIGltYWdlczwvdGl0bGU-&pv=e6e63354-e2ed-4538-af49-8f955caef108&i6=MjYwNzo1MzAwOjYwOjc4Njc6OjM%3D

238 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.wintersexpress.com/ 463 KB
69 KB 326ms
178ms Document
text/html 192.104.182.109
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.104.182.109 , United States, ASN10668 (LEE-ASN, US),

Reverse DNS

cms.us-midwest-1.vip.tn-cloud.net

Software

Resource Hash

b6325f88b44aca54eccdb053f48f095be90b97336ea75141feda9b088bfc14a0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 25230
cache-control: public, max-age=10
content-encoding: gzip
content-length: 68889
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Mon, 25 Nov 2024 00:52:45 GMT
etag: W/185a80883d3bdfe06f6125b49672133b
last-modified: Mon, 25 Nov 2024 00:52:44 GMT
link: <https://bloximages.chicago2.vip.townnews.com>; rel=preconnect dns-prefetch; crossorigin <https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/jquery/resources/scripts/jquery.min.d6d18fcf88750a16d256e72626e676a6.js>; rel=preload; as=script </shared-content/art/tncms/user/user.js>; rel=preload; as=script <https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/scripts/bootstrap.min.d457560d3dfbf1d56a225eb99d7b0702.js>; rel=preload; as=script <https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/common.08a61544f369cc43bf02e71b2d10d49f.js>; rel=preload; as=script <https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.ee95c0b6f1daceb31bf5ef84353968c6.js>; rel=preload; as=script <https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/application.0758030105fdd3a70dff03f4da4530e2.js>; rel=preload; as=script <https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.navigation.accessibility.7a9170240d21440159b9bd59db72933b.js>; rel=preload; as=script
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000
vary: X-IPCountry, Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-loop: 1
x-tncms: 1.83.2; app15; 1.15s; 4.8M
x-ua-compatible: IE=edge
x-vcache: HIT
x-xrds-location: https://www.wintersexpress.com/tncms/xrds/
x-xss-protection: 1; mode=block

GET
H2 200 jquery.min.d6d18fcf88750a16d256e72626e676a6.js Show response
bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/jquery/resources/scripts/ 98 KB
38 KB 132ms
35ms Script
application/x-javascript 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/jquery/resources/scripts/jquery.min.d6d18fcf88750a16d256e72626e676a6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bad3f4a20b737202b4cb52ce0124a2ae5d54be0002feb42790867ee446425332

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
content-encoding: gzip
cf-cache-status: HIT
etag: W/"60e609f2-1882c"
age: 94997
expires: Thu, 13 Mar 2025 16:53:30 GMT
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: application/x-javascript
last-modified: Wed, 07 Jul 2021 20:09:22 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=604800
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e80106679dcabb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 38456
server: cloudflare

GET
H2 200 user.js Show response
www.wintersexpress.com/shared-content/art/tncms/user/ 4 KB
2 KB 124ms
119ms Script
application/x-javascript 192.104.182.109
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wintersexpress.com/shared-content/art/tncms/user/user.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.182.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.us-midwest-1.vip.tn-cloud.net
Software: /
Resource Hash: 8cf6f020c4fe1dfc77d6ad29dfe4c4591e317d397baf3ee31edaf44ce3da098a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-vcache: HIT
cache-control: public, max-age=10
content-encoding: gzip
service-worker-allowed: /
etag: W/"6740ec95-ee3"
age: 462
accept-ranges: bytes
content-length: 1658
date: Mon, 25 Nov 2024 07:45:33 GMT
last-modified: Fri, 22 Nov 2024 20:41:57 GMT
content-type: application/x-javascript
vary: Accept-Encoding

GET
H2 200 bootstrap.min.d457560d3dfbf1d56a225eb99d7b0702.js Show response
bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/scripts/ 39 KB
13 KB 157ms
61ms Script
application/x-javascript 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/scripts/bootstrap.min.d457560d3dfbf1d56a225eb99d7b0702.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

93eac8b1fb14d0863561633dfdf563013c023393aabfb122e3be7256629d9235

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
content-encoding: gzip
cf-cache-status: HIT
etag: W/"5d726a23-9bd8"
age: 94997
expires: Thu, 23 Oct 2025 22:57:50 GMT
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: application/x-javascript
last-modified: Fri, 06 Sep 2019 14:16:03 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e80106699f0abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12719
server: cloudflare

GET
H2 200 common.08a61544f369cc43bf02e71b2d10d49f.js Show response
bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/ 33 KB
14 KB 154ms
58ms Script
application/x-javascript 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/common.08a61544f369cc43bf02e71b2d10d49f.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4908103eb097a575d25aecab0b105c51313e35ce211bb70d82ea0ce6e75ed2b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
content-encoding: gzip
cf-cache-status: HIT
etag: W/"660d5cdc-841f"
age: 94997
expires: Fri, 18 Apr 2025 01:24:21 GMT
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: application/x-javascript
last-modified: Wed, 03 Apr 2024 13:42:52 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e80106679d6abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14189
server: cloudflare

GET
H2 200 tnt.ee95c0b6f1daceb31bf5ef84353968c6.js Show response
bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/ 11 KB
4 KB 131ms
35ms Script
application/x-javascript 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.ee95c0b6f1daceb31bf5ef84353968c6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b093bf8fe11ce768e5543697030a064da71b347431594daf7efb86f94a201c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
content-encoding: gzip
cf-cache-status: HIT
etag: W/"65d66921-2d77"
age: 94997
expires: Thu, 13 Mar 2025 21:08:38 GMT
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: application/x-javascript
last-modified: Wed, 21 Feb 2024 21:20:33 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=604800
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e80106679dbabb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4260
server: cloudflare

GET
H2 200 application.0758030105fdd3a70dff03f4da4530e2.js Show response
bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/ 4 KB
2 KB 156ms
60ms Script
application/x-javascript 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/application.0758030105fdd3a70dff03f4da4530e2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f4049e8923ddb3b759697aebae3d69181b42fa677abba4d875f4a1ba7beff89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6707d183-1166"
age: 94997
expires: Wed, 15 Oct 2025 19:01:21 GMT
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: application/x-javascript
last-modified: Thu, 10 Oct 2024 13:07:15 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e80106679daabb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1636
server: cloudflare

GET
H2 200 tnt.navigation.accessibility.7a9170240d21440159b9bd59db72933b.js Show response
bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/ 2 KB
1 KB 155ms
60ms Script
application/x-javascript 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.navigation.accessibility.7a9170240d21440159b9bd59db72933b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf3e21aad61783d6e6908e5631c43656c05a34a9c7f64eab44dcd7fc58562aa8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
content-encoding: gzip
cf-cache-status: HIT
etag: W/"671917ae-9b8"
age: 94997
expires: Wed, 05 Nov 2025 10:49:54 GMT
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: application/x-javascript
last-modified: Wed, 23 Oct 2024 15:35:10 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e80106679d8abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 910
server: cloudflare

GET
H2 200 bootstrap.min.87df60d54091cf1e8f8173c2e568260c.css
bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/styles/ 107 KB
21 KB 156ms
61ms Stylesheet
text/css 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/styles/bootstrap.min.87df60d54091cf1e8f8173c2e568260c.css

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

296ffff5be5fa17a541df8e925d24e473ced64d535f543542bebc15759b761fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
content-encoding: gzip
cf-cache-status: HIT
etag: W/"65d66920-1ac2e"
age: 95451
expires: Thu, 13 Mar 2025 16:53:30 GMT
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: text/css
last-modified: Wed, 21 Feb 2024 21:20:32 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=604800
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e80106679d3abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21439
server: cloudflare

GET
H2 200 layout.4f2008879f13ddd758050a76c1e8672c.css
bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/styles/ 155 KB
34 KB 128ms
33ms Stylesheet
text/css 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/styles/layout.4f2008879f13ddd758050a76c1e8672c.css

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

252904bb838e1fb52a44c23792b4f5395783fae0ce1e9fa1d02f307c7657d1b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6734b379-26de1"
age: 95451
expires: Fri, 21 Nov 2025 04:25:41 GMT
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: text/css
last-modified: Wed, 13 Nov 2024 14:11:05 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e80106679d4abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 34470
server: cloudflare

GET
H2 200 theme-basic.7fe92e6efd905ab9f8cd307568b298f3.css
bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/themes/resources/styles/ 41 KB
9 KB 154ms
59ms Stylesheet
text/css 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/themes/resources/styles/theme-basic.7fe92e6efd905ab9f8cd307568b298f3.css

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8b8506928501a437418ca18498b5fcbd474b0c4bfc96b438bc9e09baa53adce5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66be51f7-a358"
age: 95451
expires: Wed, 20 Aug 2025 19:03:36 GMT
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: text/css
last-modified: Thu, 15 Aug 2024 19:07:35 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e80106679d5abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 9533
server: cloudflare

GET
H2 200 css2
fonts.googleapis.com/ 37 KB
2 KB 117ms
48ms Stylesheet
text/css 2607:f8b0:4004:c08::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Fira+Sans:wght@300;400;500;600;700;900&family=Fira+Sans+Condensed:wght@300;400;500;600;700;900&family=Oswald:wght@500;600;700&family=DM+Serif+Text&display=swap

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7834d7d1a04f735530e24e6fe9b6b7ca55591c6eefb068d22b568b095e18b716

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 07:53:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Mon, 25 Nov 2024 07:53:16 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 csrf.js Show response
www.wintersexpress.com/shared-content/art/tncms/api/ 940 B
762 B 122ms
120ms Script
application/x-javascript 192.104.182.109
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wintersexpress.com/shared-content/art/tncms/api/csrf.js
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.182.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.us-midwest-1.vip.tn-cloud.net
Software: /
Resource Hash: 9fe769bfc93145d27bc2efa853ca49895d7a44af9c5dd2566c3233b66c9d14b4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.wintersexpress.com
Referer: https://www.wintersexpress.com/

Response headers

x-vcache: HIT
cache-control: public, max-age=10
content-encoding: gzip
service-worker-allowed: /
etag: W/"6740ec95-3ac"
age: 462
accept-ranges: bytes
content-length: 537
date: Mon, 25 Nov 2024 07:45:33 GMT
last-modified: Fri, 22 Nov 2024 20:41:57 GMT
content-type: application/x-javascript
vary: Accept-Encoding

GET
H2 200 access.3e0b8030b6000aa9a609.js Show response
www.wintersexpress.com/shared-content/art/tncms/api/ 71 KB
29 KB 156ms
153ms Script
application/x-javascript 192.104.182.109
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wintersexpress.com/shared-content/art/tncms/api/access.3e0b8030b6000aa9a609.js
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.182.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.us-midwest-1.vip.tn-cloud.net
Software: /
Resource Hash: b07d02c8ede625dd16b97254a7d58fb54d63c5906d0c9390a494998d99d495ba

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.wintersexpress.com
Referer: https://www.wintersexpress.com/

Response headers

x-vcache: HIT
cache-control: public, max-age=10
content-encoding: gzip
service-worker-allowed: /
etag: W/"67214290-11c3d"
age: 462
accept-ranges: bytes
content-length: 29787
date: Mon, 25 Nov 2024 07:45:33 GMT
last-modified: Tue, 29 Oct 2024 20:16:16 GMT
content-type: application/x-javascript
vary: Accept-Encoding

GET
H2 200 user-controls.578df3df79d812af55ab13bae47f9857.js Show response
bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/block/resources/scripts/ 533 B
483 B 45ms
39ms Script
application/x-javascript 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/block/resources/scripts/user-controls.578df3df79d812af55ab13bae47f9857.js

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

448e1a4179ffa476609ed1e8909867082486239c06fb2e277f7843e3269d427b

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
content-encoding: gzip
cf-cache-status: HIT
etag: W/"65d66921-215"
age: 94997
expires: Thu, 13 Mar 2025 18:20:19 GMT
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: application/x-javascript
last-modified: Wed, 21 Feb 2024 21:20:33 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=604800
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010674a3cabb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 355
server: cloudflare

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 108 KB
33 KB 112ms
47ms Script
text/javascript 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

34dd39ca5c8799cba74edb6835a6db8ee2e2a588130add89bc6260cde1219a52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: br
etag: 385 / 20052 / m202411180101 / config-hash: 79477889192541496
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 07:53:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33713
x-xss-protection: 0
server: cafe

GET
H2 200 tnt.ads.adverts.66a3812a7b5c12fde8cd998fd691ad7d.js Show response
bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/ads/resources/scripts/ 207 B
281 B 154ms
60ms Script
application/x-javascript 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/ads/resources/scripts/tnt.ads.adverts.66a3812a7b5c12fde8cd998fd691ad7d.js

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

64d2ce701b1f0b1d910bff7f252ae7a53d5f90cf3efb970163811c757b889d57

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
content-encoding: gzip
cf-cache-status: HIT
etag: W/"65d66924-cf"
age: 94997
expires: Thu, 13 Mar 2025 16:53:30 GMT
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: application/x-javascript
last-modified: Wed, 21 Feb 2024 21:20:36 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=604800
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e80106699f1abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 176
server: cloudflare

GET
H2 200 tracking.js Show response
www.wintersexpress.com/shared-content/art/tncms/ 3 KB
1 KB 155ms
154ms Script
application/x-javascript 192.104.182.109
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wintersexpress.com/shared-content/art/tncms/tracking.js
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.182.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.us-midwest-1.vip.tn-cloud.net
Software: /
Resource Hash: aa4391f03da55de95caebed478d3e1183fb01a3e8f1c5891a48e75717ed2bed9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-vcache: HIT
cache-control: public, max-age=10
content-encoding: gzip
service-worker-allowed: /
etag: W/"6740ec95-a3a"
age: 462
accept-ranges: bytes
content-length: 1157
date: Mon, 25 Nov 2024 07:45:33 GMT
last-modified: Fri, 22 Nov 2024 20:41:57 GMT
content-type: application/x-javascript
vary: Accept-Encoding

GET
H2 200 fontawesome.48f6e778a25162f5c4a6977fb556155b.js Show response
bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/ 277 KB
115 KB 42ms
36ms Script
application/x-javascript 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/fontawesome.48f6e778a25162f5c4a6977fb556155b.js

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a8dd5310f1564e14e30c03c9c260a31c490ce92ac9b5123d50dc2af9193a485f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66e19e2e-45518"
age: 94997
expires: Wed, 17 Sep 2025 19:02:15 GMT
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: application/x-javascript
last-modified: Wed, 11 Sep 2024 13:42:06 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010674a3dabb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 117608
server: cloudflare

GET
H2 200 tracker.js Show response
www.wintersexpress.com/shared-content/art/stats/common/ 9 KB
3 KB 133ms
131ms Script
application/x-javascript 192.104.182.109
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wintersexpress.com/shared-content/art/stats/common/tracker.js
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.182.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.us-midwest-1.vip.tn-cloud.net
Software: /
Resource Hash: d50881e8cf2ac03741c7c31b98dcabdf91d458ed76766efc511b26a2b796dd0f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-vcache: HIT
cache-control: public, max-age=10
content-encoding: gzip
service-worker-allowed: /
etag: W/"66f6f794-2200"
age: 462
accept-ranges: bytes
content-length: 3224
date: Mon, 25 Nov 2024 07:45:33 GMT
last-modified: Fri, 27 Sep 2024 18:21:08 GMT
content-type: application/x-javascript
vary: Accept-Encoding

GET
H2 200 f46c4fc2-b2d1-11ed-8535-cb060e253bb4.png
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/custom/image/ 15 KB
16 KB 57ms
56ms Image
image/webp 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/custom/image/f46c4fc2-b2d1-11ed-8535-cb060e253bb4.png

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efb4c7a950bf4f16b1e83d9c57ba2bc27569230487d4853db37900a15143dd7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "63f64969-4cee"
cf-cache-status: HIT
expires: Fri, 14 Nov 2025 23:46:27 GMT
cf-polished: origFmt=png, origSize=19694
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/webp
content-disposition: inline; filename="f46c4fc2-b2d1-11ed-8535-cb060e253bb4.webp"
vary: Accept
last-modified: Wed, 22 Feb 2023 16:57:13 GMT
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e801066a9f3abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 15770
server: cloudflare

GET
H2 200 69192660-b2c8-11ed-8535-8f312503fa1e.png
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/custom/image/ 13 KB
13 KB 56ms
55ms Image
image/webp 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/custom/image/69192660-b2c8-11ed-8535-8f312503fa1e.png?resize=640%2C171

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7116e73e282e128b2827e5e618b27f80ea54502476ce62c583785e1e48f0b34f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "6159d5bff9885d6b6e093a485ed5e23d"
cf-cache-status: HIT
expires: Tue, 01 Jul 2025 21:16:47 GMT
cf-polished: origFmt=png, origSize=16906
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/webp
content-disposition: inline; filename="69192660-b2c8-11ed-8535-8f312503fa1e.webp"
vary: Accept
last-modified: Wed, 22 Feb 2023 15:48:54 GMT
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e801066a9f4abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 13010
server: cloudflare

GET
H2

200

65318aac6fde3.image.png
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/media/0/9e/09ed333a-6eba-11ee-8536-971babcb4835/
Redirect Chain

https://www.wintersexpress.com/tncms/media/winters/
https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/media/0/9e/09ed333a-6eba-11ee-8536-971babcb4835/65318aac6fde3.image.png?resize=1333%2C356

11 KB
11 KB

37ms
37ms

Image
image/webp

104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/media/0/9e/09ed333a-6eba-11ee-8536-971babcb4835/65318aac6fde3.image.png?resize=1333%2C356

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b012409edbcd903043eebec6b10090d195a2e324fb4b7fe5f37e26135219dd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "1ce6d26bf6e7f46747291abb98c5cd21"
age: 94997
cf-cache-status: HIT
expires: Fri, 07 Nov 2025 20:28:12 GMT
cf-polished: origFmt=png, origSize=17767
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/webp
content-disposition: inline; filename="65318aac6fde3.webp"
vary: Accept
last-modified: Thu, 19 Oct 2023 19:59:40 GMT
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010674a3eabb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11478
server: cloudflare

Redirect headers

x-robots-tag: noarchive
content-encoding: gzip
etag: W/3344a738a3a6624bc3461b072181fbe5
age: 44869
x-content-type-options: nosniff
date: Sun, 24 Nov 2024 19:25:26 GMT
content-type: text/html; charset=UTF-8
last-modified: Thu, 19 Oct 2023 19:59:42 GMT
vary: X-IPCountry, Accept-Encoding
x-frame-options: SAMEORIGIN
x-vcache: HIT
strict-transport-security: max-age=31536000
link: <https://bloximages.chicago2.vip.townnews.com>; rel=preconnect dns-prefetch; crossorigin
x-tncms: 1.83.2; app18; 0.01s; 0.6M
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=10
location: https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/media/0/9e/09ed333a-6eba-11ee-8536-971babcb4835/65318aac6fde3.image.png?resize=1333%2C356
x-loop: 1
referrer-policy: strict-origin-when-cross-origin
content-length: 496
x-xss-protection: 1; mode=block

GET
H2 200 ed2d22f4-b2d1-11ed-8535-ff560034a643.png
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/custom/image/ 15 KB
16 KB 52ms
52ms Image
image/webp 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/custom/image/ed2d22f4-b2d1-11ed-8535-ff560034a643.png

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efb4c7a950bf4f16b1e83d9c57ba2bc27569230487d4853db37900a15143dd7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "63f6495d-4cee"
cf-cache-status: HIT
expires: Thu, 20 Nov 2025 02:53:44 GMT
cf-polished: origFmt=png, origSize=19694
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/webp
content-disposition: inline; filename="ed2d22f4-b2d1-11ed-8535-ff560034a643.webp"
vary: Accept
last-modified: Wed, 22 Feb 2023 16:57:01 GMT
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010670a25abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 15770
server: cloudflare

GET
H2 200 evvnt_discovery_plugin-latest.min.js Show response
discovery.evvnt.com/prd/ 421 KB
120 KB 157ms
39ms Script
text/javascript 2600:9000:2199:d000:18:a82e:7180:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://discovery.evvnt.com/prd/evvnt_discovery_plugin-latest.min.js
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2199:d000:18:a82e:7180:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a73c1339e9733df332038af7288d412dde2a2c650d99c2a4169484c4c702d950

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-amz-cf-pop: IAD79-C1
content-encoding: br
etag: W/"b32ba2ee14364581d4324417dd5c30ea"
age: 85066
via: 1.1 e7311287a3a52035e5fcaf9a58791104.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: lDiREChAMSDtFSBXJ9hy1bsVLGHS9Ww5cQxIY9zNnG280OEd7DROSw==
date: Sun, 24 Nov 2024 08:15:31 GMT
content-type: text/javascript
vary: accept-encoding
server: AmazonS3
last-modified: Mon, 30 Sep 2024 23:41:20 GMT
x-amz-server-side-encryption: AES256

GET
H2 200 embed-widget-market-overview.js Show response
s3.tradingview.com/external-embedding/ 13 KB
5 KB 157ms
37ms Script
text/javascript 37.19.207.34
CDN77 Datacamp Li...

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.tradingview.com/external-embedding/embed-widget-market-overview.js
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 37.19.207.34 Ashburn, United States, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS: 37-19-207-34.bunnyinfra.net
Software: BunnyCDN-ASB1-925 /
Resource Hash: 3e5d4f2cbb3948d73f8ded1de3dba8b7d8b18dd04ed5ad4f59b2acbef9f167c9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cdn-status: 200
access-control-max-age: 3000
content-encoding: br
etag: "040a6bc79e67d61e09ee03730dd9560f"
access-control-allow-methods: GET
date: Mon, 25 Nov 2024 07:53:16 GMT
last-modified: Fri, 22 Nov 2024 20:05:20 GMT
content-type: text/javascript
vary: Accept-Encoding
cdn-cache: HIT
x-amz-id-2: yqJCR2vPvP1wH3eQBBmSSfgIvMw1HhaZkbhET1KJ2VZBDLHBTIh+nVyT29/iL0Fcx0OlgjY0p9Yqq4tcrt1LVymTouLsgOcYpc0EILX/4Vc=
cdn-requestpullcode: 200
cdn-cachedat: 11/23/2024 04:19:45
cache-control: public, max-age=300
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: 0e2daf09-b694-4906-9f20-7c3ca5f9a6a3
cdn-requestid: d4fa71919dfb29179388e9d1c3333ae1
cdn-pullzone: 1837468
cdn-proxyver: 1.06
x-amz-request-id: 5R81P05YBMWXW96S
access-control-allow-origin: *
cdn-edgestorageid: 925
server: BunnyCDN-ASB1-925
cdn-requestcountrycode: CA
x-amz-server-side-encryption: AES256

GET
H2 200 tnt.ads.core.ee10a41bfea60001b9edb7ab35e5c9e1.js Show response
bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/ads/resources/scripts/ 14 KB
5 KB 43ms
36ms Script
application/x-javascript 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/ads/resources/scripts/tnt.ads.core.ee10a41bfea60001b9edb7ab35e5c9e1.js

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7458edd9b7b53f7b32c80f4856a8a0d1c4b7557c589f7c6b860c30a43829ac3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
content-encoding: gzip
cf-cache-status: HIT
etag: W/"65f221dd-3662"
age: 48277
expires: Wed, 19 Mar 2025 19:05:17 GMT
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: application/x-javascript
last-modified: Wed, 13 Mar 2024 21:59:57 GMT
vary: Accept-Encoding
x-vcache: HIT
strict-transport-security: max-age=604800
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010674a38abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5096
server: cloudflare

GET
H2 200 maillist_signup.deacc71a82fe583ccc361b42498ff614.js Show response
bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/block/resources/scripts/ 4 KB
1 KB 43ms
35ms Script
application/x-javascript 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/block/resources/scripts/maillist_signup.deacc71a82fe583ccc361b42498ff614.js

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e2ff429aac35e1b55d4b5e1e299237b84fd6469fa4abc13770b2896981fdb050

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6734b375-ffe"
age: 94997
expires: Thu, 20 Nov 2025 19:46:45 GMT
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: application/x-javascript
last-modified: Wed, 13 Nov 2024 14:11:01 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010674a39abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1246
server: cloudflare

GET
H2 200 sticky-kit.cd42d35abf643b0a78798fe03bf6bc83.js Show response
bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/ 4 KB
2 KB 41ms
34ms Script
application/x-javascript 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/sticky-kit.cd42d35abf643b0a78798fe03bf6bc83.js

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

47220c4c850d2a71293522af7071da5706951e1cecc6dddce7bc78343f48de1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
content-encoding: gzip
cf-cache-status: HIT
etag: W/"65d66922-1010"
age: 94997
expires: Thu, 13 Mar 2025 21:08:38 GMT
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: application/x-javascript
last-modified: Wed, 21 Feb 2024 21:20:34 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=604800
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010674a3aabb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1501
server: cloudflare

GET
H2 200 tnt.regions.e7df22f20c42105cce5864da9e346f48.js Show response
bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/ 4 KB
2 KB 46ms
40ms Script
application/x-javascript 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.regions.e7df22f20c42105cce5864da9e346f48.js

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50eea9da4f4a1b43ff0b25615da2dcf7dcb6fd9173b4ab1b472663d204acc258

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6707d183-1041"
age: 94997
expires: Fri, 24 Oct 2025 21:55:34 GMT
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: application/x-javascript
last-modified: Thu, 10 Oct 2024 13:07:15 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010674a3babb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1560
server: cloudflare

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 226 KB
78 KB 130ms
49ms Script
application/javascript 2607:f8b0:4004:c21::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PDQV3N

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c0b5dfb7fdb5fc92bb0a9b997b8f1c72eb4ae3e0f7b7c308c71c03ce299e02ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Mon, 25 Nov 2024 07:53:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 25 Nov 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 79663
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 345 KB
85 KB 159ms
42ms Script
application/javascript 108.138.70.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.70.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-70-84.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3bf4f940a69cf7d1af0797f0371ddae937a8274190b22ebe165f0f7223b0e670

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"812ceba01127f3bf5aede260eaddcd29"
age: 2908
via: 1.1 5afe13d9a6dd513ea0054947fa28dc18.cloudfront.net (CloudFront), 1.1 45893c5ff2aa24fa7dce9573a0274642.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: BnYi0n9mrApKK6mAQwvNFvC79s8lvksJW2QhLkAs_66mi_MCrbQ50Q==
date: Mon, 25 Nov 2024 07:04:49 GMT
content-type: application/javascript
last-modified: Wed, 06 Nov 2024 22:51:03 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P7, IAD12-P1
x-amz-server-side-encryption: AES256

GET
H2 403 tracker.gif
www.wintersexpress.com/shared-content/art/stats/common/ 0
48 B 36ms
35ms Image
text/plain 192.104.182.109
LEE-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.wintersexpress.com/shared-content/art/stats/common/tracker.gif?tnms_rs=1600x1200x24&tnms_vtum=1&tnms_vt=1&tnms_vid=1732521196675120120160012001287666008336&tnms_dt=wintersexpress.com%20%7C%20Winters%20Express&tnms_upage=1&tnms_do=www.wintersexpress.com&tnms_uri=/&tnms_ref=&rt=1732521196677
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.182.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.us-midwest-1.vip.tn-cloud.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

date: Mon, 25 Nov 2024 07:53:16 GMT
content-length: 0

GET
H3 200 va9B4kDNxMZdWfMOD5VnLK3eRhf6.woff2
fonts.gstatic.com/s/firasans/v17/ 24 KB
24 KB 87ms
49ms Font
font/woff2 142.251.167.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/firasans/v17/va9B4kDNxMZdWfMOD5VnLK3eRhf6.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Fira+Sans:wght@300;400;500;600;700;900&family=Fira+Sans+Condensed:wght@300;400;500;600;700;900&family=Oswald:wght@500;600;700&family=DM+Serif+Text&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f94.1e100.net

Software

sffe /

Resource Hash

45f1b654ec61c60215f597e30df063b0fee38c8a42f7046f99bf9bf3376971dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.wintersexpress.com
Referer: https://fonts.googleapis.com/

Response headers

age: 241086
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sat, 22 Nov 2025 12:55:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 22 Nov 2024 12:55:10 GMT
last-modified: Tue, 02 May 2023 14:50:32 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24964
x-xss-protection: 0
server: sffe

GET
H3 200 va9E4kDNxMZdWfMOD5Vvl4jL.woff2
fonts.gstatic.com/s/firasans/v17/ 23 KB
23 KB 72ms
35ms Font
font/woff2 142.251.167.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/firasans/v17/va9E4kDNxMZdWfMOD5Vvl4jL.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f94.1e100.net

Software

sffe /

Resource Hash

89ae1743656b75948be30cc4909efd3c61771b7bd9f6d53eb14cd9731d486b57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.wintersexpress.com
Referer: https://fonts.googleapis.com/

Response headers

age: 190944
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 23 Nov 2025 02:50:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 23 Nov 2024 02:50:52 GMT
last-modified: Tue, 02 May 2023 14:50:07 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23880
x-xss-protection: 0
server: sffe

GET
DATA 200
OK truncated
/ 75 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e31c42447e764b1195ff393437950867800ce2465dd3724c95640f4f5b34487c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 200 va9B4kDNxMZdWfMOD5VnPKreRhf6.woff2
fonts.gstatic.com/s/firasans/v17/ 23 KB
23 KB 56ms
53ms Font
font/woff2 142.251.167.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/firasans/v17/va9B4kDNxMZdWfMOD5VnPKreRhf6.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f94.1e100.net

Software

sffe /

Resource Hash

f8fb86afe5b79eaff2c4a5a44459de5444d04a7b395fd7bd627e70b95e5e5347

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.wintersexpress.com
Referer: https://fonts.googleapis.com/

Response headers

age: 175972
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 23 Nov 2025 07:00:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 23 Nov 2024 07:00:24 GMT
last-modified: Tue, 02 May 2023 14:50:03 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23620
x-xss-protection: 0
server: sffe

GET
H3 200 va9B4kDNxMZdWfMOD5VnSKzeRhf6.woff2
fonts.gstatic.com/s/firasans/v17/ 24 KB
24 KB 57ms
54ms Font
font/woff2 142.251.167.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/firasans/v17/va9B4kDNxMZdWfMOD5VnSKzeRhf6.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f94.1e100.net

Software

sffe /

Resource Hash

3bdc29109b621ad2c793d86fdc3f61e810d4aeafc3b8419f8f2aeb9c7ce0d364

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.wintersexpress.com
Referer: https://fonts.googleapis.com/

Response headers

age: 239248
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sat, 22 Nov 2025 13:25:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 22 Nov 2024 13:25:48 GMT
last-modified: Tue, 02 May 2023 14:50:11 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24868
x-xss-protection: 0
server: sffe

GET
H3 200 wEOsEADFm8hSaQTFG18FErVhsC9x-tarWU3IuMR0cg.woff2
fonts.gstatic.com/s/firasanscondensed/v10/ 23 KB
23 KB 56ms
53ms Font
font/woff2 142.251.167.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/firasanscondensed/v10/wEOsEADFm8hSaQTFG18FErVhsC9x-tarWU3IuMR0cg.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f94.1e100.net

Software

sffe /

Resource Hash

458af683b8dbd6454c2ab93f5d228801d4c9edb8a8a8930c28563c6406a849f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.wintersexpress.com
Referer: https://fonts.googleapis.com/

Response headers

age: 186207
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 23 Nov 2025 04:09:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 23 Nov 2024 04:09:49 GMT
last-modified: Thu, 21 Apr 2022 16:46:28 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23784
x-xss-protection: 0
server: sffe

GET
H3 200 va9B4kDNxMZdWfMOD5VnZKveRhf6.woff2
fonts.gstatic.com/s/firasans/v17/ 23 KB
23 KB 60ms
55ms Font
font/woff2 142.251.167.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/firasans/v17/va9B4kDNxMZdWfMOD5VnZKveRhf6.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f94.1e100.net

Software

sffe /

Resource Hash

c52b9a30cb5d84dcfb2a4f9967f37abd86c3e709554ed4f168a03222e033bb93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.wintersexpress.com
Referer: https://fonts.googleapis.com/

Response headers

age: 186034
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 23 Nov 2025 04:12:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 23 Nov 2024 04:12:42 GMT
last-modified: Tue, 02 May 2023 14:50:22 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24020
x-xss-protection: 0
server: sffe

GET
H2 200 64abb4bf83c06.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/0/ba/0bac3524-a57c-5d8a-b207-ab3af5ffb628/ 44 KB
44 KB 78ms
72ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/0/ba/0bac3524-a57c-5d8a-b207-ab3af5ffb628/64abb4bf83c06.image.jpg?crop=1148%2C646%2C44%2C268&resize=750%2C422&order=crop%2Cresize

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8cd455f2a1cfc7b9e95833204dad2ac12dc465312607b7cffb9de864ce035ad5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "d7808ab5e8f4e23333854debc328910e"
cf-cache-status: HIT
expires: Sat, 22 Nov 2025 00:20:39 GMT
cf-polished: origSize=47081, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Mon, 10 Jul 2023 07:35:28 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010685aa1abb8-YYZ
access-control-allow-origin: *
server: cloudflare

GET
H2 200 673fc6dc43ae5.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/2/4b/24b3a530-a863-11ef-8d8e-d79ab2c30b3b/ 12 KB
12 KB 95ms
90ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/2/4b/24b3a530-a863-11ef-8d8e-d79ab2c30b3b/673fc6dc43ae5.image.jpg?crop=936%2C527%2C0%2C87&resize=300%2C169&order=crop%2Cresize

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c54d182acc0386729c7c8d502abecb6ca96c29794ffb1149c50edffb24c71a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "2bbc6a69ddbbc0a6bf9acf5429fa7709"
cf-cache-status: HIT
expires: Sat, 22 Nov 2025 00:12:40 GMT
cf-polished: degrade=85, origSize=12364, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Thu, 21 Nov 2024 23:48:44 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010685aa2abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12100
server: cloudflare

GET
H2 200 662a8e43737ca.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/9/03/903397c6-0326-11ef-a5e8-032b9ef17bb0/ 14 KB
14 KB 96ms
90ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/9/03/903397c6-0326-11ef-a5e8-032b9ef17bb0/662a8e43737ca.image.jpg?crop=1460%2C821%2C0%2C145&resize=300%2C169&order=crop%2Cresize

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3a0adc6c0365fcdf6401e1b64ce76a72ad0cf4fcc4c1d717f0c485e4c9bb30f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "d6144c977a06f41f8a889d4608b77535"
cf-cache-status: HIT
expires: Sat, 22 Nov 2025 00:12:40 GMT
cf-polished: origSize=15239, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Thu, 25 Apr 2024 17:09:23 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010685aa3abb8-YYZ
access-control-allow-origin: *
server: cloudflare

GET
H2 200 673fc3b39d691.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/4/2b/42b7a628-a861-11ef-b357-979f55f21f70/ 16 KB
17 KB 95ms
90ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/4/2b/42b7a628-a861-11ef-b357-979f55f21f70/673fc3b39d691.image.jpg?crop=1794%2C1009%2C0%2C72&resize=300%2C169&order=crop%2Cresize

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c8d068269c9e28500717132d2ac92d922b218e7cc920d18f5b4d8d3d7c50f60c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "97a3e9544983ac3534a3afce100000c4"
cf-cache-status: HIT
expires: Fri, 21 Nov 2025 23:52:59 GMT
cf-polished: degrade=85, origSize=17156, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Thu, 21 Nov 2024 23:35:16 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010685aa4abb8-YYZ
access-control-allow-origin: *
server: cloudflare

GET
H2 200 6732bd7349dc8.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/e/45/e45753f0-a09d-11ef-b318-7f86835d224c/ 12 KB
12 KB 96ms
91ms Image
image/webp 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/e/45/e45753f0-a09d-11ef-b318-7f86835d224c/6732bd7349dc8.image.jpg?crop=936%2C527%2C0%2C71&resize=300%2C169&order=crop%2Cresize

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d2ecd417b587e339d8454ffde22329d9b753340fa08b4b5f1427f4899b7d9ec6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "62ea8272fd749d636ff9e341be507dfe"
cf-cache-status: HIT
expires: Fri, 21 Nov 2025 23:52:59 GMT
cf-polished: qual=85, origFmt=jpeg, origSize=15387
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/webp
content-disposition: inline; filename="6732bd7349dc8.webp"
vary: Accept
last-modified: Tue, 12 Nov 2024 02:29:07 GMT
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010685aa5abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12354
server: cloudflare

GET
H2 200 67350c22deaf9.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/f/7d/f7de2780-a1fd-11ef-8971-d39d25926080/ 14 KB
15 KB 89ms
84ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/f/7d/f7de2780-a1fd-11ef-8971-d39d25926080/67350c22deaf9.image.jpg?crop=866%2C487%2C35%2C0&resize=300%2C169&order=crop%2Cresize

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36218c17023a11d958a1b9acf3782e04e7700b1045ee594a58b305cff8dab9b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "5aaec6111730dd6499b852cb7ffeac7c"
cf-cache-status: HIT
expires: Fri, 21 Nov 2025 23:37:49 GMT
cf-polished: degrade=85, origSize=14692, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Wed, 13 Nov 2024 20:29:23 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010685aa6abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14651
server: cloudflare

GET
H2 200 673fc033e8185.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/2/cd/2cd80b10-a85f-11ef-9540-23839dccaabe/ 16 KB
16 KB 54ms
50ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/2/cd/2cd80b10-a85f-11ef-9540-23839dccaabe/673fc033e8185.image.jpg?crop=864%2C486%2C0%2C32&resize=300%2C169&order=crop%2Cresize

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

55d34a887dca0076789b740d486f5914396e2b8951caa8d3f48900582cbd0977

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "a2de3564919c000300b2c5a4555584ef"
cf-cache-status: HIT
expires: Fri, 21 Nov 2025 23:52:59 GMT
cf-polished: degrade=85, origSize=16278, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Thu, 21 Nov 2024 23:20:20 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010685aa7abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 16094
server: cloudflare

GET
H2 200 64abb6eeee8c4.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/3/f3/3f3d199d-abf8-57c1-a077-8eac57247426/ 14 KB
14 KB 96ms
92ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/3/f3/3f3d199d-abf8-57c1-a077-8eac57247426/64abb6eeee8c4.image.jpg?crop=955%2C537%2C0%2C161&resize=300%2C169&order=crop%2Cresize

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ac78a65e854b0b27cf82d07a92bcdeb62fbda95e8987656b76540a3cb81ce08d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "6403c52b31cc4790bc5e67958fb54456"
cf-cache-status: HIT
expires: Fri, 21 Nov 2025 23:52:59 GMT
cf-polished: degrade=85, origSize=14224, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Mon, 10 Jul 2023 07:44:47 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010685aa8abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14204
server: cloudflare

GET
H2 200 64abb19e2a2a1.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/8/57/857c6c37-490d-5e35-80af-4210f0b5d7a0/ 10 KB
10 KB 94ms
91ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/8/57/857c6c37-490d-5e35-80af-4210f0b5d7a0/64abb19e2a2a1.image.jpg?crop=1662%2C935%2C0%2C156&resize=300%2C169&order=crop%2Cresize

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9cff82a35dc75fb0dc6e967417b2901887356bfcc4bddc211feb2fe55c4ef5f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "b0a1eba72170a7fb8f3970c1981fd2d5"
cf-cache-status: HIT
expires: Fri, 21 Nov 2025 23:52:59 GMT
cf-polished: origSize=10448, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Mon, 10 Jul 2023 07:22:07 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010685aa9abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 9969
server: cloudflare

GET
H2 200 64abb4bf83c06.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/0/ba/0bac3524-a57c-5d8a-b207-ab3af5ffb628/ 5 KB
5 KB 87ms
62ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/0/ba/0bac3524-a57c-5d8a-b207-ab3af5ffb628/64abb4bf83c06.image.jpg?crop=1229%2C646%2C4%2C268&resize=200%2C105&order=crop%2Cresize

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

60ff7e6a931797ade90b7e2ffee8bcb15b6463b47b48299377f463c59ff23ef2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "8b5c99b48a2d8bc4543e0a7d3934ad88"
cf-cache-status: HIT
expires: Sat, 22 Nov 2025 00:05:47 GMT
cf-polished: degrade=85, origSize=4909, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Mon, 10 Jul 2023 07:35:28 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010689ac1abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4895
server: cloudflare

GET
H2 200 673fc6dc43ae5.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/2/4b/24b3a530-a863-11ef-8d8e-d79ab2c30b3b/ 7 KB
8 KB 86ms
62ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/2/4b/24b3a530-a863-11ef-8d8e-d79ab2c30b3b/673fc6dc43ae5.image.jpg?resize=200%2C150

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

960fd21cbf90bff7c4d4c58f8bb70000683e93504ef9042e417b8a3b982ff9e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "8f07f0b13aec4b59c7c6ac0c6bad7124"
cf-cache-status: HIT
expires: Sat, 22 Nov 2025 00:05:43 GMT
cf-polished: degrade=85, origSize=8056, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Thu, 21 Nov 2024 23:48:44 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010689ac2abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7573
server: cloudflare

GET
H2 200 662a8e43737ca.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/9/03/903397c6-0326-11ef-a5e8-032b9ef17bb0/ 9 KB
9 KB 91ms
67ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/9/03/903397c6-0326-11ef-a5e8-032b9ef17bb0/662a8e43737ca.image.jpg?resize=200%2C152

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

820b5f698595fdd1cc6c8603eff1d20ebd4bffeacadde63f6979911de705f6c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "968c2324ec133aa6090752592b2fac35"
cf-cache-status: HIT
expires: Fri, 21 Nov 2025 23:58:53 GMT
cf-polished: degrade=85, origSize=9135, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Thu, 25 Apr 2024 17:09:23 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010689ac3abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8994
server: cloudflare

GET
H2 200 673fc3b39d691.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/4/2b/42b7a628-a861-11ef-b357-979f55f21f70/ 9 KB
9 KB 89ms
68ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/4/2b/42b7a628-a861-11ef-b357-979f55f21f70/673fc3b39d691.image.jpg?resize=200%2C129

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fefad5f6070dc4f588391d1328cfe1927a0387a96e395b94f448e4bc4118dda6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "de9781d211d376922c7c0b240653ec7c"
cf-cache-status: HIT
expires: Fri, 21 Nov 2025 23:50:53 GMT
cf-polished: degrade=85, origSize=9755, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Thu, 21 Nov 2024 23:35:16 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010689ac4abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 9245
server: cloudflare

GET
H2 200 6732bd7349dc8.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/e/45/e45753f0-a09d-11ef-b318-7f86835d224c/ 7 KB
7 KB 84ms
63ms Image
image/webp 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/e/45/e45753f0-a09d-11ef-b318-7f86835d224c/6732bd7349dc8.image.jpg?resize=200%2C143

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8dead0a117fea5970954d57aedeaceed0892f625167b611af70c0de5ba5ba2c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "906255ae070b429c3ccb3b4ab2965ad2"
cf-cache-status: HIT
expires: Wed, 12 Nov 2025 02:36:25 GMT
cf-polished: qual=85, origFmt=jpeg, origSize=10511
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/webp
content-disposition: inline; filename="6732bd7349dc8.webp"
vary: Accept
last-modified: Tue, 12 Nov 2024 02:29:07 GMT
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010689ac5abb8-YYZ
access-control-allow-origin: *
server: cloudflare

GET
H2 200 67350c22deaf9.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/f/7d/f7de2780-a1fd-11ef-8971-d39d25926080/ 6 KB
7 KB 83ms
63ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/f/7d/f7de2780-a1fd-11ef-8971-d39d25926080/67350c22deaf9.image.jpg?resize=200%2C104

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4a0cd0f521435487b3c84c790aebafaffa89f22e5a58959e1e1ac44abac17431

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "f22f3cd264835646c6ecf768b0029ea3"
cf-cache-status: HIT
expires: Fri, 21 Nov 2025 23:37:47 GMT
cf-polished: degrade=85, origSize=6856, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Wed, 13 Nov 2024 20:29:23 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010689ac6abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6506
server: cloudflare

GET
H2 200 673fc033e8185.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/2/cd/2cd80b10-a85f-11ef-9540-23839dccaabe/ 8 KB
8 KB 85ms
67ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/2/cd/2cd80b10-a85f-11ef-9540-23839dccaabe/673fc033e8185.image.jpg?resize=200%2C128

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6cacbac181ea7b10547c7c001f30cc674f47321d227672dffa3b862a77f09c8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "2e803dd0ead4239b6410095f1cb0b5f2"
cf-cache-status: HIT
expires: Fri, 21 Nov 2025 23:34:17 GMT
cf-polished: degrade=85, origSize=8682, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Thu, 21 Nov 2024 23:20:20 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010689ac7abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8281
server: cloudflare

GET
H2 200 64abb6eeee8c4.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/3/f3/3f3d199d-abf8-57c1-a077-8eac57247426/ 10 KB
10 KB 84ms
66ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/3/f3/3f3d199d-abf8-57c1-a077-8eac57247426/64abb6eeee8c4.image.jpg?resize=200%2C180

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

13860d9a3ef014c4e77e4ef585e1ca512fc6e3cf6a05f85e411fce70f5873141

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "dc9ee586a8547ff3ee2945a1fb68ddec"
cf-cache-status: HIT
expires: Fri, 21 Nov 2025 23:23:17 GMT
cf-polished: degrade=85, origSize=10484, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Mon, 10 Jul 2023 07:44:47 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010689ac8abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 10280
server: cloudflare

GET
H2 200 64abb19e2a2a1.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/8/57/857c6c37-490d-5e35-80af-4210f0b5d7a0/ 6 KB
6 KB 80ms
64ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/8/57/857c6c37-490d-5e35-80af-4210f0b5d7a0/64abb19e2a2a1.image.jpg?resize=200%2C150

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

de713a96c9cd834b5c18f79743b62bd50c534bff732e265ca0b8d215c7fda9aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "90f4670423f718e822c1c80803be5038"
cf-cache-status: HIT
expires: Fri, 21 Nov 2025 23:23:17 GMT
cf-polished: origSize=6429, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Mon, 10 Jul 2023 07:22:07 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010689ac9abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6062
server: cloudflare

GET
H2 200 6670cf700aa55.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/8/ff/8ffb1108-2d06-11ef-b34f-d372dc0a1681/ 10 KB
10 KB 79ms
67ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/8/ff/8ffb1108-2d06-11ef-b34f-d372dc0a1681/6670cf700aa55.image.jpg?resize=200%2C162

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ae3c9adc871688ead37386c3e23c75e07568f077ab4851da3c8c8914362868e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "b44d26a259dffc34ac018b81e420e079"
cf-cache-status: HIT
expires: Wed, 12 Nov 2025 02:31:43 GMT
cf-polished: degrade=85, origSize=10034, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Tue, 18 Jun 2024 00:06:08 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010689acaabb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 9756
server: cloudflare

GET
H2 200 673fc3231540a.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/e/c8/ec8e63a4-a860-11ef-afd1-03f5cd91c68d/ 8 KB
8 KB 78ms
66ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/e/c8/ec8e63a4-a860-11ef-afd1-03f5cd91c68d/673fc3231540a.image.jpg?resize=200%2C150

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

58f4eda94248d1e320dea3ea133e130ff1951ea42d0e092122e45dd36df1fed9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "520baff214e5b5cf3c9ecb975d440b38"
cf-cache-status: HIT
expires: Fri, 21 Nov 2025 23:38:51 GMT
cf-polished: degrade=85, origSize=8273, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Thu, 21 Nov 2024 23:32:51 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010689acbabb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7956
server: cloudflare

GET
H2 200 6732bafd4d178.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/6/cd/6cd6e40e-a09c-11ef-8091-9f2e5ad26a3e/ 9 KB
9 KB 90ms
78ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/6/cd/6cd6e40e-a09c-11ef-8091-9f2e5ad26a3e/6732bafd4d178.image.jpg?resize=200%2C150

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2fce813d11267f16b2fc0a5c71b3f660efef3bc1501dd5762d64cfa12731a88c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "06d70901c2f2cc5949e99a05aafb7878"
cf-cache-status: HIT
expires: Wed, 12 Nov 2025 02:31:26 GMT
cf-polished: degrade=85, origSize=8873, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Tue, 12 Nov 2024 02:18:37 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010689accabb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8746
server: cloudflare

GET
H2 200 6722487f54ea5.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/c/6b/c6bcc1dc-96ce-11ef-a8d3-3301bbcc81aa/ 7 KB
8 KB 77ms
65ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/c/6b/c6bcc1dc-96ce-11ef-a8d3-3301bbcc81aa/6722487f54ea5.image.jpg?resize=200%2C150

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c622e6e1126cb3c4c6bd2af17186a3c0738e89f59507f8c57227ff4aad3f612

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "e5b2598a1015bcfb468343c8d1cd5c64"
cf-cache-status: HIT
expires: Wed, 05 Nov 2025 19:32:12 GMT
cf-polished: degrade=85, origSize=10586, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Wed, 30 Oct 2024 14:53:51 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010689aceabb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7578
server: cloudflare

GET
H2 200 672245b87946c.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/1/f0/1f098c0a-96cd-11ef-82db-a7db3b7c6599/ 7 KB
8 KB 80ms
69ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/1/f0/1f098c0a-96cd-11ef-82db-a7db3b7c6599/672245b87946c.image.jpg?resize=200%2C144

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d4f9f58109ef96d36ca52f8bd18a21b75340937871d95cec6e11ed6a7370e6ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "84fefd703befbf95d01dad08ec0d2345"
cf-cache-status: HIT
expires: Fri, 21 Nov 2025 21:33:56 GMT
cf-polished: degrade=85, origSize=10620, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Wed, 30 Oct 2024 14:42:00 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010689acfabb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7544
server: cloudflare

GET
H2 200 673512edbd3f9.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/0/44/044fb53e-a202-11ef-b4ba-1769b7c2d9c0/ 5 KB
5 KB 89ms
78ms Image
image/webp 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/0/44/044fb53e-a202-11ef-b4ba-1769b7c2d9c0/673512edbd3f9.image.jpg?resize=200%2C153

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

80f074e9be412b958715081710266bb3b8cd89550bf21ec03c7e13ec36073c1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "e87dcf68706ef81b5e004bdb3461bbe8"
cf-cache-status: HIT
expires: Fri, 21 Nov 2025 23:15:40 GMT
cf-polished: qual=85, origFmt=jpeg, origSize=8935
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/webp
content-disposition: inline; filename="673512edbd3f9.webp"
vary: Accept
last-modified: Wed, 13 Nov 2024 20:58:21 GMT
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010689ad0abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5404
server: cloudflare

GET
H2 200 64ba0eeb9aab2.image.png
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/f/66/f66a9a06-ce57-5510-8a1e-0d33d4e158f0/ 3 KB
3 KB 90ms
77ms Image
image/webp 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/f/66/f66a9a06-ce57-5510-8a1e-0d33d4e158f0/64ba0eeb9aab2.image.png?resize=200%2C100

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2027d1787b66ef290a0e9901721bc22309600eb642bfbfb625e8f9ac3e23b759

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "b5235d78e0cbda30571a41f033c22250"
cf-cache-status: HIT
expires: Tue, 07 Oct 2025 05:10:45 GMT
cf-polished: origFmt=png, origSize=5959
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/webp
content-disposition: inline; filename="64ba0eeb9aab2.webp"
vary: Accept
last-modified: Fri, 21 Jul 2023 04:51:55 GMT
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010689ad1abb8-YYZ
access-control-allow-origin: *
server: cloudflare

GET
H2 200 66e205e011818.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/7/10/71003b52-7081-11ef-b8a4-9b9567a3becf/ 9 KB
9 KB 89ms
77ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/7/10/71003b52-7081-11ef-b8a4-9b9567a3becf/66e205e011818.image.jpg?resize=200%2C200

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0b5ae21eac1a31d5486e8ae0df768b63de6670d17855568eaa3118a747778c19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "2478a88db9ede9e2ed376749bcc694a9"
cf-cache-status: HIT
expires: Fri, 21 Nov 2025 03:35:29 GMT
cf-polished: origSize=9617, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: image/jpeg
last-modified: Wed, 11 Sep 2024 21:04:32 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e8010689ad2abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8786
server: cloudflare

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 541df9709e639a31e400f0b9d0255d2b096ec4cefefe496c38450b96f6e7ff0e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 74 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b15dec3d30115400e55a13974894241063aeb3500c18474e50a0b1fca5226e02

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 73 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bc40838a707dba656095bdce002939c726b0fe7de618b613ff3a29a39aef0938

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/ 492 KB
152 KB 34ms
33ms Script
text/javascript 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

b95fe6fcb4925330bf629fda90a1362a336b4a8b87bf9573d87927d78c186062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: br
etag: 1421939719645060458
age: 57400
x-content-type-options: nosniff
expires: Mon, 24 Nov 2025 15:56:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 24 Nov 2024 15:56:37 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 155913
x-xss-protection: 0
server: cafe

GET
H2 200 /
www.tradingview-widget.com/embed-widget/market-overview/ Frame B006 0
0 183ms
34ms Document
text/html 37.19.207.34
CDN77 Datacamp Li...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tradingview-widget.com/embed-widget/market-overview/?locale=en

Requested by

Host: s3.tradingview.com
URL: https://s3.tradingview.com/external-embedding/embed-widget-market-overview.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

37.19.207.34 Ashburn, United States, ASN60068 (CDN77 Datacamp Limited, GB),

Reverse DNS

37-19-207-34.bunnyinfra.net

Software

BunnyCDN-ASB1-925 /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https: data: blob: wss: 'unsafe-inline'; object-src 'none'; base-uri 'none'; script-src https://static.tradingview.com/static/ blob: https://.ampproject.org/ https://.paypal.com/ https://platform.twitter.com https://platform.x.com https://songbird.cardinalcommerce.com/edge/v1/ https://checkout.razorpay.com/ https://cdn.checkout.com/ https://www.tradingview-widget.com/static/bundles/embed/ 'nonce-7TrOGYNZq0HVXUh/4jkWxw=='
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.wintersexpress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control: max-age=120
cdn-cache: HIT
cdn-cachedat: 11/25/2024 07:52:58
cdn-edgestorageid: 925
cdn-proxyver: 1.06
cdn-pullzone: 2118568
cdn-requestcountrycode: CA
cdn-requestid: 666109e5f43ef8c3e59c434eefd11746
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-status: 200
cdn-uid: 0e2daf09-b694-4906-9f20-7c3ca5f9a6a3
content-encoding: br
content-security-policy: default-src 'self' https: data: blob: wss: 'unsafe-inline'; object-src 'none'; base-uri 'none'; script-src https://static.tradingview.com/static/ blob: https://*.ampproject.org/ https://*.paypal.com/ https://platform.twitter.com https://platform.x.com https://songbird.cardinalcommerce.com/edge/v1/ https://checkout.razorpay.com/ https://cdn.checkout.com/ https://www.tradingview-widget.com/static/bundles/embed/ 'nonce-7TrOGYNZq0HVXUh/4jkWxw=='
content-type: text/html; charset=utf-8
date: Mon, 25 Nov 2024 07:53:17 GMT
expires: Mon, 25 Nov 2024 07:53:16 GMT
referrer-policy: origin-when-cross-origin
server: BunnyCDN-ASB1-925
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H2 429 /
www.wintersexpress.com/tncms/csrf/token/ 67 B
0 35ms
34ms Fetch
text/plain 192.104.182.109
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wintersexpress.com/tncms/csrf/token/
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/shared-content/art/tncms/api/csrf.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.182.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.us-midwest-1.vip.tn-cloud.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, no-store
content-length: 67
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: text/plain

GET
H2 200 e42ec5cd-11f7-4d8a-a91c-74054da9c4cb Show response
config.aps.amazon-adsystem.com/configs/ 563 B
838 B 154ms
33ms Script
application/javascript 18.160.10.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/e42ec5cd-11f7-4d8a-a91c-74054da9c4cb
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.10.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-10-17.iad12.r.cloudfront.net
Software: CloudFront /
Resource Hash: 778ddd4dd74db059c0b76267e415e95fca61d5396f6d485e3d7a75028f371fbd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: max-age=3600
age: 768
via: 1.1 2a3aa853116c0a37d6c7762eca54d208.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: L1_T3I6h97xWSx8OiqLG5NFs3Jq84t--5Wk3bkwcZY5pgJFUoxacyQ==
date: Mon, 25 Nov 2024 07:40:29 GMT
content-type: application/javascript
x-amz-cf-pop: IAD12-P3
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 3 KB
3 KB 48ms
47ms XHR
application/json 108.138.70.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fwww.wintersexpress.com&pubid=e42ec5cd-11f7-4d8a-a91c-74054da9c4cb
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.70.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-70-84.iad12.r.cloudfront.net
Software: Server /
Resource Hash: 2a6189f8ee4035f048eaedb4744ef6300f362a90a1f7aa6906edeac2e8e49eb4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
via: 1.1 45893c5ff2aa24fa7dce9573a0274642.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.wintersexpress.com
x-cache: Miss from cloudfront
content-length: 3066
x-amz-cf-id: rICvPxrH2SR56QSADvx00FUVKYuCe1UiDwR6O2vzYq7gRBck4wFNMQ==
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: IAD12-P1
server: Server

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 121ms
44ms XHR
application/javascript 108.138.70.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.70.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-70-84.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-allow-methods: GET
x-cache: RefreshHit from cloudfront
x-amz-cf-id: iZj7vI35hRxKPQbd8971NgjlqYc6DxwYTm4iR2SAyEwMrWEzoAnxBA==
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 a53ebc5c4d12bc9682b9c11ea18dccbe.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: IAD12-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 219 KB
77 KB 44ms
43ms Script
application/javascript 2607:f8b0:4004:c21::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5MTD44X&l=dataLayer&gtm=45He4bk0v72758733za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PDQV3N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f30673a2e4a0eac691ae17c3bfd089302541e12f45ade488f4919f70dc42f681

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Mon, 25 Nov 2024 07:53:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 25 Nov 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 78368
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 305 KB
86 KB 58ms
58ms Script
application/javascript 2607:f8b0:4004:c21::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WXMV2VZ&l=dataLayer&gtm=45He4bk0v72758733za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PDQV3N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4e1ad9009b927e35bc8d997f2bd7ad0ce3fced1ed3ede5279bc63853b023fa86

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Mon, 25 Nov 2024 07:53:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 25 Nov 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 88064
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 136ms
31ms Script
application/javascript 104.94.117.85
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.94.117.85 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-94-117-85.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Mon, 25 Nov 2024 08:08:17 GMT
accept-ranges: bytes
content-length: 17407
date: Mon, 25 Nov 2024 07:53:17 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 125ms
35ms Script
text/javascript 3.167.69.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.69.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-69-118.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 81491
via: 1.1 beec8df5d3c3defd412e08f4a26fcf0c.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: dC4seBgJYoNbp8BAAfoS1mOJ0rWGIy0aOfuC8fiy_-kkKR-wVO2-zA==
date: Sun, 24 Nov 2024 09:15:07 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P6
x-amz-server-side-encryption: AES256

GET
H2 200 ima.js Show response
cdn-ima.33across.com/ 16 KB
6 KB 105ms
31ms Script
application/javascript 104.18.29.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ima.js
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.29.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ee7d90acfcf61e37a67097a1f97ddb90fd685f3e9dcb6ed34931f2b94713d8d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"671a7171-403e"
age: 207052
cf-ray: 8e80106bfc7336d3-YYZ
expires: Thu, 28 Nov 2024 07:53:17 GMT
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: application/javascript
last-modified: Thu, 24 Oct 2024 16:10:25 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 56 KB
12 KB 82ms
27ms Script
text/javascript 2606:4700:10::6816:34ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fwww.wintersexpress.com%2F&ref=&_it=amazon&partner_id=664
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:34ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 492db2ca577f4d221e3e28239c19e7db05f1701b298bf278fc4d1fcb92563586

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"1e77f38a1df1490d4175e3c4878bd150"
age: 563
x-amz-request-id: THYSH64QJPGS7V2H
cf-ray: 8e80106bdd14a306-YUL
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: text/javascript
last-modified: Fri, 15 Nov 2024 18:21:40 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-id-2: pzbDREEUmeCFhhPDngmrmdpF9XszREUUlcIdr98gnp9lMbyksiSyrcfwDBCQ3Ak+bkRLsZNlE90=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 100 KB
29 KB 75ms
27ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab2ce7a605858febda81cd3408ddb9897e109b417d514d9c12cf0e1a89658ae4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-amz-id-2: owy1RIYgBrgwEpx4XhPtMjUY6FmSw8aJnvfE+18sujP6tLRsNYUzOCiWqB21Zd9XDsVJ69alNxqyL5Pgoseb2q1P/Iw0J9hk
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"14cd899b51c2c37c71fbf5e1ae6fe38b"
age: 2047
x-amz-request-id: 3A8DGG9F00Y5TCYT
cf-ray: 8e80106bc809a2f4-YUL
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: text/javascript;charset=utf-8
last-modified: Wed, 13 Nov 2024 11:06:09 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 64 B
421 B 201ms
66ms XHR
text/javascript 3.167.98.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.wintersexpress.com%2F&pid=oY3MSjKF8nlTA&cb=0&ws=1600x1200&v=24.1105.2150&t=2000&slots=%5B%7B%22sd%22%3A%22ad-2953096%22%2C%22s%22%3A%5B%222x1%22%5D%2C%22sn%22%3A%22%2F132916964%2C32926401%2Fwintersexpress.com%2Fhomepage%22%7D%2C%7B%22sd%22%3A%22ad-2953099%22%2C%22s%22%3A%5B%221x1%22%5D%2C%22sn%22%3A%22%2F132916964%2C32926401%2Fwintersexpress.com%2Fhomepage%22%7D%2C%7B%22sd%22%3A%22ad-2953072%22%2C%22s%22%3A%5B%221170x90%22%2C%22970x90%22%2C%22728x90%22%2C%22728x250%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F132916964%2C32926401%2Fwintersexpress.com%2Fhomepage%22%7D%2C%7B%22sd%22%3A%22ad-2953075%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F132916964%2C32926401%2Fwintersexpress.com%2Fhomepage%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22platform%22%3A%7B%22brand%22%3A%22%22%2C%22version%22%3A%5B%22%22%5D%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sm=619d3ff8-be70-4411-af3f-1fc17f3c1134&pubid=e42ec5cd-11f7-4d8a-a91c-74054da9c4cb&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.98.152 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-98-152.iad55.r.cloudfront.net
Software: Server /
Resource Hash: d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 48850a600c11c704f12260094c298d3a.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.wintersexpress.com
x-cache: Miss from cloudfront
content-length: 84
x-amz-cf-id: 6bRIxjYF18fk84Ykb3Wt0AAjrbaTPqPg6d92nMS9kBBx2shJd5YfDw==
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: text/javascript;charset=UTF-8
x-amz-cf-pop: IAD55-P7
server: Server

GET
H2 200 132916964 Show response
fundingchoicesmessages.google.com/i/ 196 KB
65 KB 128ms
58ms Script
application/javascript 2607:f8b0:4004:c08::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/132916964?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c7b9fa70e938248d77e1f1ee044eb34307b4ffe78e77d9d0637d8a07363388fd

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-7245lECicRRng3lsksxtnA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmJw15BikPj6kkkLiJ3SZ7CGAHHrzXOs04E46d951hIgNlS4xOoMxI5Fl1g9gVi15xKrORDfX3eJ9TkQzzh_mXUBEBdJXGFtAeLbTVdYHwMxw9crrBxALMTD8fbmhF1sAjfO7exjUtJIyi-MT87PKynKTCotyS9KS05LLU4tKkstijcyMDIxNDS01DMwjC8wAABXgUJL"
content-security-policy: script-src 'report-sample' 'nonce-7245lECicRRng3lsksxtnA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 publisher_settings Show response
discovery.evvnt.com/api/publisher/wintersexpress.com/ 6 KB
2 KB 69ms
34ms Fetch
application/json 99.84.208.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://discovery.evvnt.com/api/publisher/wintersexpress.com/publisher_settings
Requested by: Host: discovery.evvnt.com
URL: https://discovery.evvnt.com/prd/evvnt_discovery_plugin-latest.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.208.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-208-21.iad79.r.cloudfront.net
Software: / Express
Resource Hash: d1955c7004fb7e187c686837acd2ef206e17381beea159d58786ccda164c513f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: public, max-age=120
content-encoding: br
etag: W/"18b2-UjxJ76tgXLw/FdYFwFLePrFNTcQ"
age: 1259
via: 1.1 aae0c8231be15466b169b68f10d6a918.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-cf-id: xW-aYPZCmUPN7ShyfCIPiBlHKGtw7aIRLBSP1KUmBlct2SbpOmse1w==
date: Mon, 25 Nov 2024 07:32:18 GMT
content-type: application/json; charset=utf-8
x-powered-by: Express
vary: Accept-Encoding
x-amz-cf-pop: IAD79-C1

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 128 B
282 B 42ms
41ms XHR
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=664&sync=0&domain=www.wintersexpress.com&url=https://www.wintersexpress.com/
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fwww.wintersexpress.com%2F&ref=&_it=amazon&partner_id=664
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d31a20c7aa35343affd5eaf512e5fdb532bdf6211a22aafd620358a0bc3b5150

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
debug: NON-OPTIONS
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
access-control-allow-credentials: true
cf-ray: 8e80106d6fa8a2db-YUL
access-control-allow-origin: *
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: authorization,content-type

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 138ms
40ms Preflight
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=664&sync=0&domain=www.wintersexpress.com&url=https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.wintersexpress.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 8e80106d2f8da2db-YUL
content-length: 0
content-type: application/json
date: Mon, 25 Nov 2024 07:53:17 GMT
debug: OPTIONS block
expires: Tue, 25 Nov 2025 07:53:17 GMT
server: cloudflare

GET
H2

200

envelope Show response
lexicon.33across.com/v1/
Redirect Chain

https://lexicon.33across.com/v1/envelope?pid=0010b00002XdhehAAB&src=aps&ver=1.14.0
https://lexicon.33across.com/v1/envelope?pid=0010b00002XdhehAAB&src=aps&ver=1.14.0&b=1&tp=v0Y8YcFCaTkRSvkI3jkVsq8YAXNP44pUOpX%2BcdHYCtg%3D

42 B
138 B

34ms
32ms

XHR
application/json

35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0010b00002XdhehAAB&src=aps&ver=1.14.0&b=1&tp=v0Y8YcFCaTkRSvkI3jkVsq8YAXNP44pUOpX%2BcdHYCtg%3D
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 435b1ece4a55f4f8d06866b32c1aee3cc4661eb905265894795f15a57bf1b33d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.wintersexpress.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
date: Mon, 25 Nov 2024 07:53:16 GMT
content-type: application/json
vary: origin

Redirect headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
location: https://lexicon.33across.com/v1/envelope?pid=0010b00002XdhehAAB&src=aps&ver=1.14.0&b=1&tp=v0Y8YcFCaTkRSvkI3jkVsq8YAXNP44pUOpX%2BcdHYCtg%3D
access-control-allow-credentials: true
referrer-policy: unsafe-url
via: 1.1 google
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: https://www.wintersexpress.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 25 Nov 2024 07:53:17 GMT
vary: origin

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 308 KB
104 KB 51ms
45ms Script
application/javascript 142.250.31.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-4T2EB147B8&l=dataLayer&cx=c&gtm=45He4bk0v861227858za200zb72758733

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WXMV2VZ&l=dataLayer&gtm=45He4bk0v72758733za200

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

15a84b19341f0d72d23c8448cbb52e22631a48bee328f0f30ffe1ef4875c2ebc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Mon, 25 Nov 2024 07:53:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 106474
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 analytics.min.js Show response
cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/ 106 KB
30 KB 158ms
42ms Script
text/javascript 99.86.191.237
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/analytics.min.js
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.191.237 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-191-237.iad79.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c61fcc1401e2278735bea5d306ca0cc32b93ccdf62ec8179ed0c999545b5502b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

access-control-max-age: 3000
content-encoding: br
x-amz-version-id: cknvhRie0d.5LSRvFhB35AONaxh2m0FR
etag: W/"ca62e8a5580d4550920a84f5b7875661"
age: 54
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: NT_prcgr7dSo2PNrdjHrue3OuRK15WpfkAOn3m80W2u-ZHRxZNLfSQ==
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: text/javascript; charset=utf-8
vary: accept-encoding
last-modified: Tue, 19 Nov 2024 19:35:36 GMT
x-amz-replication-status: COMPLETED
cache-control: public, max-age=120
via: 1.1 9edb8d9b9614520133cf2257f302ebaa.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: IAD79-C3
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
618 B 126ms
41ms XHR
application/json 3.227.77.161
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.227.77.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-227-77-161.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: b58afd1c343ecc242a39f65193fb69135edf92aabb8784816aa8301ab7865fe3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.wintersexpress.com
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 156
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: application/json;charset=utf-8
x-server: 10.40.3.253
server: Jetty(9.4.38.v20210224)

GET
H2 200 6670cf700aa55.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/8/ff/8ffb1108-2d06-11ef-b34f-d372dc0a1681/ 15 KB
15 KB 46ms
45ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/8/ff/8ffb1108-2d06-11ef-b34f-d372dc0a1681/6670cf700aa55.image.jpg?crop=720%2C405%2C0%2C89&resize=300%2C169&order=crop%2Cresize

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

78680443b8482ebd2d59d90323f15e53781a62b25ca7d2452d25eba4f631aaff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "49dd2050bd71ef1bd8f0b85b1cba03a3"
cf-cache-status: HIT
expires: Sat, 15 Nov 2025 08:30:38 GMT
cf-polished: degrade=85, origSize=15129, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: image/jpeg
last-modified: Tue, 18 Jun 2024 00:06:08 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e80106cfcf8abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14999
server: cloudflare

GET
H2 200 673fc3231540a.image.jpg
bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/e/c8/ec8e63a4-a860-11ef-afd1-03f5cd91c68d/ 36 KB
37 KB 50ms
49ms Image
image/jpeg 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/content/tncms/assets/v3/editorial/e/c8/ec8e63a4-a860-11ef-afd1-03f5cd91c68d/673fc3231540a.image.jpg?crop=936%2C527%2C0%2C87&resize=640%2C360&order=crop%2Cresize

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb84aa93d407741c01d2655b587a6de47bad9046e89d37e97fabd629d85cb76a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
cf-bgj: imgq:85,h2pri
etag: "42ba0ecf94f82af91b3b7c591782b800"
cf-cache-status: HIT
expires: Fri, 21 Nov 2025 23:53:03 GMT
cf-polished: origSize=38985, status=webp_bigger
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: image/jpeg
last-modified: Thu, 21 Nov 2024 23:32:51 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e80106cfcf9abb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 37295
server: cloudflare

GET
H2 200 1bd5d34e3cb4c76be920.discovery_plugin.chunk.js Show response
discovery.evvnt.com/prd/ 71 KB
24 KB 36ms
31ms Script
text/javascript 2600:9000:2199:d000:18:a82e:7180:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://discovery.evvnt.com/prd/1bd5d34e3cb4c76be920.discovery_plugin.chunk.js
Requested by: Host: discovery.evvnt.com
URL: https://discovery.evvnt.com/prd/evvnt_discovery_plugin-latest.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2199:d000:18:a82e:7180:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c0bc803ded3eb30a6da6c3a037589f7554a759eb01357fe52de1adc19193d87b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-amz-cf-pop: IAD79-C1
cache-control: public, max-age= 31536000
content-encoding: br
etag: W/"ab6c7c6a4c0562bc0790dbbc1880e29c"
age: 80939
via: 1.1 e7311287a3a52035e5fcaf9a58791104.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 8Oq2We9dZkquCgINYvrU33dT-Fu38Mx8EMNqTdHDvCXR1BpHNJBeHg==
date: Sun, 24 Nov 2024 09:24:19 GMT
content-type: text/javascript
vary: accept-encoding
server: AmazonS3
last-modified: Mon, 30 Sep 2024 23:41:18 GMT
x-amz-server-side-encryption: AES256

GET
H2 200 0b1ce43b67eebae6e37b.discovery_plugin.chunk.js Show response
discovery.evvnt.com/prd/ 22 KB
7 KB 40ms
35ms Script
text/javascript 2600:9000:2199:d000:18:a82e:7180:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://discovery.evvnt.com/prd/0b1ce43b67eebae6e37b.discovery_plugin.chunk.js
Requested by: Host: discovery.evvnt.com
URL: https://discovery.evvnt.com/prd/evvnt_discovery_plugin-latest.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2199:d000:18:a82e:7180:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6696ed43d6d776de48975f4c28e254e10917c6af9e789d85a0747dd0df73b011

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-amz-cf-pop: IAD79-C1
cache-control: public, max-age= 31536000
content-encoding: br
etag: W/"4f392753ed293a648f9ee43ae26aab8a"
age: 80938
via: 1.1 e7311287a3a52035e5fcaf9a58791104.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: F3B5fIztDqZrHy2rIAZuuWH0xPuAvwk_42H7BLJB6BD9oqmQgIu6mw==
date: Sun, 24 Nov 2024 09:24:20 GMT
content-type: text/javascript
vary: accept-encoding
server: AmazonS3
last-modified: Mon, 30 Sep 2024 23:41:18 GMT
x-amz-server-side-encryption: AES256

GET
H2 200 1015f49f36c26dd0963e.discovery_plugin.chunk.js Show response
discovery.evvnt.com/prd/ 33 KB
11 KB 41ms
37ms Script
text/javascript 2600:9000:2199:d000:18:a82e:7180:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://discovery.evvnt.com/prd/1015f49f36c26dd0963e.discovery_plugin.chunk.js
Requested by: Host: discovery.evvnt.com
URL: https://discovery.evvnt.com/prd/evvnt_discovery_plugin-latest.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2199:d000:18:a82e:7180:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f1c47b530099b2d4785e3e97e6d84c67a1fef2563fe7499715948fd060a80e68

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-amz-cf-pop: IAD79-C1
cache-control: public, max-age= 31536000
content-encoding: br
etag: W/"d2864425b91c12c5964886492143258c"
age: 4808
via: 1.1 e7311287a3a52035e5fcaf9a58791104.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: WEOJruzru3tFbeoI_r0DrcseJdEMYbAUwO1O4r59Nb3xBWcLWl4RCw==
date: Mon, 25 Nov 2024 06:33:10 GMT
content-type: text/javascript
vary: accept-encoding
server: AmazonS3
last-modified: Mon, 30 Sep 2024 23:41:18 GMT
x-amz-server-side-encryption: AES256

GET
H2 200 2c683219b28d5899b23f.discovery_plugin.chunk.js Show response
discovery.evvnt.com/prd/ 21 KB
7 KB 43ms
39ms Script
text/javascript 2600:9000:2199:d000:18:a82e:7180:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://discovery.evvnt.com/prd/2c683219b28d5899b23f.discovery_plugin.chunk.js
Requested by: Host: discovery.evvnt.com
URL: https://discovery.evvnt.com/prd/evvnt_discovery_plugin-latest.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2199:d000:18:a82e:7180:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3eb03286cfecb19f6e1290e06e301e8aa08ad44f7b6503ef50d1c81cc2dffbc5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-amz-cf-pop: IAD79-C1
cache-control: public, max-age= 31536000
content-encoding: br
etag: W/"c380af0d43c8706d2fa9d8d7912f1399"
age: 2330
via: 1.1 e7311287a3a52035e5fcaf9a58791104.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: UR4t3FZpo-ilzh-qvliEGRrXp_MAjxIZd0MtyipCQV0RdJwTm7OKog==
date: Mon, 25 Nov 2024 07:14:28 GMT
content-type: text/javascript
vary: accept-encoding
server: AmazonS3
last-modified: Mon, 30 Sep 2024 23:41:18 GMT
x-amz-server-side-encryption: AES256

GET
H2 200 39734b965a9f1204aea7.discovery_plugin.chunk.js Show response
discovery.evvnt.com/prd/ 52 KB
7 KB 42ms
39ms Script
text/javascript 2600:9000:2199:d000:18:a82e:7180:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://discovery.evvnt.com/prd/39734b965a9f1204aea7.discovery_plugin.chunk.js
Requested by: Host: discovery.evvnt.com
URL: https://discovery.evvnt.com/prd/evvnt_discovery_plugin-latest.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2199:d000:18:a82e:7180:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e790d4a8d8aa7e73e8a014f77dc25e8e5d7e717a24c273ea01f53eba41495bee

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-amz-cf-pop: IAD79-C1
cache-control: public, max-age= 31536000
content-encoding: gzip
etag: W/"5041096b32899ab4c9bb10d5d8fdcfe8"
age: 10969
via: 1.1 e7311287a3a52035e5fcaf9a58791104.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: p2x9MX9Gv-zEIqfdOKcPUzTHLhvw4UxutuWevfbun0blcewJ-FWVeQ==
date: Mon, 25 Nov 2024 04:50:29 GMT
content-type: text/javascript
vary: accept-encoding
server: AmazonS3
last-modified: Mon, 30 Sep 2024 23:41:18 GMT
x-amz-server-side-encryption: AES256

GET
H2 200 2579a868e6715f5dcc71.discovery_plugin.chunk.js Show response
discovery.evvnt.com/prd/ 18 KB
7 KB 45ms
41ms Script
text/javascript 2600:9000:2199:d000:18:a82e:7180:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://discovery.evvnt.com/prd/2579a868e6715f5dcc71.discovery_plugin.chunk.js
Requested by: Host: discovery.evvnt.com
URL: https://discovery.evvnt.com/prd/evvnt_discovery_plugin-latest.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2199:d000:18:a82e:7180:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 438b495b58aff2c18739f6ac7b88c6b857b51b5beef4070832cd77b901540cd5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-amz-cf-pop: IAD79-C1
cache-control: public, max-age= 31536000
content-encoding: br
etag: W/"7305d35e0783417aef857bb5e997c629"
age: 80938
via: 1.1 e7311287a3a52035e5fcaf9a58791104.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: BSCJsWATLeQDpzfwX77BO9uIMVeD6u9B-9et493mEjZY3qJotGWhnA==
date: Sun, 24 Nov 2024 09:24:20 GMT
content-type: text/javascript
vary: accept-encoding
server: AmazonS3
last-modified: Mon, 30 Sep 2024 23:41:18 GMT
x-amz-server-side-encryption: AES256

GET
H2 200 4e23f623619524c76371.discovery_plugin.chunk.js Show response
discovery.evvnt.com/prd/ 8 KB
3 KB 45ms
42ms Script
text/javascript 2600:9000:2199:d000:18:a82e:7180:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://discovery.evvnt.com/prd/4e23f623619524c76371.discovery_plugin.chunk.js
Requested by: Host: discovery.evvnt.com
URL: https://discovery.evvnt.com/prd/evvnt_discovery_plugin-latest.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2199:d000:18:a82e:7180:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1e6807edce0b29407094360025d2e6c1e9cc5e4119f08eecc0e6bc5075c7afab

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-amz-cf-pop: IAD79-C1
cache-control: public, max-age= 31536000
content-encoding: br
etag: W/"c12230e8fbaa51c8a6a30728032fe280"
age: 81552
via: 1.1 e7311287a3a52035e5fcaf9a58791104.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: chia1qlC_9O9NVis6W0WsLjVpfog0fwuasNJCUJ6VVWcBJUuJmotnw==
date: Sun, 24 Nov 2024 09:14:06 GMT
content-type: text/javascript
vary: accept-encoding
server: AmazonS3
last-modified: Mon, 30 Sep 2024 23:41:19 GMT
x-amz-server-side-encryption: AES256

GET
H2 200 AGSKWxVBXQcQfi8emDBaALjsx4fYFTABtOuc16tE3kU3k5OGKrnOx6COMxQzvrDXY8lv2E_QOWC7PpqP7zTAi9KFnJ-dQqx5LLUW5nD3tJJ0xR2i3I9dLupRUosFbXRBk1FsYgf5jJH_wA== Show response
fundingchoicesmessages.google.com/f/ 10 KB
5 KB 64ms
62ms Script
application/javascript 2607:f8b0:4004:c08::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVBXQcQfi8emDBaALjsx4fYFTABtOuc16tE3kU3k5OGKrnOx6COMxQzvrDXY8lv2E_QOWC7PpqP7zTAi9KFnJ-dQqx5LLUW5nD3tJJ0xR2i3I9dLupRUosFbXRBk1FsYgf5jJH_wA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzMyNTIxMTk3LDcwMDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly93d3cud2ludGVyc2V4cHJlc3MuY29tLyIsbnVsbCxbWzgsIjl6NWtkZHRLZlVvIl0sWzksImVuLVVTIl0sWzE5LCIyIl1dXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.9z5kddtKfUo.es5.O/am=DgY/d=1/rs=AJlcJMy4sqygLRfBfCmmtDRdEVslECkuZQ/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

55ecbba63a08d0f60cfe9da13af30f1e0c3aa69bce0705828c2d249085ada589

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-_n7IiGW_TTUdqZgBxnQ0nA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmLw0JBikPj6kkkLiJ3SZ7CGAHHrzXOs04E46d951hIgNlS4xOoMxI5Fl1g9gVi15xKrORDfX3eJ9TkQzzh_mXUBEBdJXGFtAeLbTVdYHwMxw9crrBxALMTD8fbmhF1sAh1_vj1iUtJIyi-MT87PKynKTCotyS9KS05LLU4tKkstijcyMDIxNDS01DMwjC8wAABq2kK7"
content-security-policy: script-src 'report-sample' 'nonce-_n7IiGW_TTUdqZgBxnQ0nA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame 9A8C 0
0 93ms
31ms Document
text/html 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.wintersexpress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1988
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28994
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 25 Nov 2024 07:20:09 GMT
expires: Mon, 25 Nov 2024 08:10:09 GMT
last-modified: Mon, 18 Nov 2024 20:43:40 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 3 KB
4 KB 148ms
32ms Script
text/javascript 2600:9000:2199:6400:a:e047:754:f4a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2199:6400:a:e047:754:f4a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1764e898369c24be8d7d1cbcb82079c27f3898fbc1883f388a5c1008dd30c9e8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-amz-version-id: 0u1R0tyw.MUCZY63NwBE.7D35dRY5mh8
ETag: "0537d8d06dd9dfbe911ad6bf6504f4bf"
Age: 5306
Connection: keep-alive
Via: 1.1 acb5e0138f17ffe7929a4d64a50c4a24.cloudfront.net (CloudFront)
Accept-Ranges: bytes
X-Cache: Hit from cloudfront
Content-Length: 3181
X-Amz-Cf-Id: 0a3D-tG9wfwv0L_lsfaLX2ZeX8LVq4kidef1lkpFtWxISP-7xGj45w==
Date: Mon, 25 Nov 2024 06:24:52 GMT
Content-Type: text/javascript
Last-Modified: Wed, 31 Jul 2024 16:30:07 GMT
Server: AmazonS3
X-Amz-Cf-Pop: IAD79-C1
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 101 KB
29 KB 34ms
28ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

59855ab21479dde905cf48ff3e82c9c15fcf97c96f99276952e263ede1f58916

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-amz-id-2: o6TWqepGTs+4w/MLbrstr2m+yX+O3cuxyK5GQJA/Z/gBrKpfvysiobSJPdHR+D42UcFib4Fo59A=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"a7da20199e9cb2cd9232f608481d0778"
age: 3336
x-amz-request-id: MY1S3MK7A3C1S8SS
cf-ray: 8e80106dd8e8a2f4-YUL
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: text/javascript;charset=utf-8
last-modified: Wed, 13 Nov 2024 11:06:09 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 129ms
59ms Script
text/javascript 2620:100:a00b::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

1635d2075d3343c86490d2229c1fb868ad59d92958ef65e04cb65767c703e9f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"670e3454-a69c"
cross-origin-resource-policy: cross-origin
expires: Tue, 26 Nov 2024 07:53:17 GMT
access-control-allow-origin: *
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: text/javascript
last-modified: Tue, 15 Oct 2024 09:22:28 GMT
server: nginx

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 90ms
18ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 179699
x-goog-stored-content-encoding: gzip
expires: Sun, 23 Nov 2025 05:58:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Sat, 23 Nov 2024 05:58:18 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AFiumC6J5HrwHJTJbjXwCgCJ-qa0raWhhP9Rj7ZZL1-oOdkjrfhpf0a0f3FfnabTALL7oXg2wi3vrxTxdA
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
1 KB 196ms
133ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 839e11d5ea35fe60fd65d0da091762640d7b98144b58f553a8742d863bc60795

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

etag: 96161c00fc10ad819c09e1314f0ae5b4
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1213
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: text/javascript; charset=utf-8
last-modified: Thu, 14 Nov 2024 17:54:21 GMT
server: Google Frontend
x-cloud-trace-context: 9cb55d4ce25bacef495b80ce1f026903

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 43 KB
13 KB 36ms
32ms Script
text/javascript 3.167.69.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.69.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-69-118.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 30b32e97f2e3e06deb742bf2e19daeb4f4657a956e836c2a25a7df2bc72f7500

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7db46e1255a018ecf02f47b2c19c26c4"
age: 80917
via: 1.1 beec8df5d3c3defd412e08f4a26fcf0c.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: yYffpLgriaStOPYdGtNELEiy7-DLwsWEUztgPFRbNRU7YZAVN12rWg==
date: Sun, 24 Nov 2024 12:19:03 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:40 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P6
x-amz-server-side-encryption: AES256

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
898 B 61ms
18ms Script
application/javascript 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
age: 29975
x-content-type-options: nosniff
x-jsd-version-type: branch
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-eddf8230042-FRA, cache-yul1970052-YUL
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 439
x-jsd-version: master

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 33ms
30ms Script
application/javascript 104.18.29.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.29.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9ffa45453324362cbc5cc78288e04513100c2d61baf3a969717ea5df3d0dbb39

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"671a7174-43df"
age: 527559
cf-ray: 8e80106ddd6e36d3-YYZ
expires: Thu, 28 Nov 2024 07:53:17 GMT
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: application/javascript
last-modified: Thu, 24 Oct 2024 16:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 161 KB
26 KB 436ms
435ms Fetch
text/plain 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2044719051248835&correlator=3260665239399474&eid=31086416%2C31088832%2C31088845%2C83320950%2C31065645%2C31084739%2C31087491&output=ldjh&gdfp_req=1&vrg=202411180101&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&gpp_sid=-1&iu_parts=132916964%3A32926401%2Cwintersexpress.com%2Chomepage&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=2x1%2C1x1%2C1170x90%7C970x90%7C728x90%7C728x250%7C970x250%2C300x250&ifi=1&didk=3432204455~3432204450~3432204521~3432204516&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1732521197722&lmt=1732495964&adxs=799%2C800%2C215%2C230&adys=0%2C1%2C933%2C1349&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C1&ucis=1%7C2%7C3%7C4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.wintersexpress.com%2F&vis=1&psz=1600x1%7C1600x1%7C1600x90%7C300x250&msz=1600x1%7C1600x1%7C1600x90%7C300x250&fws=4%2C4%2C4%2C4&ohw=1600%2C1600%2C1600%2C1600&td=1&egid=35525&tan=6bbc9e20-bc61-4f42-a53d-bd083b4b85ff%2C6bbc9e20-bc61-4f42-a53d-bd083b4b8600%2C6bbc9e20-bc61-4f42-a53d-bd083b4b8601%2C6bbc9e20-bc61-4f42-a53d-bd083b4b8602&tdf=2&topics=9&tps=9&htps=10&a3p=EhkKCnB1YmNpZC5vcmcYkoG-krYySABSAghkEhwKDWNyd2RjbnRybC5uZXQYkoG-krYySABSAghkEhkKCnVpZGFwaS5jb20YkoG-krYySABSAghkEhsKDGlkNS1zeW5jLmNvbRiSgb6StjJIAFICCGQSHQoOZXNwLmNyaXRlby5jb20YkoG-krYySABSAghkEhQKBW9wZW54GJKBvpK2MkgAUgIIZBIbCgwzM2Fjcm9zcy5jb20YkoG-krYySABSAghkEhcKCHJ0YmhvdXNlGJKBvpK2MkgAUgIIZA..&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1732521196442&idt=915&prev_scp=pos%3Dimpact-top%26amznbid%3D2%26amznp%3D2%7Cpos%3Dimpact-sticky-anchor%26amznbid%3D2%26amznp%3D2%7Cpos%3Dbreakout-one%26amznbid%3D2%26amznp%3D2%7Cpos%3Drectangle-left-one%26amznbid%3D2%26amznp%3D2&cust_params=browser%3DChrome%26k%3Dwinters%2520express%26page%3Dhomepage%252Capp-editorial%26pub%3DWinters%2520Express&adks=1819146505%2C1801229185%2C1853130385%2C4084300749&frm=20&eoidce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

3d05096c2a13ec3370b57c4fcac3e66906deb13f85728d4f66c19949b3415fec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: br
google-lineitem-id: 6786420681,6298314877,6819535119,6819535119
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2,-2,-2,-2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138489845433,138432427740,138494739422,138495317218
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.wintersexpress.com
content-length: 26615
x-xss-protection: 0
server: cafe

GET
H2 200 container.html
846d83c2930c516597075cc9390fed92.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame EC20 0
0 160ms
34ms Document
text/html 2607:f8b0:4004:c21::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://846d83c2930c516597075cc9390fed92.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.wintersexpress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 25 Nov 2024 07:53:17 GMT
expires: Mon, 25 Nov 2024 07:53:17 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 664 Show response
a.ad.gt/api/v1/u/matches/ 8 KB
4 KB 71ms
28ms Script
application/javascript 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/664?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fwww.wintersexpress.com%2F&ref=&_it=amazon&partner_id=664
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e1c35b709f85d2f8fcbe980f34cd2e8cceebcf578928fb274c4419bb39e83c09

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 262
cross-origin-resource-policy: cross-origin
cf-ray: 8e80106e4ae1a2b0-YUL
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: application/javascript
last-modified: Mon, 25 Nov 2024 07:45:04 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 204 collect
analytics.google.com/g/ 0
0 92ms
39ms Fetch
text/plain 2001:4860:4802:36::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-4T2EB147B8&gtm=45je4bk0v887101457z8861227858za200zb861227858&_p=1732521196640&_gaz=1&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&tag_exp=101925629~102067555~102067808~102077855~102081485&cid=1130602829.1732521198&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&dt=wintersexpress.com%20%7C%20Winters%20Express&dl=https%3A%2F%2Fwww.wintersexpress.com%2F&sid=1732521197&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1&ep.canonical_url=https%3A%2F%2Fwww.wintersexpress.com%2F&epn.townnews_crm_group_id=39&ep.generator=BLOX&ep.generator_version=1.83.2&tfd=1698
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4T2EB147B8&l=dataLayer&cx=c&gtm=45He4bk0v861227858za200zb72758733
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.wintersexpress.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
559 B 108ms
41ms Ping
text/plain 2607:f8b0:4004:c17::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-4T2EB147B8&cid=1130602829.1732521198&gtm=45je4bk0v887101457z8861227858za200zb861227858&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=0&tag_exp=101925629~102067555~102067808~102077855~102081485
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4T2EB147B8&l=dataLayer&cx=c&gtm=45He4bk0v861227858za200zb72758733
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c17::9c Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.wintersexpress.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame 5763 0
0 119ms
45ms Document
text/html 2607:f8b0:4004:c19::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-4T2EB147B8&gacid=1130602829.1732521198&gtm=45je4bk0v887101457z8861227858za200zb861227858&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102077855~102081485&z=1487293689

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4T2EB147B8&l=dataLayer&cx=c&gtm=45He4bk0v861227858za200zb72758733

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.wintersexpress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 25 Nov 2024 07:53:17 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 80ms
44ms Image
image/gif 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-4T2EB147B8&cid=1130602829.1732521198&gtm=45je4bk0v887101457z8861227858za200zb861227858&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=0&tag_exp=101925629~102067555~102067808~102077855~102081485&tag_exp=101925629~102067555~102067808~102077855~102081485&z=1734732357

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Mon, 25 Nov 2024 07:53:17 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 settings Show response
cdn.segment.com/v1/projects/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/ 10 KB
2 KB 98ms
30ms Fetch
application/json 99.86.191.237
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/v1/projects/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/settings
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.191.237 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-191-237.iad79.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 46311b08c6775f4a3598bec2532b2767d4c9ef866b8af6399e6cfa57079c4c38

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: J6xG0q7LpAN08sdn9Kl4P8QPe085plre
etag: W/"9a459088a5d6405a19f4614acfb211d0"
age: 6138
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: 4hzHnr8rxb4KmYkU2r6IVRGRJKlOmOeYv_ATQIgVUr1JeMWIa9vTSQ==
date: Mon, 25 Nov 2024 06:10:59 GMT
content-type: application/json; charset=utf-8
vary: accept-encoding
last-modified: Tue, 19 Nov 2024 19:35:38 GMT
x-amz-replication-status: COMPLETED
cache-control: public, max-age=10800
via: 1.1 55fa3dde23353cff6cf7a09eb763933c.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: IAD79-C3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 207 KB
73 KB 44ms
44ms Script
application/javascript 142.250.31.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PDMH9T6&gtm_auth=QzlUjhMy0COR5MgCC_1Cyw&gtm_preview=env-1&gtm_cookies_win=x

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

1672054d64fb96cb8e4564615657184ed3d7fb33c4ffbd252d9acf9a36264f95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: application/javascript; charset=UTF-8
vary: *
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 75010
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 4e1251346db872331a84.powered_by_evvnt.png
discovery.evvnt.com/prd/images/ 17 KB
17 KB 40ms
40ms Image
image/png 99.84.208.21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://discovery.evvnt.com/prd/images/4e1251346db872331a84.powered_by_evvnt.png
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.208.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-208-21.iad79.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37d44df61428260da98324576010ebd04c0d5a1ce6774bbed15bbfbdfc141a0c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

etag: "097fd79365bc9c17a0b1ec1596d8c8b7"
age: 1021
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: -amSV4rb5V4YRS0VLuq2P13wpi9eCxk2LcaGYDJHhkNQkG18dPOuog==
date: Mon, 25 Nov 2024 07:36:17 GMT
content-type: image/png
vary: accept-encoding
last-modified: Mon, 30 Sep 2024 23:41:20 GMT
cache-control: public, max-age= 31536000
via: 1.1 39174a6a452e175e6e614ff396a4ca4e.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 17440
x-amz-cf-pop: IAD79-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 widget_events Show response
discovery.evvnt.com/api/publisher/6938/ 27 KB
6 KB 40ms
40ms Fetch
application/json 99.84.208.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://discovery.evvnt.com/api/publisher/6938/widget_events?hitsPerPage=30&multipleEventInstances=true&publisher_id=6938&widgetNumber=30
Requested by: Host: discovery.evvnt.com
URL: https://discovery.evvnt.com/prd/evvnt_discovery_plugin-latest.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.208.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-208-21.iad79.r.cloudfront.net
Software: / Express
Resource Hash: 45b1551d108bf6c7e80dfa083a293ae5467d720227cf680f0348b5821f5ac374

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: public, max-age=1800, stale-while-revalidate=1800
content-encoding: br
etag: W/"6c8b-2Say/AaD/Pqt2BGi7MjMaJuVYps"
age: 1258
via: 1.1 aae0c8231be15466b169b68f10d6a918.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-cf-id: BVfrxSv8VGvv4UvUDBrqySyPpcrLjMfEQQLNN1RC-wU8obpE291vCQ==
date: Mon, 25 Nov 2024 07:32:19 GMT
content-type: application/json; charset=utf-8
x-powered-by: Express
vary: Accept-Encoding
x-amz-cf-pop: IAD79-C1

GET
H2 204 increment Show response
id5-sync.com/api/esp/ 0
238 B 387ms
107ms XHR
text/plain 162.19.138.83
OVH OVH SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.wintersexpress.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.wintersexpress.com
date: Mon, 25 Nov 2024 07:53:17 GMT
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 664 Show response
p.ad.gt/api/v1/p/ 40 KB
14 KB 112ms
28ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://p.ad.gt/api/v1/p/664
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/664?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2a514fbb52956f623e0a80bdb74df6608efe564e1ccfc7fdf10705baf917750c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 262
cf-ray: 8e80106f7962a311-YUL
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Mon, 25 Nov 2024 07:46:16 GMT

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
170 B 156ms
94ms Image
image/gif 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001732521198-UPABSCL4-DAUN&halo_id=060ixe9ju6a65dg9iefi9ld8dfc9glgge7huom6wi0e0ykq6umou60k4koi6q0qqm
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cf-ray: 8e80106f5bd233f5-YUL
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: image/gif
server: cloudflare

GET
H2 200 ip_match
ids4.ad.gt/api/v1/ 0
193 B 331ms
92ms Image
text/html 35.81.219.226
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids4.ad.gt/api/v1/ip_match?id=AU1D-0100-001732521198-UPABSCL4-DAUN
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.81.219.226 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-81-219-226.us-west-2.compute.amazonaws.com
Software: nginx/1.27.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-length: 0
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: text/html; charset=utf-8
server: nginx/1.27.1

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001732521198-UPABSCL4-DAUN&adnxs_id=$UID&gdpr=0
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fmatch%3Fid%3DAU1D-0100-001732521198-UPABSCL4-DAUN%26adnxs_id%3D%24UID%26gdpr%3D0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001732521198-UPABSCL4-DAUN&adnxs_id=3248038131172656463&gdpr=0

43 B
95 B

95ms
94ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001732521198-UPABSCL4-DAUN&adnxs_id=3248038131172656463&gdpr=0
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cf-ray: 8e80106fdbf833f5-YUL
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001732521198-UPABSCL4-DAUN&adnxs_id=3248038131172656463&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 167.114.209.103; 167.114.209.103; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: a3cf31c5-c0a4-4ed5-bf3e-88bc82a37f31
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

openx
ids.ad.gt/api/v1/
Redirect Chain

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001732521198-UPABSCL4-DAUN%26auid%3DAU...
https://u.openx.net/w/1.0/cm?cc=1&id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001732521198-UPABSCL4-DAUN%26auid...
https://ids.ad.gt/api/v1/openx?openx_id=598f9492-e17e-481e-9400-ae635b82dd46&id=AU1D-0100-001732521198-UPABSCL4-DAUN&auid=AU1D-0100-001732521198-UPABSCL4-DAUN

43 B
94 B

95ms
93ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/openx?openx_id=598f9492-e17e-481e-9400-ae635b82dd46&id=AU1D-0100-001732521198-UPABSCL4-DAUN&auid=AU1D-0100-001732521198-UPABSCL4-DAUN
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cf-ray: 8e80106fbbee33f5-YUL
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: image/gif
server: cloudflare

Redirect headers

location: https://ids.ad.gt/api/v1/openx?openx_id=598f9492-e17e-481e-9400-ae635b82dd46&id=AU1D-0100-001732521198-UPABSCL4-DAUN&auid=AU1D-0100-001732521198-UPABSCL4-DAUN
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: image/gif
vary: Accept, Accept-Encoding
server: OXGW/0.0.0

GET
H2

200

pbm_match
ids.ad.gt/api/v1/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001732521198-UPABSCL4-DAUN
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001732521198-UPABSCL4-DAUN
https://ids.ad.gt/api/v1/pbm_match?pbm=7B9D21CE-6374-4E40-BAC4-EDE54204A2D4&id=AU1D-0100-001732521198-UPABSCL4-DAUN

43 B
95 B

94ms
94ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/pbm_match?pbm=7B9D21CE-6374-4E40-BAC4-EDE54204A2D4&id=AU1D-0100-001732521198-UPABSCL4-DAUN
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cf-ray: 8e8010703c1833f5-YUL
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/pbm_match?pbm=7B9D21CE-6374-4E40-BAC4-EDE54204A2D4&id=AU1D-0100-001732521198-UPABSCL4-DAUN
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 25 Nov 2024 07:53:18 GMT
server: nginx

GET
H/1.1 204
No Content token
token.rubiconproject.com/ 0
1 KB 186ms
32ms Image
text/plain 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001732521198-UPABSCL4-DAUN&gdpr=0
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: c1df09169f58a071f2a391dff1b3307b
Pragma: no-cache

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001732521198-UPABSCL4-DAUN&gdpr=0
https://match.adsrvr.org/track/cmb/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001732521198-UPABSCL4-DAUN&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=20fe83ce-9e2a-40f5-8b28-9316079689d8&id=AU1D-0100-001732521198-UPABSCL4-DAUN

43 B
95 B

95ms
94ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=20fe83ce-9e2a-40f5-8b28-9316079689d8&id=AU1D-0100-001732521198-UPABSCL4-DAUN
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cf-ray: 8e8010703c1a33f5-YUL
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: image/gif
server: cloudflare

Redirect headers

location: https://ids.ad.gt/api/v1/t_match?tdid=20fe83ce-9e2a-40f5-8b28-9316079689d8&id=AU1D-0100-001732521198-UPABSCL4-DAUN
content-length: 259
date: Mon, 25 Nov 2024 07:53:18 GMT
server: Kestrel

GET
H2

200

tapad_match
ids.ad.gt/api/v1/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001732521198-UPABSCL4-DAUN&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001732521198...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001732521198-UPABSCL4-DAUN&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001732...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=c71235e1-47ee-4579-a4bc-a625aaea868a%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=20fe83ce-9e2a-40f5-8b28-9316079689d8&ttd_puid=c71235e1-47ee-4579-a4bc-a625aaea868a%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001732521198-UPABSCL4-DAUN&tapad_id=c71235e1-47ee-4579-a4bc-a625aaea868a

43 B
95 B

98ms
96ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001732521198-UPABSCL4-DAUN&tapad_id=c71235e1-47ee-4579-a4bc-a625aaea868a
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cf-ray: 8e801070ec6c33f5-YUL
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: image/gif
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001732521198-UPABSCL4-DAUN&tapad_id=c71235e1-47ee-4579-a4bc-a625aaea868a
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Mon, 25 Nov 2024 07:53:18 GMT
server: Jetty(11.0.13)

GET
H2 200 pixel
cm.g.doubleclick.net/ 170 B
409 B 136ms
39ms Image
image/png 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001732521198-UPABSCL4-DAUN

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

amo_match
ids.ad.gt/api/v1/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Famo_match%3Fturn_id%3D%24!%7BTURN_UUID%7D%26id%3DAU1D-0100-001732521198-UPABSCL4-DAUN
https://ids.ad.gt/api/v1/amo_match?turn_id=2807572217573817762&id=AU1D-0100-001732521198-UPABSCL4-DAUN

43 B
95 B

97ms
97ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/amo_match?turn_id=2807572217573817762&id=AU1D-0100-001732521198-UPABSCL4-DAUN
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cf-ray: 8e8010713c9333f5-YUL
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ids.ad.gt/api/v1/amo_match?turn_id=2807572217573817762&id=AU1D-0100-001732521198-UPABSCL4-DAUN
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Mon, 25 Nov 2024 07:53:15 GMT

GET
H2

200

son_match
ids.ad.gt/api/v1/
Redirect Chain

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001732521198-UPABSCL4-DAUN&uid=[UID]&gdpr=0
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001732521198-UPABSCL4-DAUN&uid=31226daa-0c5f-4e81-b7a2-63101a171f28&gdpr=0

43 B
95 B

102ms
101ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001732521198-UPABSCL4-DAUN&uid=31226daa-0c5f-4e81-b7a2-63101a171f28&gdpr=0
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cf-ray: 8e801070ec6d33f5-YUL
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, private
location: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001732521198-UPABSCL4-DAUN&uid=31226daa-0c5f-4e81-b7a2-63101a171f28&gdpr=0
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Mon, 25 Nov 2024 07:53:18 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-6-135
x-xss-protection: 0

GET
H2

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001732521198-UPABSCL4-DAUN
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTczMjUyMTE5OC1VUEFCU0NMNC1EQVVO

170 B
232 B

41ms
40ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTczMjUyMTE5OC1VUEFCU0NMNC1EQVVO

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-ray: 8e80106fec0033f5-YUL
location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTczMjUyMTE5OC1VUEFCU0NMNC1EQVVO
cf-cache-status: DYNAMIC
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: text/html; charset=utf-8
server: cloudflare

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 177 B
442 B 491ms
430ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 4bacb894ffaca1f46145cb872ef65ee9b8a18341c296c4c1c3f6609266891e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.wintersexpress.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 177
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/json
x-cloud-trace-context: c3f407e7266aa8249c9911be91a1d03b
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2 200 featured_Robin_Flyer_11_1.webp
cdn.prod.discovery.evvnt.com/uploads/event_image/2563157/event_image/ 11 KB
12 KB 353ms
34ms Image
image/webp 2600:9000:2305:a800:8:4487:bd00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.discovery.evvnt.com/uploads/event_image/2563157/event_image/featured_Robin_Flyer_11_1.webp
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2305:a800:8:4487:bd00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1ec96c782faf1fd9712c5948e37b0b34a82b3771a2272c6e95ac24b90935578f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: max-age=315576000
x-amz-version-id: fy9BjkIWHf87on7b9FH7pMjhcaz17n75
etag: "fb8cfd40cdae8d56523517443f7f5343"
age: 278740
via: 1.1 5840e9664aef77d9be1f708259e60d56.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 11570
x-amz-cf-id: QeXqRpcfnb0j63hDiBzDKl5MYoNG0wuKd7jFPhjs2xZVL8Fxn4tyBg==
date: Fri, 22 Nov 2024 02:27:38 GMT
content-type: image/webp
last-modified: Thu, 14 Nov 2024 18:02:04 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-P2
x-amz-server-side-encryption: AES256

GET
H2 200 featured_Robin_Flyer_11_1.webp
cdn.prod.discovery.evvnt.com/uploads/event_image/2563146/event_image/ 11 KB
12 KB 319ms
35ms Image
image/webp 2600:9000:2305:a800:8:4487:bd00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.discovery.evvnt.com/uploads/event_image/2563146/event_image/featured_Robin_Flyer_11_1.webp
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2305:a800:8:4487:bd00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1ec96c782faf1fd9712c5948e37b0b34a82b3771a2272c6e95ac24b90935578f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: max-age=315576000
x-amz-version-id: dauxEeuF6rac_pFAvt4EsiAyakFxVWSx
etag: "fb8cfd40cdae8d56523517443f7f5343"
age: 74314
via: 1.1 5840e9664aef77d9be1f708259e60d56.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 11570
x-amz-cf-id: 64kgPTBqi3Nz6fJx2rcEiD2RfO6QF8YXzPGiFQyxaAsO3yVTJSbMUg==
date: Sun, 24 Nov 2024 11:14:45 GMT
content-type: image/webp
last-modified: Thu, 14 Nov 2024 17:57:59 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-P2
x-amz-server-side-encryption: AES256

GET
H2 200 Default_-__300_x_250_px_.webp
cdn.prod.promo.evvnt.com/uploads/promotional_asset/image/ 289 KB
290 KB 293ms
37ms Image
image/webp 2600:9000:2305:a600:8:4487:bd00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.promo.evvnt.com/uploads/promotional_asset/image/Default_-__300_x_250_px_.webp
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2305:a600:8:4487:bd00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ec6e69b151d4572666e72a5325d27be9590d9b2ddeca17bf3a197ad496af008d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

vary: accept-encoding
x-amz-version-id: hxc5Tf8ux6.D8uyXmLQucj4qxYxLp86Q
etag: "90f2f3f605b06cf042a05d9ff1e6aa28"
age: 9610
via: 1.1 e880df37740c4e68e519f8478d14cb88.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 295790
x-amz-cf-id: 3IrAiRx1ipZCbsAVT5WhUYgIPMky4TD3dz1QY-lzMXQPVjEQXOtMqw==
date: Mon, 25 Nov 2024 05:13:09 GMT
content-type: image/webp
last-modified: Mon, 16 Sep 2024 10:59:15 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-P2
x-amz-server-side-encryption: AES256

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 297 KB
102 KB 52ms
52ms Script
application/javascript 142.250.31.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-12M2XZC8V4&l=dataLayer&cx=c&gtm=45He4bk0v857454493za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PDMH9T6&gtm_auth=QzlUjhMy0COR5MgCC_1Cyw&gtm_preview=env-1&gtm_cookies_win=x

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

8df5c96e35652aabff552b369a84a4284a28eb19a9419de62d103801b35b21a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Mon, 25 Nov 2024 07:53:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 104099
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 tsub-middleware.bundle.c0f5511a001f780f591f.js Show response
cdn.segment.com/analytics-next/bundles/ 18 KB
6 KB 32ms
32ms Script
application/javascript 99.86.191.237
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/tsub-middleware.bundle.c0f5511a001f780f591f.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.191.237 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-191-237.iad79.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 557c67c76c13a84e8b483ee1a0dfdd807399d960909266e7c6a83ddfadca9c81

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

access-control-max-age: 3000
content-encoding: br
etag: W/"f7b3d2021df83853b191aefa39a74b15"
x-amz-version-id: EQDrSFOFyelI4PsWTOH4DKByMTXk3P9P
age: 10441848
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: OHduJU6Vv5OMCNDGtr3xnqroinyqgjsu_FPAB3yXoneYc5iCpB0W9A==
date: Sat, 27 Jul 2024 11:22:31 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 26 Jul 2024 21:05:36 GMT
x-amz-replication-status: COMPLETED
cache-control: public,max-age=31536000,immutable
via: 1.1 9edb8d9b9614520133cf2257f302ebaa.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: IAD79-C3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 270 KB
95 KB 42ms
41ms Script
application/javascript 142.250.31.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer

Requested by

Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/664

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

af911cd0b69092767985f5342a6b3c6971ea52df38adcb35e8bb30430dfc0f9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Mon, 25 Nov 2024 07:53:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 96981
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
121 B 99ms
99ms XHR
text/plain 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/664
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: text/plain
Referer: https://www.wintersexpress.com/

Response headers

cf-ray: 8e80106fbb78a2b0-YUL
access-control-allow-origin: https://www.wintersexpress.com
cf-cache-status: DYNAMIC
date: Mon, 25 Nov 2024 07:53:18 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
88 B 317ms
98ms Script
text/plain 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=1dc3548de933eed108ac3b9d68beb447&url=https%3A%2F%2Fwww.wintersexpress.com%2F&code=%27none%27
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/664
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cf-ray: 8e801071dd05a2ac-YUL
cf-cache-status: DYNAMIC
date: Mon, 25 Nov 2024 07:53:18 GMT
server: cloudflare

POST
H2 200 match Show response
seg.ad.gt/api/v2/ 4 KB
377 B 103ms
102ms XHR
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/664
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d655a64bb99a6e14f79f3fdd9ba33433979e90070b5393fa0f5028966da4d5b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.wintersexpress.com/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
cf-ray: 8e801070eb7a33f1-YUL
access-control-allow-origin: *
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/json
vary: origin, access-control-request-method, access-control-request-headers, accept-encoding
server: cloudflare

OPTIONS
H2 200 match
seg.ad.gt/api/v2/ Frame 0
0 190ms
91ms Preflight 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.wintersexpress.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
allow: POST
cf-cache-status: DYNAMIC
cf-ray: 8e8010705af233f1-YUL
date: Mon, 25 Nov 2024 07:53:18 GMT
server: cloudflare
vary: origin, access-control-request-method, access-control-request-headers

GET
H2 200 ajs-destination.bundle.ed53a26b6edc80c65d73.js Show response
cdn.segment.com/analytics-next/bundles/ 9 KB
3 KB 31ms
30ms Script
application/javascript 99.86.191.237
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/ajs-destination.bundle.ed53a26b6edc80c65d73.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.191.237 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-191-237.iad79.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 129151ed0140041b198ce3b364a11861a3b5baa5bb60475ebf7bedb9b0fc94d6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

access-control-max-age: 3000
content-encoding: br
etag: W/"00e9c65cbba11c07c4bf4a6e2727b8ea"
x-amz-version-id: 1lCjHefPzcRt0EbQDFkkb.6FnzhNuKxa
age: 19327672
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: rntyL5Oe0AEcsGe3UTlkW97Eg6b-d1V5BAV3yDk38am9UP7F97GE_A==
date: Mon, 15 Apr 2024 15:05:27 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 12 Apr 2024 21:39:45 GMT
x-amz-replication-status: COMPLETED
cache-control: public,max-age=31536000,immutable
via: 1.1 9edb8d9b9614520133cf2257f302ebaa.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: IAD79-C3
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 120ms
41ms Fetch
text/plain 2607:f8b0:4004:c1f::66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-12M2XZC8V4&gtm=45je4bk0v873737409z8857454493za200zb857454493&_p=1732521196640&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&tag_exp=101925629~102067555~102067808~102077855~102081485&cid=1130602829.1732521198&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1732521198&sct=1&seg=0&dl=https%3A%2F%2Fwww.wintersexpress.com%2F&dt=wintersexpress.com%20%7C%20Winters%20Express&en=page_view&_fv=1&_ss=1&tfd=1980
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-12M2XZC8V4&l=dataLayer&cx=c&gtm=45He4bk0v857454493za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1f::66 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.wintersexpress.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: text/plain
server: Golfe2

GET bounce
id5-sync.com/ 0
0

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
294 B 388ms
114ms Fetch
application/json 162.19.138.117
OVH OVH SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

429c09ef872b45d80fa51a8ed156e581ed31fd094c179e4d6dd1d3f1bf18f20b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.wintersexpress.com
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 schemaFilter.bundle.5c2661f67b4b71a6d9bd.js Show response
cdn.segment.com/analytics-next/bundles/ 2 KB
1 KB 31ms
31ms Script
application/javascript 99.86.191.237
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/schemaFilter.bundle.5c2661f67b4b71a6d9bd.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.191.237 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-191-237.iad79.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31892c21ae4fb908a875bbe29dbf0df74c2e84171cfbcac23540f3ad8222a35a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

access-control-max-age: 3000
content-encoding: br
etag: W/"3867b2388b619ff7fddc29ef359fc9aa"
x-amz-version-id: 6p7m0DymtVd2iHKfdr7k4GM1yYafy1xS
age: 19617035
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: 0v6V6e8_gNWJE25c5hnIrSiEX4zDPiK2mNHjk825vju1jT7-5IvZiw==
date: Fri, 12 Apr 2024 06:42:44 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 12 Apr 2024 03:48:56 GMT
x-amz-replication-status: COMPLETED
cache-control: public,max-age=31536000,immutable
via: 1.1 9edb8d9b9614520133cf2257f302ebaa.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: IAD79-C3
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 200 p Show response
api.segment.io/v1/ 21 B
179 B 321ms
96ms Fetch
application/json 35.163.144.222
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.segment.io/v1/p

Requested by

Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/analytics.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.163.144.222 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-163-144-222.us-west-2.compute.amazonaws.com

Software

Resource Hash

12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.wintersexpress.com/

Response headers

strict-transport-security: max-age=31536000
access-control-allow-origin: https://www.wintersexpress.com
content-length: 21
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/json
vary: Origin

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame F1FE 0
0 45ms
43ms Fetch
image/gif 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssw94Xixmgq22mLGrP77nm_No5mn9nBx7Sp9aZp3L4vdkLCnNQj4NMvQS9FLbbrdI6LYeQ1RfMI8D3TOmDohEiVrVS0Tlp4-jDW3FDsx_wKDUJTxFSGH4WPae8zpEUP5EMp1l_Sy_QXYRTnvWmp8QhzV6_bXTbq_latabcjOndpUVk7tAwMHJPwbkBkA4FpoFAT2AbCx4JpNjxaAPyaEcXexYwaJgvg8Yn4eBwnks-GgDEYjGd1YfT9lQxREnHG9fqjdwQkkh1zZ_h4zAm57fB0SNCdgriZRZkCdCrl3tEH4idfHbipM4kSd2HW6u6HYfKokDTp1SMw1i91gdn2i1QRtNinTdk67f3sx37KEekz6TgVAmWDNSEANC32nTQbmEyYg3Ujfm-UwXxUAyjVJDcSQj8Pkzy5bQ6IElpIl1FkU4cOAYAG&sai=AMfl-YQ1aHShv4-tHRwk-njnM2dw9cbQZuMetowMda7_izcW2rl7oy_qHnPgHUR4kn9MTMVM2W1P_9W437eiQZ6VWCz65jxHSVFfCiisLatlPbxF86Q_gBfIGEsOC8KMGlwciyg2cedURHUmZjaZvgKW&sig=Cg0ArKJSzLC-KH2z1s72EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 07:53:18 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 reveal.e5d561a6b71aa2730a07fa90f5f4f6d6.js Show response
bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/ads/resources/scripts/templates/ Frame F1FE 8 KB
3 KB 36ms
34ms Script
application/x-javascript 104.16.132.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/ads/resources/scripts/templates/reveal.e5d561a6b71aa2730a07fa90f5f4f6d6.js

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.132.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d036d654e0622364d1afd83a7d7f4badf6c0efd242e3bd1476b225f1d4971581

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-robots-tag: noarchive
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6734b378-1e66"
age: 48268
expires: Thu, 20 Nov 2025 20:33:41 GMT
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/x-javascript
last-modified: Wed, 13 Nov 2024 14:11:04 GMT
vary: Accept-Encoding
x-vcache: MISS
strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 8e801070eecaabb8-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2641
server: cloudflare

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame F1FE 217 KB
67 KB 200ms
34ms Script
text/javascript 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

8d2678ff0715284456a48f52fa21c43a417bea04bcb4b6fcd516ab11dc047192

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: br
etag: 12158714353530318320
age: 392
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 08:46:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 25 Nov 2024 07:46:46 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69014
x-xss-protection: 0
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 5124 0
0 46ms
45ms Fetch
image/gif 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsul3BQlTVHvDvYV6_MT-TLg7eOK4MI5t9j00jQ-0RXft5oUR-yLXDT4m9Ilfv_VXAovZwR4anJ2JbCN8PEy62UY4KLCm-w5oBVqUhWcWqABlIKQ54HJLUpCDyty1WM6_SbFZv5PPP6x-AWFkC-bDIRK_h__me1KmTGXPb189f3LfmgxYLBPjiNDF_0xHfDI1pLa_DIfctgXGwV345I1qqEE6OIU8HnutNJyTxun6zrKYqkW0j23bJ0VSDnxOVDryJnVi1veI9wBLDst4GrL4112wZjhHhHRha2LMFi9NQeyR3t6j4LajpKBfy1VVNxnNev4orZmSJ6AVzdK7Boaxf7QErD0uCBgQp7mR_v8T4CQTJCqsM0pwivUhB15apubVVZjOjJ7Km6DsaDdiIPxIKSgACRdRf7gIJt_funlqwDWdA&sai=AMfl-YQAhJaNYRZhFDyFD5qbZ1NSnyr2NbHpcNZLzWxcji8BaXHwwea1zQc1OujDERu8qM7cOyZGoKRA05rQHtwsLi2acmgw6NwU9PH957TirvqaDntbzl-qS87KbCh8vIqPPTIe3xaA3gGMHQCEfIR6&sig=Cg0ArKJSzPwA2OijCvjjEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 07:53:18 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 infolinks_main.js Show response
resources.infolinks.com/js/ 4 KB
3 KB 184ms
40ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/infolinks_main.js
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2aaaf8171a701189f4fd0e480156dec1d2c5856cf81f3d24756faf431f061a1f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"110d-62766e98f2ae0"
age: 2736
via: 1.1 google
cf-ray: 8e801071fa19a1e4-YYZ
expires: Mon, 25 Nov 2024 08:07:42 GMT
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/javascript
last-modified: Thu, 21 Nov 2024 07:06:58 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 5124 217 KB
0 177ms
177ms Script
text/javascript 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

8d2678ff0715284456a48f52fa21c43a417bea04bcb4b6fcd516ab11dc047192

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: br
etag: 12158714353530318320
age: 392
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 08:46:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 25 Nov 2024 07:46:46 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69014
x-xss-protection: 0
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 77A7 0
0 45ms
44ms Fetch
image/gif 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstQuX3oujy6xSYZPCcJeLvisml7AZxpXVGyJQd1QYxzJTitvzaTH0VRHbTbvALswRwnQhsLYHS6dBvq-Z_JnlZ_Rx5FDVqHI2fscx1E15lCliG1gmxNqTEUi5uXkkvcbIhv0ztBTFurNk1GGN2cyDUVJstRhLxTI2k8letXWgkf-UbvDT2iIeYNbmWCKVRy8OjIjmTz4HdxpALBEl7ZbMpgr5SWJl3HEPZ7QadZ1YdcQtLCBWKHGcaAR0So-wKBSntzr9L-X9pX5bLXATis8izPRdvhwE7SfdEYIgIaQDwduPnEzSvknXrKbWz9dC0dnsH2sIHgJcHT1JLUZ3xfitAgwH0Ig6ApCRcHMjct8M4gAPHHgegD5t9auXJoH2GoRmF2WsevfrmZ0EGxyafhH5-rQKP6t7xA7fxawjp65VJdvRBomfxbV6xg6IKB1E_tLCC-v4pv6mLN&sai=AMfl-YSELuxdOrInzoPtr1bBDIHg9t45fapfFJYVAEdDXmiTTbTOsSsJ2Y9XBXG7Mus_bFCojYYd-YSDXdAD1wzFjyQLWkbfNoAtQ7omGHkBRrDCvu-17-E67Re3bpjjhnKDtMm-SOmALeSquACm4uk1&sig=Cg0ArKJSzIcPNzTDcdNUEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 07:53:18 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20241120/r20110914/client/ Frame 77A7 3 KB
1 KB 158ms
32ms Script
text/javascript 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20241120/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

944a37f694b55de268a0bf52dbae4e12f12c4ae09ee5c8d213ba05075c2865dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: br
etag: 6567774568227038691
age: 57403
x-content-type-options: nosniff
expires: Sun, 08 Dec 2024 15:56:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 24 Nov 2024 15:56:35 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1234
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 77A7 217 KB
0 166ms
166ms Script
text/javascript 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

8d2678ff0715284456a48f52fa21c43a417bea04bcb4b6fcd516ab11dc047192

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: br
etag: 12158714353530318320
age: 392
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 08:46:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 25 Nov 2024 07:46:46 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69014
x-xss-protection: 0
server: cafe

GET
H2 200 8031523852662354230
tpc.googlesyndication.com/simgad/ Frame 77A7 100 KB
100 KB 194ms
70ms Image
image/jpeg 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8031523852662354230

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9a805141d588150c5edf51153e94504ea61a2db7d47920ea89b9c310cddae0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

age: 22267
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Tue, 25 Nov 2025 01:42:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Mon, 25 Nov 2024 01:42:11 GMT
last-modified: Mon, 28 Oct 2024 18:57:11 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 102278
x-xss-protection: 0
server: sffe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame CDD2 0
0 44ms
44ms Fetch
image/gif 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssO4C1VYwYCYcId80eArd8dFPK9uFq7uKOeDVXJ2pZ9fN3PnPzK4DAhGRWlPDnV2nZWazF_Kmj_8f-hrA8YbZAiuoIMSBzypGeQ9YZQW2yBy2kKZQTsBWN6U5tIvlJt9SxlStsU2UHx-lqXEuOitJl-SXXMNfxp1bGeKCIx5hjOb5JcAQf9tM9S3cxnjUU4ulktRS7SPvRVWdLz4SW3yLNPxLxW6xlI4zstSRi6rnGEJsieQwKj_PFgsi6doXLzgN_AHB3_Kb380uNv_DwYJcGUgd_o62lUVIiggXQv-V1pAP5DU_airdNQP69kT7cIYxusvWUe0BiJZjiyAIese4UCdtXFkTlVpTbVpt997JlawoiTfpD_W1L6ROzkV4JpwFyav0tESGJXbgjl68vyq69u_qXFX4rBNjER6QMydrQKY_pMsq-ffrnKmAlXSqp0K-3jsCWymx8M&sai=AMfl-YReg1hpze7LNcH_CGHD_4n9Ho78OoyTwOW1Jl9C3RGy_vo0-bbrjskRq3YdLJA5C0xnTrvs0NEQMpbiHBV_i51aL-3qBKgIw4PX-OAhTRJBTVAqDADRICKbsyb6hFFmIJ6G5Nc_acM_QMQKlFgQ&sig=Cg0ArKJSzEM9ej24OtOSEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20241120/r20110914/client/ Frame CDD2 3 KB
0 145ms
145ms Script
text/javascript 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20241120/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

944a37f694b55de268a0bf52dbae4e12f12c4ae09ee5c8d213ba05075c2865dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: br
etag: 6567774568227038691
age: 57403
x-content-type-options: nosniff
expires: Sun, 08 Dec 2024 15:56:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 24 Nov 2024 15:56:35 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1234
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame CDD2 217 KB
0 156ms
156ms Script
text/javascript 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

8d2678ff0715284456a48f52fa21c43a417bea04bcb4b6fcd516ab11dc047192

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: br
etag: 12158714353530318320
age: 392
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 08:46:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 25 Nov 2024 07:46:46 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69014
x-xss-protection: 0
server: cafe

GET
H2 200 12438626820812998814
tpc.googlesyndication.com/simgad/ Frame CDD2 121 KB
121 KB 146ms
35ms Image
image/jpeg 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12438626820812998814

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5399dd664069ceeea8667991398b745cf5eddf8ac2f8bfb638d70dfc13d9dd07

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

age: 34119
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Mon, 24 Nov 2025 22:24:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Sun, 24 Nov 2024 22:24:39 GMT
last-modified: Mon, 28 Oct 2024 19:02:26 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 123470
x-xss-protection: 0
server: sffe

GET
DATA 200
OK truncated
/ Frame 77A7 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cfef577828ce1c4938cba233349fdb3cd5fcaac42bc919ccc976f892a19018df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame CDD2 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 514e5a7257d3f4823ba63d457f53ba3659e7fdb2f18d99da9daf0a615bda8440

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 200 animate.min.css
cdnjs.cloudflare.com/ajax/libs/animate.css/3.5.2/ 52 KB
4 KB 114ms
33ms Stylesheet
text/css 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/animate.css/3.5.2/animate.min.css

Requested by

Host: bloximages.chicago2.vip.townnews.com
URL: https://bloximages.chicago2.vip.townnews.com/wintersexpress.com/shared-content/art/tncms/templates/libraries/flex/components/ads/resources/scripts/templates/reveal.e5d561a6b71aa2730a07fa90f5f4f6d6.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5eb03d2a-ce35"
age: 464306
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HskPfcEVAEVmVDTacn7FshmKS6tY78xG5RHUQ%2BshvpP9WeFHL4N6fD9pQgBEnm0AjvcFewqCQVx%2FzXoyHkq%2BUozmqw%2BHajlju4hQPYZu4B8oNgQiYFbHAuOJl5AqvcZn10DJyUKa"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sat, 15 Nov 2025 07:53:18 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 04 May 2020 16:04:58 GMT
vary: Accept-Encoding
priority: u=0,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8e801071fd41ac09-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3279
server: cloudflare

GET
H2

200

10093456834737784039
tpc.googlesyndication.com/simgad/
Redirect Chain

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgODnm4DkywEQARgBMghtplB7comKlA
https://tpc.googlesyndication.com/simgad/10093456834737784039

504 KB
505 KB

106ms
102ms

Image
image/jpeg

2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10093456834737784039

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5973328c7a47736227218616372ba3ac2284bc56aeb4a5d96be40a627a2f695c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

age: 161517
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Sun, 23 Nov 2025 11:01:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Sat, 23 Nov 2024 11:01:21 GMT
last-modified: Fri, 20 Sep 2024 18:41:28 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 516212
x-xss-protection: 0
server: sffe

Redirect headers

cache-control: public, max-age=2592000
location: https://tpc.googlesyndication.com/simgad/10093456834737784039
timing-allow-origin: *
age: 69558
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Tue, 24 Dec 2024 12:34:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
x-xss-protection: 0
date: Sun, 24 Nov 2024 12:34:00 GMT
content-type: text/html; charset=UTF-8
server: cafe

GET
H2

200

11758019229478185904
tpc.googlesyndication.com/simgad/
Redirect Chain

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgODn69_ZLxABGAEyCGEAWlolSaX7
https://tpc.googlesyndication.com/simgad/11758019229478185904

210 KB
210 KB

137ms
136ms

Image
image/jpeg

2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11758019229478185904

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a640e9eca4059f8a87f5815bce61c6799babfc358762166e398eb599a96959f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

age: 161517
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Sun, 23 Nov 2025 11:01:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Sat, 23 Nov 2024 11:01:21 GMT
last-modified: Fri, 20 Sep 2024 18:41:32 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 214697
x-xss-protection: 0
server: sffe

Redirect headers

cache-control: public, max-age=2592000
location: https://tpc.googlesyndication.com/simgad/11758019229478185904
timing-allow-origin: *
age: 69558
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Tue, 24 Dec 2024 12:34:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
x-xss-protection: 0
date: Sun, 24 Nov 2024 12:34:00 GMT
content-type: text/html; charset=UTF-8
server: cafe

GET
H2 200 join-ad-interest-groups.html
proton.ad.gt/ Frame B046 0
0 67ms
27ms Document
text/html 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://proton.ad.gt/join-ad-interest-groups.html
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/664
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://www.wintersexpress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
ad-auction-allowed: true
age: 1449
apigw-requestid: Byp4Uiw4vHcESVg=
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 8e8010720fc0a31a-YUL
content-encoding: br
content-type: text/html
date: Mon, 25 Nov 2024 07:53:18 GMT
last-modified: Mon, 25 Nov 2024 07:12:40 GMT
server: cloudflare
supports-loading-mode: fenced-frame
vary: Accept-Encoding

GET
H2 200 ice.js Show response
resources.infolinks.com/js/1970.003-4.011/ 194 KB
59 KB 40ms
39ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1970.003-4.011/ice.js
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fdfa5618d1b43e123fa394f1f52a20379ff4eabca85c9db42852842ae869fff5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: max-age=2592000
content-encoding: br
cf-cache-status: HIT
etag: W/"30795-6272c7fe560af"
age: 7523
via: 1.1 google
cf-ray: 8e8010724a35a1e4-YYZ
expires: Wed, 25 Dec 2024 05:47:55 GMT
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/javascript
last-modified: Mon, 18 Nov 2024 09:25:38 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 204 event Show response
p.ad.gt/api/v1/ 0
34 B 130ms
130ms XHR
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/664
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.wintersexpress.com/

Response headers

cf-ray: 8e8010733c02a2b7-YUL
access-control-allow-origin: https://www.wintersexpress.com
cf-cache-status: DYNAMIC
date: Mon, 25 Nov 2024 07:53:18 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 139ms
101ms Preflight
text/html 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.wintersexpress.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://www.wintersexpress.com
allow: OPTIONS, POST
cf-cache-status: DYNAMIC
cf-ray: 8e8010728bc4a2b7-YUL
content-encoding: br
content-type: text/html; charset=utf-8
date: Mon, 25 Nov 2024 07:53:18 GMT
server: cloudflare
vary: Origin

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CDD2 0
0 43ms
41ms Fetch
image/gif 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame CDD2 0
0 45ms
44ms Fetch
image/gif 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss7UKnh56ddEJwO7Q1np9cXsBU_5ccIXcwlMhdFZPn1VaZKazkevV_W9MVagT8isgz8_WeRc1mB35HflM9TEPPVi0Z1BAkK0nMKuGM_Wlqp6fff88eWynxZdtnwcIhnDBAF1ZD83zclp9WvwATFv3Vv_uubrb9FVyjtEudpTu9ZTXS0tse3X1zvHTlvobH0YtCGKZ9ohdcgUY1HI-joGb80zYA0HvyZcD0ba8qHI1hVU6QH6FAOL9sMIMl_PM0vOQeOd7dIFhKvE0HsCfusIj3FRqoUgQp4YEYOsCbpdp94QbxmuadlsctF8xEIPClsLj90Dc6KNsCoDCQLZEaIhb8GyqPP2pxr-qwjXWy8Xo2Jr9E9R7PTSBxSVLt5h4u7XMS0lKlwOD90mcpGcfg9S2AAirAGy5pNujq08fVvoejs6xWz6DynK216Cc_7nmV6a0-bDM8bbTUyhkc&sai=AMfl-YS6dNar1wXenwkF9jjnypm82Bgo5E-uRd3FbWn67uEU8A6cA9-0ogBCOwXvmuIUwDzM9O5ncvWGscQwLqA8guOXOET_jblncczlSAxUiBfFloKcETfLbHeMUmoe1qo9HC7fEal3VKS1A_EsGe0Q&sig=Cg0ArKJSzKSrFO3RLUGYEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 07:53:18 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F1FE 0
0 43ms
40ms Fetch
image/gif 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame F1FE 0
0 42ms
42ms Fetch
image/gif 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvfTvvGx3vzd2fdrMAy5mLE404pJJM-eIIunS2_Klqk9XU_dn8ZnzM7fP-4Upm14IDDw1l33ZP1ylVog6k8IZzEPCScagi4HsSHzAKdKsS_FVMncRIQCnZeqmf3WV75mJUU9GjnDmsDMMfi_mZBi8wAIkFlPNN9HtPAfmkJiBmfpJoyb1RYqwa4VkJuRV30ukUnl1tMDiLzHczLXrvIfyCs2HgD4z-XeQXuL4bDt9N2iUXCOVRb7eVsGLm7XGikHhgbm5XelrD0chwn8429IjgDDwaoC92Q-yc4vfsEu6AiL2abt5IhV9f8ftdoyMgSy9guI4H-P7QTQZEqJhQRlLDMHtWNgUGqVTtpEX2ei-30Ty_QYi4lrJdOEnR_SIi0bir49t7P6WwSHmYh3gDBSRbLIXzVvV5ECEi166bYFKGuIAUSf2sTnlk&sai=AMfl-YS6TYR4RCBjfAnxoI4cxI_X9rMzhTnf5Kx3dZsp2CbozDG-iozLb1Wo9TRMIA8fjPCVFrSHyZUKbYJTIJfCSbqwfxmBlfTR8JC6_l5pXTPZZP5HCsJpKb6sd8M450KhVeSg9k4NjL6jyIfiyFqX&sig=Cg0ArKJSzNoi1QyTCpJ1EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 07:53:18 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5124 0
0 60ms
41ms Fetch
image/gif 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 5124 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 679efbb3d57180134b17a7588e21434311cd215ad954a9716216b5e26c4189cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 5124 0
0 44ms
44ms Fetch
image/gif 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst4V2rwRbktkRVzWVCxoevD1AXj2_0Ujf_GhuGydlduEltVxOPb_VKY6AmRxFdSYm6a_p6x-J5TY48OJP9zD0KT7cmoKMOpfyfvu8C-mftQuKWgU_oVate-GF15TtS5WABcqLCvxzAQGO1QaBpfMe1aJ_tEvzHpcR0znMeYZ93Ggdg4_nKIdRhzlci_b_SMUPmQUVbpD3QMulv4ZLk99HZOh_7HPmb23aoIWHab8caHfOLyy7OaDIiGDm-W39hhRJgRBfnssfilpyWXpGQFNvvP5BUbW3wgXBVQBJRPlIXscVi1vf5qwmY4tSrNIkyp2-QHPPKwXBRnhLNbB5700b_Om63dHpRZ3jt4Ayudk1pBdQxliTBjEuHvsFpGEDvq3zi4AIgG30L6xwgV9JaZC3umJTeXrd3TSl2f-JbMyLNRjFrQ&sai=AMfl-YQMJ6nBKYn2r91andgStUSRnj5a22VdeaLxHz5qA_sN1rkJMvc1GpfO_iGclNNXVIzEYeWyIBIzrlb5E5a9wMrY8WBMy_riA3dZxNja3lrXr7_b9qH2maBlFftAmyF4Z3yNJnjKyQOhWwBs4rI-&sig=Cg0ArKJSzEnZjo_JeveMEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 07:53:18 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 77A7 0
0 77ms
41ms Fetch
image/gif 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 77A7 0
0 44ms
44ms Fetch
image/gif 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstSNvChC2FPxg01usX3rlY3F2WJMpecNPhqIzgMC9xvhc5TMRpilEpmNTSXHTZs-0po0nDxkdk4LoKiDUkXoK_jVYEoVzeHfIIPcYhFTG8dTWO_npOpbdnhUSj5h2RX3Nb_45ZAuOfIT7gkw05_6GP0yxroosJasW3XKUtH5pMLTyWVIQyU-WcXC_ZN18pRd-7Pv6S363ZfYLK3kPTb2hxbeqJ3VJa2GKhL7l-YQyxju6RkJyQ21ypDjWBKsQyajEzhZ-pCVX1ObE_WuQDd1c-5ypuYexO-X2bYzN7tyDA6HUUmZMoXQ6D4OH1BGoLFYtcShjNMs9d3Zi1L1XXBPVKqeTlQOJIhizm7hFlxUU97uvMMz7PGsYoO-8x1i29a0WTKp6vIVslfCLlOK0ETlFcO0f7_b4H-efragb1sqfn7AM3kde52bl7LCzk8uzCrdajPFCI77iu9GeE&sai=AMfl-YRIzBTIkz9BpyM0JLFiKhnw60F-8Ehfw8qQWfw95kwmxpkAIsFeeJy_1m8z-GcExXucFYfLUYEQaFB4LspWP8zG38pUbrnQGL4Cg2DIkF6V_mL_oiIbW_s7ifEg07FWvknWlgnJgnFJMmGPNojk&sig=Cg0ArKJSzKGYgCURAIxeEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 07:53:18 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CDD2 0
0 41ms
41ms Fetch
image/gif 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F1FE 0
0 76ms
40ms Fetch
image/gif 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5124 0
0 113ms
40ms Fetch
image/gif 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 77A7 0
0 150ms
42ms Fetch
image/gif 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 25 Nov 2024 07:53:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 manage
router.infolinks.com/usync/ Frame AC46 0
0 134ms
60ms Document
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/manage?pid=3119781&wsid=0&pdom=www.wintersexpress.com&purl=https%3A%2F%2Fwww.wintersexpress.com%2F
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1970.003-4.011/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://www.wintersexpress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control: no-store
cf-cache-status: DYNAMIC
cf-ray: 8e8010742dab711b-YYZ
content-encoding: br
content-type: text/html;charset=UTF-8
date: Mon, 25 Nov 2024 07:53:18 GMT
p3p: CP="NON DSP NID OUR COR"
server: cloudflare
via: 1.1 google

GET
H2 200 lcmanage Show response
router.infolinks.com/usync/ 283 B
260 B 84ms
61ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/lcmanage?pid=3119781&wsid=0&pdom=www.wintersexpress.com&purl=https%3A%2F%2Fwww.wintersexpress.com%2F
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1970.003-4.011/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6af1d81975e307f4f1bf7f8e1cec7c374cb12471c871b3e5f1a868df4e6c7184

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-store
content-encoding: br
cf-cache-status: DYNAMIC
via: 1.1 google
cf-ray: 8e801073cac1a1e4-YYZ
p3p: CP="NON DSP NID OUR COR"
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/javascript;charset=ISO-8859-1
server: cloudflare

GET
H2 200 gsd Show response
router.infolinks.com/ 329 B
513 B 83ms
61ms Script
text/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/gsd?evt=afterGSD&pid=3119781&pdom=www.wintersexpress.com&purl=https%3A%2F%2Fwww.wintersexpress.com%2F&jsv=1970.003-4.011&_cb=17325211986540
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1970.003-4.011/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3de72960e19da7e5aefea643b35ec1c1bfb9770e6fefaa3e1f30c33a6d0c3685

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: max-age=0
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 8e801073cac0a1e4-YYZ
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NON DSP NID OUR COR"
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: text/javascript;charset=UTF-8
server: cloudflare

POST v3
id5-sync.com/gm/ 0
0

GET
H3 200 adback. Show response
fundingchoicesmessages.google.com/f/AGSKWxVQH61x-Do6Ie3eajrkfsEd0XEz-ghYSBNq0pTPf87vyjRTXVdG9Aw1fFCkYF-S-OWfSFnjglH_OB7H7y36xG9sm1yoDk3DdScQffu8a6-DBNLIZ3tvkZurQYka3whzFUYP935jrZidG_6RyZRc79-73asYE... 54 B
109 B 51ms
50ms Script
application/javascript 142.251.111.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVQH61x-Do6Ie3eajrkfsEd0XEz-ghYSBNq0pTPf87vyjRTXVdG9Aw1fFCkYF-S-OWfSFnjglH_OB7H7y36xG9sm1yoDk3DdScQffu8a6-DBNLIZ3tvkZurQYka3whzFUYP935jrZidG_6RyZRc79-73asYEcdVic_Hr3QYOrkIeHV7bA0xJ09QPbdV/_/adasync.-gallery_ad//ad_gif_/advs.ads./adback.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.9z5kddtKfUo.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMwlEc_sVMli9kpRqcR6cJANtpBcPQ/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f100.1e100.net

Software

ESF /

Resource Hash

e32cc4f4194010d53238f1ea3483aa3cd1b272630e87730057bc5f57389d2a53

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-xUEsAI7i2BeIjO8dhEu5Cg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmJw1pBikPj6kkkLiJ3SZ7CGAHHrzXOs04E46d951hIgNlS4xOoMxI5Fl1g9gVi15xKrORDfX3eJ9TkQzzh_mXUBEBdJXGFtAeLbTVdYHwMxw9crrBxALMTD8e7mhF1sAgfWrr3DpKSRlF8Yn5yfV1KUmVRakl-UlpyWWpxaVJZaFG9kYGRiaGhoqWdgGF9gAABWPEJR"
content-security-policy: script-src 'report-sample' 'nonce-xUEsAI7i2BeIjO8dhEu5Cg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 lidar.js Show response
pagead2.googlesyndication.com/pagead/js/ 251 KB
79 KB 33ms
33ms Script
text/javascript 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/lidar.js?fcd=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

e49c23480a4201c1ceda93745f113687ac437311eb8d8c48e46dfe50311092e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: br
etag: 15940481303248106213
age: 1307
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 08:31:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 25 Nov 2024 07:31:31 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 80845
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxXwH55TiWxn-kj1K_9q_YBjBTLt2-T-0nDRCiKw86NoUyYI2GUxnKJTSrIf1P9Wt8b9hICWIIL-OMGgc0--3mDJErEvs2TG2mPM22U1mQcPgC6b3nFAuLAU6hSLwkiRGHeSMKRo2g== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 82ms
49ms XHR
text/html 142.251.111.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXwH55TiWxn-kj1K_9q_YBjBTLt2-T-0nDRCiKw86NoUyYI2GUxnKJTSrIf1P9Wt8b9hICWIIL-OMGgc0--3mDJErEvs2TG2mPM22U1mQcPgC6b3nFAuLAU6hSLwkiRGHeSMKRo2g==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f100.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-9o7778kONe7O2bv66_if_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.wintersexpress.com/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmII1pBicEqfwRoCxAxfr7ByALEQD8e7mxN2sQlM-DT1DZOSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjE0NLTUMzCNLzAAAEFrJrk"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-9o7778kONe7O2bv66_if_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://www.wintersexpress.com
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 iqusync-1.32.min.js Show response
resources.infolinks.com/static/usync/ 2 KB
1004 B 38ms
37ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/usync/iqusync-1.32.min.js
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/lcmanage?pid=3119781&wsid=0&pdom=www.wintersexpress.com&purl=https%3A%2F%2Fwww.wintersexpress.com%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ddba0922a45957701891711e9f25d998cb23fc853271bba573dc0bc96dc64fc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: max-age=2592000
content-encoding: br
cf-cache-status: HIT
etag: W/"906-61fa30c22522c"
age: 11660
via: 1.1 google
cf-ray: 8e8010748b05a1e4-YYZ
expires: Wed, 25 Dec 2024 04:38:58 GMT
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/javascript
last-modified: Wed, 14 Aug 2024 11:30:03 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 200 doq.htm Show response
rt3060.infolinks.com/action/ 3 KB
2 KB 223ms
115ms XHR
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3060.infolinks.com/action/doq.htm?pcode=utf-8&r=17325211987881
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1970.003-4.011/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b4ae6f9c190a587611393357e1ef80131bdee6a1b62cfe786167a87f7fa38d8d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache,no-store
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 8e8010753d6dabc7-YYZ
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://www.wintersexpress.com
p3p: CP="NON DSP NID OUR COR"
date: Mon, 25 Nov 2024 07:53:19 GMT
content-type: text/html;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
server: cloudflare
content-language: en-CA

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXwH55TiWxn-kj1K_9q_YBjBTLt2-T-0nDRCiKw86NoUyYI2GUxnKJTSrIf1P9Wt8b9hICWIIL-OMGgc0--3mDJErEvs2TG2mPM22U1mQcPgC6b3nFAuLAU6hSLwkiRGHeSMKRo2g==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f100.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-xCOf87bUDl9oNYOfMmVPWQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.wintersexpress.com/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw1ZBicEqfwRoCxAxfr7ByALEQD8e7mxN2sQlcuPygnVnJJSm_MD45P68kNa9ENzGlWBfELspMKi3JL0Jhp5aBVOTkp6dn5qXHGxkYmRgaGlrqGZjGFxgAAD7HJrM"
content-security-policy: script-src 'report-sample' 'nonce-xCOf87bUDl9oNYOfMmVPWQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://www.wintersexpress.com
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXwH55TiWxn-kj1K_9q_YBjBTLt2-T-0nDRCiKw86NoUyYI2GUxnKJTSrIf1P9Wt8b9hICWIIL-OMGgc0--3mDJErEvs2TG2mPM22U1mQcPgC6b3nFAuLAU6hSLwkiRGHeSMKRo2g==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f100.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-n8Ub4FOCdefwm8Bs388e_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.wintersexpress.com/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw0gDi9BmsIUDM8PUKKwcQC_FwvLs5YRebwILjv_uZlVyS8gvjk_PzSlLzSnQTU4p1QeyizKTSkvwiFHZqGUhFTn56emZeeryRgZGJoaGhpZ6BaXyBAQA1-iaX"
content-security-policy: script-src 'report-sample' 'nonce-n8Ub4FOCdefwm8Bs388e_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://www.wintersexpress.com
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXwH55TiWxn-kj1K_9q_YBjBTLt2-T-0nDRCiKw86NoUyYI2GUxnKJTSrIf1P9Wt8b9hICWIIL-OMGgc0--3mDJErEvs2TG2mPM22U1mQcPgC6b3nFAuLAU6hSLwkiRGHeSMKRo2g==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f100.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-VxVu-T2Io2GowbAl3Giu9w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.wintersexpress.com/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmLw1JBicEqfwRoCxAxfr7ByALEQD8e7mxN2sQn8WDOzn1nJJSm_MD45P68kNa9ENzGlWBfELspMKi3JL0Jhp5aBVOTkp6dn5qXHGxkYmRgaGlrqGZjGFxgAAC7aJnk"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-VxVu-T2Io2GowbAl3Giu9w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://www.wintersexpress.com
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxUgeB17ZHMLXCpQoEbLGnLkCQg8uDrwwfjb87Q-muciWDhjVZ-hXm3pP5Uw0nJaNUJG9WpvNENHwY7P7pWYVuN2bcvT0fNekuXN-TIcZpST6sl_CdCIzo1BhvJGjemlVWRmMz_nNQ== Show response
fundingchoicesmessages.google.com/f/ 6 KB
3 KB 62ms
59ms Script
application/javascript 142.251.111.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUgeB17ZHMLXCpQoEbLGnLkCQg8uDrwwfjb87Q-muciWDhjVZ-hXm3pP5Uw0nJaNUJG9WpvNENHwY7P7pWYVuN2bcvT0fNekuXN-TIcZpST6sl_CdCIzo1BhvJGjemlVWRmMz_nNQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzMyNTIxMTk4LDgwNTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vd3d3LndpbnRlcnNleHByZXNzLmNvbS8iLG51bGwsW1s4LCI5ejVrZGR0S2ZVbyJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f100.1e100.net

Software

ESF /

Resource Hash

8e2e76a2c8f2f6f9c896fbb1ce20d97d0b72045e6ed931e7886041cad6ccc52e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-AqacBZzUV0YBff6StJCX5A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmLw1pBikPj6kkkLiJ3SZ7CGAHHrzXOs04E46d951hIgNlS4xOoMxI5Fl1g9gVi15xKrORDfX3eJ9TkQzzh_mXUBEBdJXGFtAeLbTVdYHwMxw9crrBxALMTD8e7mhF1sAhO-HJjKrKSRlF8Yn5yfV1KUmVRakl-UlpyWWpxaVJZaFG9kYGRiaGhoqWdgGF9gAABWXEI9"
content-security-policy: script-src 'report-sample' 'nonce-AqacBZzUV0YBff6StJCX5A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 iquid-01.js Show response
resources.infolinks.com/static/ 68 KB
14 KB 38ms
36ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/iquid-01.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.32.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f60c8e46ff2161132091c8bdaf0628c161918a67a1d65854c21bc6bdff7eb91

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: max-age=2592000
content-encoding: br
cf-cache-status: HIT
etag: W/"11007-613231db6db5c"
age: 2946
via: 1.1 google
cf-ray: 8e801074cb16a1e4-YYZ
expires: Wed, 25 Dec 2024 07:04:12 GMT
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/javascript
last-modified: Fri, 08 Mar 2024 09:50:03 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 ima.js Show response
cdn-ima.33across.com/ 16 KB
0 1ms
1ms Script
application/javascript 104.18.29.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ima.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.32.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.29.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ee7d90acfcf61e37a67097a1f97ddb90fd685f3e9dcb6ed34931f2b94713d8d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"671a7171-403e"
age: 207052
cf-ray: 8e80106bfc7336d3-YYZ
expires: Thu, 28 Nov 2024 07:53:17 GMT
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: application/javascript
last-modified: Thu, 24 Oct 2024 16:10:25 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 id5.js Show response
resources.infolinks.com/static/ 58 KB
17 KB 38ms
37ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/id5.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.32.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05e77dab19940dd457e00282837faecc886434cc8cc5f631575a5e6c386de774

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: max-age=2592000
content-encoding: br
cf-cache-status: HIT
etag: W/"e65f-5f7cf3aed6f0f"
age: 4861
via: 1.1 google
cf-ray: 8e801074cb18a1e4-YYZ
expires: Wed, 25 Dec 2024 06:32:17 GMT
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/javascript
last-modified: Sun, 26 Mar 2023 15:25:02 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 did-004d.min.js Show response
d-code.liadm.com/ 137 KB
47 KB 124ms
34ms Script
application/javascript 2600:9000:2073:6000:1c:2afd:fb00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d-code.liadm.com/did-004d.min.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.32.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2073:6000:1c:2afd:fb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: c016ae81681aa024b9f246d58196402fa80d99d08402ebd00fef802803ea366b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: public,max-age=86400
content-encoding: gzip
age: 54200
via: 1.1 e0ed595b39732d9e9972db26854384ec.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: HgS49yqG08wm300hAITgFPh8IJPkJ55c2awJKXsn2p5H8foW58OiPw==
date: Sun, 24 Nov 2024 16:49:58 GMT
content-type: application/javascript
vary: Accept-Encoding
x-amz-cf-pop: IAD50-C2

GET
H3 200 envelope Show response
lexicon.33across.com/v1/ 42 B
58 B 41ms
41ms XHR
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0015a0000344WLkAAM&src=ima&ver=1.14.0&us_privacy=1---
Requested by: Host: cdn-ima.33across.com
URL: https://cdn-ima.33across.com/ima.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 435b1ece4a55f4f8d06866b32c1aee3cc4661eb905265894795f15a57bf1b33d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.wintersexpress.com/

Response headers

cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.wintersexpress.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/json
vary: origin

GET
H3 200 AGSKWxVx78fHDOu13jtmqSq-xSmu5eZ13duNrTV8IQTcnACET_FdIv2ryzQwQj8m3c1uR36qzpE52EKZfnI3fbZW8jH7zSWHtDGbWaf1G1kOEGs5lWv_bHj2Ve51i6d30BnlnHbhLU7Y6A== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 62ms
62ms Script
application/javascript 142.251.111.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVx78fHDOu13jtmqSq-xSmu5eZ13duNrTV8IQTcnACET_FdIv2ryzQwQj8m3c1uR36qzpE52EKZfnI3fbZW8jH7zSWHtDGbWaf1G1kOEGs5lWv_bHj2Ve51i6d30BnlnHbhLU7Y6A==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzMyNTIxMTk4LDg3NTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vd3d3LndpbnRlcnNleHByZXNzLmNvbS8iLG51bGwsW1s4LCI5ejVrZGR0S2ZVbyJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f100.1e100.net

Software

ESF /

Resource Hash

ac7122884b38204552690d708b153eb45da3022bf418101c778f72c482d2a194

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-L_6kv81oUAF5eI2kdS5sdg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmJw1JBikPj6kkkLiJ3SZ7CGAHHrzXOs04E46d951hIgNlS4xOoMxI5Fl1g9gVi15xKrORDfX3eJ9TkQzzh_mXUBEBdJXGFtAeLbTVdYHwMxw9crrBxALMTD8e7mhF1sAjOm92xlVtJIyi-MT87PKynKTCotyS9KS05LLU4tKkstijcyMDIxNDS01DMwjC8wAAA9YkHK"
content-security-policy: script-src 'report-sample' 'nonce-L_6kv81oUAF5eI2kdS5sdg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 ProfilesEngineServlet Show response
api.intentiq.com/profiles_engine/ 116 B
901 B 134ms
33ms XHR
text/html 18.67.76.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=328512134&pt=17&dpn=1&jsver=5.36&iiqidtype=2&iiqpcid=15f3f662-9e6f-467d-9855-bc0f4b623a32&iiqpciddate=1732521198878&iiqcallcount=0&iiqfailcount=0&iiqnodata=false&iiqlocalstorageenabled=true&tsrnd=453_1732521198878&fbp=2809319783&cttl=43200000&rrtt=0&dud=0&abtg=A&iiqppcc=0
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/iquid-01.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.76.20 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-76-20.iad89.r.cloudfront.net
Software: /
Resource Hash: a8e394af1a49c3a2cbb6d8476b62b1ac14fda7fafffae0db03df202f818c6871

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

access-control-max-age: 3600
access-control-allow-methods: POST, GET, OPTIONS
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
x-amz-cf-id: QGCX10WqAXltr8BItfiEjoE7HeO2YOQE8fRlqcj9e91QnjDrwgIq6w==
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: text/html
vary: Origin
access-control-allow-headers: Content-Type, Accept, X-Requested-With, remember-me, DNT,X-CustomHeader,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control
patent: https://www.almondnet.com/ip
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 41498907366f3804198b1abc90c08490.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.wintersexpress.com
x-amz-cf-pop: IAD89-P2

GET
H2

200

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/
Redirect Chain

https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=947664&iiqidtype=2&iiqpcid=15f3f662-9e6f-467d-9855-bc0f4b623a32&iiqpciddate=1732521198878&tsrn...
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=947664&iiqidtype=2&iiqpcid=15f3f662-9e6f-467d-9855-bc0f4b623a32&iiqpciddate=1732521198878&tsrn...

43 B
1 KB

41ms
39ms

Image
image/gif

2600:9000:2073:3600:1b:6b7d:2300:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=947664&iiqidtype=2&iiqpcid=15f3f662-9e6f-467d-9855-bc0f4b623a32&iiqpciddate=1732521198878&tsrnd=633_1732521198879&fbp=2809319783&jsver=5.36&abtp=100&abtg=A&ckls=true&ci=ia5HfE7Op8&nc=false&trid=114197131
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Server: 2600:9000:2073:3600:1b:6b7d:2300:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 8d0bf2975485a7f0e4b8d82ddd378292.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 25 Nov 2024 07:53:19 GMT
content-type: image/gif
x-amz-cf-pop: IAD50-C2
x-amz-cf-id: KDUGsSvmpQT2OzBBcsqPParIB8FEY_Y2PtFzfGERCgolwUa6Y-uO_A==

Redirect headers

patent: https://www.almondnet.com/ip
cache-control: no-cache, no-store, must-revalidate
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=947664&iiqidtype=2&iiqpcid=15f3f662-9e6f-467d-9855-bc0f4b623a32&iiqpciddate=1732521198878&tsrnd=633_1732521198879&fbp=2809319783&jsver=5.36&abtp=100&abtg=A&ckls=true&ci=ia5HfE7Op8&nc=false&trid=114197131
pragma: no-cache
via: 1.1 8d0bf2975485a7f0e4b8d82ddd378292.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 25 Nov 2024 07:53:18 GMT
content-type: image/gif
x-amz-cf-pop: IAD50-C2
x-amz-cf-id: pK3ZaaJog1NKAfDaDsr3atR--dN5w7OtaKhnLo_eXQxfQAliwo9gwA==

GET bounce
id5-sync.com/ 0
0

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
293 B 121ms
113ms Fetch
application/json 162.19.138.117
OVH OVH SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

429c09ef872b45d80fa51a8ed156e581ed31fd094c179e4d6dd1d3f1bf18f20b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.wintersexpress.com
date: Mon, 25 Nov 2024 07:53:17 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 syncframe
gum.criteo.com/ Frame 0D6E 0
0 113ms
34ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.wintersexpress.com&gdpr=0&gdpr_consent=&gpp=&gpp_sid=-1

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.wintersexpress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 25 Nov 2024 07:53:18 GMT
server: Kestrel
server-processing-duration-in-ticks: 301213
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H3 200 AGSKWxUMHq17QmjHDljxDGbx4ubEHh2oujvbpBpb3t12bkHJN-muMzZcaR8N97Y0egAdzbXFSSZ3u19pffpPMXkrEe0KHy0s4f_hXYTw3CozY1Db1xYo53G76fHRxoP4imVSl6uzeAsC-g== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 66ms
66ms Script
application/javascript 142.251.111.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUMHq17QmjHDljxDGbx4ubEHh2oujvbpBpb3t12bkHJN-muMzZcaR8N97Y0egAdzbXFSSZ3u19pffpPMXkrEe0KHy0s4f_hXYTw3CozY1Db1xYo53G76fHRxoP4imVSl6uzeAsC-g==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzMyNTIxMTk4LDk3MDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMCw5XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly93d3cud2ludGVyc2V4cHJlc3MuY29tLyIsbnVsbCxbWzgsIjl6NWtkZHRLZlVvIl0sWzksImVuLVVTIl0sWzE5LCIyIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f100.1e100.net

Software

ESF /

Resource Hash

56274ad982a24770370b1a8e9e1623f67d391d29fe822c6d72f63c80f9ec3e7f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-3Huyv1mhqiqOiMdnnf6YPQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:19 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmLw1ZBikPj6kkkLiJ3SZ7CGAHHrzXOs04E46d951hIgNlS4xOoMxI5Fl1g9gVi15xKrORDfX3eJ9TkQzzh_mXUBEBdJXGFtAeLbTVdYHwMxw9crrBxALMTN8f7mhF1sAjsObWBX0kjKL4xPzs8rKcpMKi3JL0pLTkstTi0qSy2KNzIwMjE0NLTUMzCMLzAAAAbzQZQ"
content-security-policy: script-src 'report-sample' 'nonce-3Huyv1mhqiqOiMdnnf6YPQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 in_search.js Show response
resources.infolinks.com/js/1970.003-4.011/ 235 KB
37 KB 56ms
40ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1970.003-4.011/in_search.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1970.003-4.011/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b251749e04ba1d0a4dcd53781ebf83415823829c9f36ee5102372f98ab40d8a2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: max-age=2592000
content-encoding: br
cf-cache-status: HIT
etag: W/"3aaea-6272c7fe560af"
age: 2099
via: 1.1 google
cf-ray: 8e8010763b94a1e4-YYZ
expires: Wed, 25 Dec 2024 07:18:20 GMT
date: Mon, 25 Nov 2024 07:53:19 GMT
content-type: application/javascript
last-modified: Mon, 18 Nov 2024 09:25:38 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 424 KB
145 KB 133ms
42ms Script
text/javascript 2607:f8b0:4004:c1f::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1970.003-4.011/ice.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1f::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

977bd6573db0c146bae702f95e3af7a1f5d00899c3c9fb1afff078a71a893149

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: private, max-age=900, stale-while-revalidate=3600
content-encoding: gzip
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 07:53:19 GMT
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 148132
date: Mon, 25 Nov 2024 07:53:19 GMT
x-xss-protection: 0
content-type: text/javascript
vary: Accept-Encoding
server: sffe

GET
H2 200 container-4.0.html
resources.infolinks.com/static/ Frame FA6F 0
0 42ms
40ms Document
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/container-4.0.html
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1970.003-4.011/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://www.wintersexpress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

age: 60
cache-control: max-age=2592000
cf-cache-status: HIT
cf-ray: 8e8010764e2b711b-YYZ
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 25 Nov 2024 07:53:19 GMT
etag: W/"a9c-60cca5a8a7732"
expires: Wed, 25 Dec 2024 07:52:19 GMT
last-modified: Mon, 18 Dec 2023 15:25:02 GMT
server: cloudflare
vary: Accept-Encoding
via: 1.1 google

POST
H3 204 AGSKWxU_WqQ0Rs21UgNVdWcPCgi8SSocRHuobc4pQMKqqzUS9X4qPBexgqQ5z3ExbroOPbY3LzCweSwPvpbt5cz7Zi4o45b29YcGqJu-xSY_qkv33GUUFBF9GCKtN59rR5yOOD29RWO9mg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 61ms
60ms XHR
text/html 142.251.111.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU_WqQ0Rs21UgNVdWcPCgi8SSocRHuobc4pQMKqqzUS9X4qPBexgqQ5z3ExbroOPbY3LzCweSwPvpbt5cz7Zi4o45b29YcGqJu-xSY_qkv33GUUFBF9GCKtN59rR5yOOD29RWO9mg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f100.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-X8YpmFflXAhkkhFv-d1VmQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.wintersexpress.com/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:19 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmLw0JBicEqfwRoCxAxfr7ByALEQN8f7mxN2sQnMePTHSsklKb8wPjk_ryQ1r0Q3MaVYF8QuykwqLckvQmGnloFU5OSnp2fmpccbGRiZGBoaWuoZmMYXGAAAGDAmWQ"
content-security-policy: script-src 'report-sample' 'nonce-X8YpmFflXAhkkhFv-d1VmQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://www.wintersexpress.com
content-length: 0
x-xss-protection: 0
server: ESF

POST v3
id5-sync.com/gm/ 0
0

GET
H2 200 getads.htm Show response
rt3060.infolinks.com/action/ 9 KB
6 KB 383ms
382ms Script
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3060.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A1%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A0%2C%22sdata%22%3A%22canada%22%2C%22scs%22%3A%22U58fqjv3Kf%22%7D%5D&rid=f7aee43d-83d7-4a2e-adc2-1c8d00ac157d&jsv=1970.003-4.011&sr=1600X1200&rts=1732521199127&cfv=-1&cb=getAdsResponse&os=Linux&ov=x86_64&br=Chrome&bv=131.0.0.0&dv=p&ce=t&purl=https%3A%2F%2Fwww.wintersexpress.com%2F&tzo=-0800&c=c&strg=true&pitc=92~KTnoinuZ4lTMqxpkaN2t1dXAKZAemo1s&sua=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%7D&rsd=noYrKOQPecd_1VASv7J6tkQ0OqPVqTD9lWBU-GylJBOdq44cth8KKe5miwaiHd8QPp-kQf2gBYVKkJPRH72G9OGAN1QcIdnyrKi50aGpxigUxhxaRwaLCNjWjLswF4kuZJxUFrnAVxnWr5d1b8jR8QGuhs6_REmM0Rw7kSGznTE&rsk=15&rcs=NPZUP4X-Q00pKjfEAV5PWA&cuid=fde4fc90-0d29-44f1-bc15-bd5307cedc82&_pubcid=d626cdd5-8985-42a5-b989-850150d0bda4&auhdrid=060ixe9ju6a65dg9iefi9ld8dfc9glgge7huom6wi0e0ykq6umou60k4koi6q0qqm&li_in_us_res=null&ique=%5Bobject%20Object%5D&hbnr=false
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1970.003-4.011/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a77683cc59e081980f341379634accbffbd7ae20e6b53988df23fae02d1e5af0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache,no-store
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 8e801076abc9a1e4-YYZ
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NON DSP NID OUR COR"
date: Mon, 25 Nov 2024 07:53:19 GMT
content-type: text/html;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
server: cloudflare
content-language: en-CA

GET
H2 200 any Show response
idx.liadm.com/idex/did-004d/ 130 B
552 B 140ms
41ms XHR
text/plain 54.164.90.29
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://idx.liadm.com/idex/did-004d/any?duid=42717b9848f5--01jdh4z1hkxpsj5yegcgx9mrbg&did=did-004d&cd=.wintersexpress.com&pu=https%3A%2F%2Fwww.wintersexpress.com%2F&us_privacy=1---&gpp_as=-1&pv=e6e63354-e2ed-4538-af49-8f955caef108&_pubcid=d626cdd5-8985-42a5-b989-850150d0bda4&ajs_user_id=null&resolve=nonId&resolve=uid2&resolve=index&resolve=openx&resolve=pubmatic&resolve=magnite&resolve=bidswitch&resolve=medianet&resolve=sovrn&resolve=connatix&resolve=thetradedesk

Requested by

Host: d-code.liadm.com
URL: https://d-code.liadm.com/did-004d.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.164.90.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-164-90-29.compute-1.amazonaws.com

Software

Resource Hash

95ef68ed59b460d83ce14aadc7b21dd0b267e6331ca2a561f51256d7c7038b7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: 1956bc76eda9ab11
request-time: 10
access-control-allow-credentials: true
expires: Tue, 26 Nov 2024 07:53:19 GMT
access-control-allow-origin: https://www.wintersexpress.com
content-length: 130
date: Mon, 25 Nov 2024 07:53:19 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H3 200 ima_ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 110 B
73 B 58ms
58ms XHR
application/json 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ima_ppub_config?ippd=https%3A%2F%2Fwww.wintersexpress.com%2F

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

be264be208f4320ddbab1ae6bf6d5556b7efb13e37f29e26ac5202222ad6ca7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 07:53:19 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 49
date: Mon, 25 Nov 2024 07:53:19 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 adview.htm Show response
rt3060.infolinks.com/action/ 0
142 B 95ms
94ms XHR
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3060.infolinks.com/action/adview.htm?rid=f7aee43d-83d7-4a2e-adc2-1c8d00ac157d&bdc=1&midx=0&emd=MTQ3fjE4MjE&rts=1732521199545&prod_t=d&jsv=1970.003-4.011&skin=sidebar&theme=nologo&sdata=canada&scs=U58fqjv3Kf&rsd=noYrKOQPecd_1VASv7J6tkQ0OqPVqTD9lWBU-GylJBOdq44cth8KKe5miwaiHd8QPp-kQf2gBYVKkJPRH72G9OGAN1QcIdnyrKi50aGpxigUxhxaRwaLCNjWjLswF4kuZJxUFrnAVxnWr5d1b8jR8QGuhs6_REmM0Rw7kSGznTE&rsk=15&rcs=NPZUP4X-Q00pKjfEAV5PWA
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1970.003-4.011/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache,no-store
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 8e8010793ed9abc7-YYZ
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://www.wintersexpress.com
content-length: 0
p3p: CP="NON DSP NID OUR COR"
date: Mon, 25 Nov 2024 07:53:19 GMT
content-type: text/html
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
server: cloudflare

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame BDC8 156 KB
52 KB 50ms
48ms Script
text/javascript 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: blank
URL: about:blank

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

1dda385aef934f6e0f667cd38b8c28c3a1c099abd8aa504a16b30b69e0637428

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 15510843180013569697
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 07:53:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 25 Nov 2024 07:53:19 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 53304
x-xss-protection: 0
server: cafe

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 5124 42 B
65 B 44ms
43ms Fetch
image/gif 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvFmPCpFAOD0UU0XVdUinEFSsud8tMepNUQv-5cU8jdykPAb9qrcGJBSbZNtv4ynYq6EgDzW7uDfQA2N5EVNLzLdyH4ANELDfy30erK60xPh9nYdaB_M77ZY3TlseBnuG7aWq5JzdOnxnvoXw_hfiLQYygCPTwiaeezeyosxf2iaFppEzLJlRvfiOoguzrpGGTxFg&sig=Cg0ArKJSzNxgIr5tIlt4EAE&id=lidar2&mcvt=1027&p=1,799,2,800&tm=1035.2999992370605&tu=8.100000381469727&mtos=1027,1027,1027,1027,1027&tos=1027,0,0,0,0&v=20241120&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=1801229185&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=2845399800&rst=1732521198227&rpt=332&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Mon, 25 Nov 2024 07:53:19 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202411140101/ Frame BDC8 434 KB
144 KB 60ms
60ms Script
text/javascript 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202411140101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

b78d297615e175f921ea0444a6d2e6b6f9f810c44acd35f48a278623fef3e677

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 11944534632581548587
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 07:53:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 25 Nov 2024 07:53:19 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 147631
x-xss-protection: 0
server: cafe

GET
H3 200 zrt_lookup_fy2021.html
googleads.g.doubleclick.net/pagead/html/r20241120/r20190131/ Frame 5C57 0
0 94ms
32ms Document
text/html 172.253.122.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20241120/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202411140101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

age: 39858
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4128
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Nov 2024 20:49:01 GMT
etag: 17661348622971093804
expires: Sun, 08 Dec 2024 20:49:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BDC8 0
20 B 42ms
42ms Image
image/gif 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&tn=DIV&id=d_IL_INSEARCH&cls=IL_BASE%20insearch1&ign=false&pw=1600&ph=1200&x=800&y=1130.4

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 25 Nov 2024 07:53:19 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BDC8 0
20 B 40ms
40ms Image
image/gif 142.250.31.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&tn=DIV&id=x-reveal-ad&cls=hidden-print&ign=false&pw=1600&ph=1200&x=0&y=0

Requested by

Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 25 Nov 2024 07:53:19 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ads
googleads.g.doubleclick.net/pagead/ Frame 2919 0
0 416ms
374ms Document
text/html 172.253.122.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-6373315980741255&output=html&h=90&slotname=2794737922&adk=1445061518&adf=2751417949&pi=t.ma~as.2794737922&w=728&abgtt=1&rdp=false&format=728x90&url=https%3A%2F%2Fwww.wintersexpress.com%2F&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1732521199668&bpp=4&bdt=88&idt=107&shv=r20241120&mjsv=m202411140101&ptt=9&saldr=aa&correlator=317168216463&frm=23&ife=1&pv=2&nhd=1&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=95347445%2C95345967%2C95347755&oid=2&pvsid=3379807540127882&tmod=1451389138&uas=0&nvt=1&loc=https%3A%2F%2Fwww.wintersexpress.com%2F&fc=640&brdim=120%2C120%2C120%2C120%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=1.melcpinstbof&fsb=1&dtd=151

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202411140101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 26685
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 25 Nov 2024 07:53:20 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads
googleads.g.doubleclick.net/pagead/ Frame 6D8F 0
0 79ms
41ms Document
text/html 172.253.122.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-6373315980741255&output=html&adk=1812271804&adf=480832070&abgtt=1&plat=1%3A16777216%2C2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=188x675_l%7C212x675_r&rdp=false&format=0x0&url=https%3A%2F%2Fwww.wintersexpress.com%2F&pra=7&wgl=1&aihb=0&aiof=3~4&asro=0&ailel=1~2~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aiael=1~2~3~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aicel=33~38&aifxl=29_18~30_19&aiixl=29_5~30_6&aiict=1&aiapm=0.3221&aiapmi=0.33938&aiombap=1&aief=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1732521199668&bpp=2&bdt=88&idt=113&shv=r20241120&mjsv=m202411140101&ptt=9&saldr=aa&prev_fmts=728x90&nras=1&correlator=317168216463&frm=23&ife=1&pv=1&nhd=1&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=95347445%2C95345967%2C95347755&oid=2&pvsid=3379807540127882&tmod=1451389138&uas=0&nvt=1&fsapi=1&loc=https%3A%2F%2Fwww.wintersexpress.com%2F&fc=640&brdim=120%2C120%2C120%2C120%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32772&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=2.2phn293giqv0&fsb=1&dtd=155

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202411140101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 25 Nov 2024 07:53:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ Frame BDC8 17 KB
13 KB 89ms
51ms XHR
application/json 64.233.180.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gda&tv=r20241120&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202411140101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

on-in-f155.1e100.net

Software

cafe /

Resource Hash

5173b4d675defadf69b4164310fe856f6d8f002695e9e4bd259862a1b7b01cb2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 12992
date: Mon, 25 Nov 2024 07:53:19 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ Frame BDC8 18 KB
7 KB 109ms
33ms Script
text/javascript 2607:f8b0:4004:c06::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202411140101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 07:53:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:20 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 runner.html
ep2.adtrafficquality.google/sodar/sodar2/232/ Frame 62C9 0
0 92ms
31ms Document
text/html 2607:f8b0:4004:c06::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1863
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 25 Nov 2024 07:22:17 GMT
expires: Mon, 25 Nov 2024 08:12:17 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame 8062 0
0 153ms
49ms Document
text/html 172.253.115.105
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f105.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Mg8DxxY5nTqTYh4GQU1gGQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-Mg8DxxY5nTqTYh4GQU1gGQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Mon, 25 Nov 2024 07:53:20 GMT
expires: Mon, 25 Nov 2024 07:53:20 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1732521200158&did=did-004d&se=e30&duid=42717b9848f5--01jdh4z1hkxpsj5yegcgx9mrbg&tv=v3.5.0&pu=https%3A%2F%2Fwww.wintersexpress.com%2F&ext__pubcid=d626cdd5-8985-42a5-b98...
https://rp4.liadm.com/j?dtstmp=1732521200158&did=did-004d&se=e30&duid=42717b9848f5--01jdh4z1hkxpsj5yegcgx9mrbg&tv=v3.5.0&pu=https%3A%2F%2Fwww.wintersexpress.com%2F&ext__pubcid=d626cdd5-8985-42a5-b9...

13 B
370 B

186ms
31ms

XHR
application/json

23.20.101.159
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1732521200158&did=did-004d&se=e30&duid=42717b9848f5--01jdh4z1hkxpsj5yegcgx9mrbg&tv=v3.5.0&pu=https%3A%2F%2Fwww.wintersexpress.com%2F&ext__pubcid=d626cdd5-8985-42a5-b989-850150d0bda4&ext_ajs_user_id=null&us_privacy=1---&wpn=lc-bundle&wpv=v3.5.0&gpp_as=-1&cd=.wintersexpress.com&c=PG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IiI-PHRpdGxlPndpbnRlcnNleHByZXNzLmNvbSB8IFdpbnRlcnMgRXhwcmVzczwvdGl0bGU-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vd3d3LndpbnRlcnNleHByZXNzLmNvbS8iPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0xIj5BcnRpY2xlIHdpdGggaW1hZ2VzPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMiI-QXJ0aWNsZSB3aXRoIGltYWdlczwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTMiPkFydGljbGUgd2l0aCBpbWFnZXM8L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS00Ij5BcnRpY2xlIHdpdGggaW1hZ2VzPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNSI-QXJ0aWNsZSB3aXRoIGltYWdlczwvdGl0bGU-&pv=e6e63354-e2ed-4538-af49-8f955caef108&i6=MjYwNzo1MzAwOjYwOjc4Njc6OjM%3D
Requested by: Host: www.wintersexpress.com
URL: https://www.wintersexpress.com/
Protocol: H2
Server: 23.20.101.159 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-20-101-159.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-pixel-event-id: db452ed4-39df-4c26-938d-ff1af08df355
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Mon, 25 Nov 2024 07:53:20 GMT
content-type: application/json

Redirect headers

access-control-max-age: 86400
access-control-expose-headers: *
location: https://rp4.liadm.com/j?dtstmp=1732521200158&did=did-004d&se=e30&duid=42717b9848f5--01jdh4z1hkxpsj5yegcgx9mrbg&tv=v3.5.0&pu=https%3A%2F%2Fwww.wintersexpress.com%2F&ext__pubcid=d626cdd5-8985-42a5-b989-850150d0bda4&ext_ajs_user_id=null&us_privacy=1---&wpn=lc-bundle&wpv=v3.5.0&gpp_as=-1&cd=.wintersexpress.com&c=PG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IiI-PHRpdGxlPndpbnRlcnNleHByZXNzLmNvbSB8IFdpbnRlcnMgRXhwcmVzczwvdGl0bGU-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vd3d3LndpbnRlcnNleHByZXNzLmNvbS8iPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0xIj5BcnRpY2xlIHdpdGggaW1hZ2VzPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMiI-QXJ0aWNsZSB3aXRoIGltYWdlczwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTMiPkFydGljbGUgd2l0aCBpbWFnZXM8L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS00Ij5BcnRpY2xlIHdpdGggaW1hZ2VzPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNSI-QXJ0aWNsZSB3aXRoIGltYWdlczwvdGl0bGU-&pv=e6e63354-e2ed-4538-af49-8f955caef108&i6=MjYwNzo1MzAwOjYwOjc4Njc6OjM%3D
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://www.wintersexpress.com
content-length: 0
date: Mon, 25 Nov 2024 07:53:20 GMT

GET
H2 200 dcl.htm Show response
rt3060.infolinks.com/action/ 0
64 B 96ms
95ms Script
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3060.infolinks.com/action/dcl.htm?rid=f7aee43d-83d7-4a2e-adc2-1c8d00ac157d&prod_t=d&sdata=canada&bdc=1&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1970.003-4.011/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache,no-store
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 8e80107fd81da1e4-YYZ
expires: Thu, 01 Jan 1970 00:00:00 GMT
content-length: 0
date: Mon, 25 Nov 2024 07:53:20 GMT
content-type: text/html;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
server: cloudflare

GET sodar
ep1.adtrafficquality.google/pagead/ Frame BDC8 0
0

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ 17 KB
13 KB 48ms
48ms XHR
application/json 64.233.180.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202411180101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

on-in-f155.1e100.net

Software

cafe /

Resource Hash

809111d7ccdcd1d1db57c493c9291fab54dd753cd62c1d3d9e96d4164c925cd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13121
date: Mon, 25 Nov 2024 07:53:21 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 icon.ico
www.wintersexpress.com/content/tncms/site/ 1 KB
1 KB 35ms
35ms Other
image/x-icon 192.104.182.109
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.wintersexpress.com/content/tncms/site/icon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.182.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.us-midwest-1.vip.tn-cloud.net
Software: /
Resource Hash: 83e269d9ebe58bd5f2879e6455046b42e718e388c5c933b0c32d1767bac6a904

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

x-vcache: HIT
cache-control: public, max-age=43200
etag: "63f77959-47e"
age: 3235
accept-ranges: bytes
content-length: 1150
date: Mon, 25 Nov 2024 06:59:25 GMT
last-modified: Thu, 23 Feb 2023 14:34:01 GMT
content-type: image/x-icon

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ 18 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c06::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202411180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.wintersexpress.com/

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Mon, 25 Nov 2024 07:53:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:20 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 runner.html
ep2.adtrafficquality.google/sodar/sodar2/232/ Frame 1B40 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c06::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.wintersexpress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1863
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 25 Nov 2024 07:22:17 GMT
expires: Mon, 25 Nov 2024 08:12:17 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame 5B16 0
0 0ms
0ms Document
text/html 172.253.115.105
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f105.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Mg8DxxY5nTqTYh4GQU1gGQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.wintersexpress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-Mg8DxxY5nTqTYh4GQU1gGQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Mon, 25 Nov 2024 07:53:20 GMT
expires: Mon, 25 Nov 2024 07:53:20 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET sodar
ep1.adtrafficquality.google/pagead/ 0
0

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 42ms
40ms Fetch
text/plain 2607:f8b0:4004:c1f::66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-12M2XZC8V4&gtm=45je4bk0v873737409z8857454493za200zb857454493&_p=1732521196640&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&tag_exp=101925629~102067555~102067808~102077855~102081485&cid=1130602829.1732521198&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AAAC&sid=1732521198&sct=1&seg=1&dl=https%3A%2F%2Fwww.wintersexpress.com%2F&dt=wintersexpress.com%20%7C%20Winters%20Express&_s=2&tfd=6985
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-12M2XZC8V4&l=dataLayer&cx=c&gtm=45He4bk0v857454493za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1f::66 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.wintersexpress.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:23 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
analytics.google.com/g/ 0
0 42ms
40ms Fetch
text/plain 2001:4860:4802:36::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-4T2EB147B8&gtm=45je4bk0v887101457za200zb861227858&_p=1732521196640&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&tag_exp=101925629~102067555~102067808~102077855~102081485&cid=1130602829.1732521198&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=AEI&dt=wintersexpress.com%20%7C%20Winters%20Express&dl=https%3A%2F%2Fwww.wintersexpress.com%2F&sid=1732521197&sct=1&seg=0&_s=2&tfd=7169
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4T2EB147B8&l=dataLayer&cx=c&gtm=45He4bk0v861227858za200zb72758733
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.wintersexpress.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.wintersexpress.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 25 Nov 2024 07:53:23 GMT
content-type: text/plain
server: Golfe2

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: id5-sync.com
URL: https://id5-sync.com/bounce

Domain: id5-sync.com
URL: https://id5-sync.com/gm/v3

Domain: id5-sync.com
URL: https://id5-sync.com/bounce

Domain: id5-sync.com
URL: https://id5-sync.com/gm/v3

Domain: ep1.adtrafficquality.google
URL: https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=232&t=2&li=gda_r20241120&jk=3379807540127882&bg=!zc6lzoHNAAaIaF9IqGg7ADQBe5WfOKtS8ngTpJpZ7icjG1pqHcUY5RZpQTuWW1uqbTevZUN09LmHCj_Zy_8R_hM7LO8ZAgAAAEJSAAAABGgBB34ANnwgsEDwooszkmulzg02Mo6K-ZPsSvnCC10mDTJ40OGP6pWXLWUTCORXUoxqAaM0M8X9nsTN8pkCvQ1ZHoOoMIzujKK8Y3rYT4ol5HbXRgOz5TINY_SV9f1n-vA7RPdNpEpggIs_wu3HkbjeFZz9JK7WNq-5vT64SzQwYFnqttYed79S_pRGWlNmU1J8wHHL1oW-FDGKjsy5ea2iMBXlRDlmS1D146v-kk8bvbMZO6wEtUN2k3SCs3VjC6H3Jh0oISmE9YesPVeOEEa78O8vSh7l5opp3HDtDs0FGlhyZRuYM03IN9SFlPGFA2mMg-ODH-GEfTjjfKnAZ5FkJ2EzkJCiZx59yl8PsBQv3du-JkgAf8a1HmIOS_5O-iYbsU_OMsoRmzDKwKvaUKy6ru8QlPIgIWlwI3I3U52SlAmkHMH0VPIKqIEqGeiP3da6-VDE5RmLAP5AMRWsEaYqTgG0s4FL_OqxBQBZTmBgi8mSwHjyFHbiJzSqKnAJkheVTObbpqUNwfTB0UbN6NdDXVpXX9DY-SMNB7BbQc3sC3Mm2DwogEfpC3S9A4EFwF4U4p6kM1c63GL17hTjPTZH6vgxpSXCyKvp6F3ZoNI9qE55OibGU9kP8pmeh7CwnLqGmb33YOu-T12y-LvoYDkPtW5l4csElWlzPh6Z6kPAS-aoawUR0ABl7hGznkfwNHaSbimeuVMXrWfDyOfnrJlD8ZVDGYb8qmud4cM8GJOa33xOBW21rnRAAkGzxCU2vxQTzjvTYurIPTGRmg-Lb-MbhSQQzi8igQFqIoE2Zf5TqfPy6ElYjkgq0qGk1cff1G-pSTchrmsFOOHUpbO-JHJsQysF_0d8IVtR7o5F2EUTInRwpy2KZwoXqnAr3fZP7GtOWlpW-rr5qKIawd0ahP31ETRIl_AJdN6aFi3jPSm4L2CklcO9PNPgTOAO4xsiYSjUw504dUVXYjTZ5L3QL5zgxg2QnoVe_ofyW8YewAAZ1Ojfi_cMoUpYWSXz

Domain: ep1.adtrafficquality.google
URL: https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202411180101&jk=2044719051248835&bg=!UlGlUR7NAAaIaF9IqGg7ADQBe5WfOEby_mZc55o7J6_Quh-hFN4LNKiK8nyXwDwIQD2SugBlvMnaPuOmGqSLwvDSbew3AgAAAFFSAAAABGgBB34ANiyCtYpSKGvWACQo09wq0TuR8N4RyfDRqoJVbh0yiIzLF6RftI3gQI77FdYo5rhvbN-K83a8nJkCnEwq_sjjFDsPxzVQjvjPB_eubNLa8yaSOcn_PxOGMrs1tAO_Hn1kF97dUKioKYNsTNLn8ESdOyf7pVVZj9F_GDClXO5cWKz9vQ_FOlOSkptKhY52v1ideGuZlwW8v_E1yVtCuPGYqy5klzvl-yjQIBTo7i5Ie5EVkO1YHjt28K5J_F5R-aE3ef8eDtUsXxyXPbm_6KxB374d9eMEa0fPjVb0MzGeoZLhg0HTEyI2LIjYYhLDlHoIawL0QZ7yxEeJOmgk7S6J8Fk_LfRR8azPliAbyjT2zR0kIuwn79Je9cbqKINxswkWHXKPItB9Fj2QvYxMakKT4eIs-Cqz79jQCCOWyFcQ-VvDDItISnXFPWB_2AQ9k5gTalbVqdE1eKC1M7g1g5ngvyEy_fSPU5f4dMVtOdNPmWBkxsDOmccvvekj6zPbxrvsjxjjSGOwxZi_CAbN4m4cURfUwnyk4JbVn62goBljdskRYSOzk3i83GMhT8kN3bmNM-7ZbXj-EHOew8vWJDUzOYOJXiz-58ravjLbsuwPo5RUZIBC7JtmsjnTKrh2Y9tM24x6ykZjv-v7rH2rrQEG1dWeR758v-t75uOuD1eZgux4Blv6ny3rp8o0vf53kg2nDolmONZWMDFXlS9OXc92O1AzM3OE_BYNRSHJ7pMPnxz-jKP8r4pMvgcIZkU4Z0s175m3vniQ2XMkGFBAvtb81j-tdG6u7ag-e_YHdf0g3j5jxlFYR4Xw97xZgjDrY7AKMawnA4R4HZrKD6twXCdWdlm3tY4QPnN2hwsEOdQ5ViJAUz4mgYwrGo0k3AZqtCz8I4KXqC2PcP03WJg-FBu_yTUxfNMX_lGnYWsHOPW8GvJk8koLfKKKTmCaNcsZ3OZBLYlquCqX

Verdicts & Comments Add Verdict or Comment

404 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

173 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.smartadserver.com/api	1970-01-21 03:24:57	Name: pid Value: 3287730146430589196
.liadm.com/j	1970-01-21 10:51:21	Name: lidid Value: 0adb23e6-e6fe-4a24-ae08-90786e1c8786
.wintersexpress.com/	1970-01-21 01:15:22	Name: _sp_ses.711b Value: *
.wintersexpress.com/	1970-01-21 10:51:21	Name: _sp_id.711b Value: 92495dd4-c948-4580-a54f-1e82042c3a55.1732521198.1.1732521198..b36696e8-dd6c-486f-9783-5eaf8de73211....0
.33across.com/	1970-01-21 10:00:57	Name: check Value: true
.crwdcntrl.net/	1970-01-21 07:44:06	Name: _cc_dc Value: 0
.crwdcntrl.net/	1970-01-21 07:44:06	Name: _cc_id Value: 6ed1798bae690f9a9b81c21dc3a7cc68
.wintersexpress.com/	1970-01-21 01:15:21	Name: lotame_domain_check Value: wintersexpress.com
.wintersexpress.com/	1970-01-21 07:44:09	Name: _cc_id Value: 6ed1798bae690f9a9b81c21dc3a7cc68
.wintersexpress.com/	1970-01-21 01:16:47	Name: panoramaId_expiry Value: 1732607597677
.wintersexpress.com/	1970-01-21 10:51:21	Name: _ga Value: GA1.1.1130602829.1732521198
.ad.gt/	1969-12-31 23:59:59	Name: au_3p_check Value: 1
.wintersexpress.com/	1970-01-21 10:00:57	Name: _au_1d Value: AU1D-0100-001732521198-UPABSCL4-DAUN
.openx.net/	1970-01-21 10:00:57	Name: i Value: a363b2ae-c175-4815-9d2d-72db28da21bf\|1732521197
.adnxs.com/	1970-01-21 03:24:57	Name: XANDR_PANID Value: jGV6Ok3fV9qLZxbNg9uzVvkjKD-wWuVwB8AYQXH2LJDCCLXR9-X2cSxUr7pPh3nFrWGORvBInrbo9DLoIW9KjWLEa_J-XmUHQngfuXQ30DA.
.adnxs.com/	1970-01-21 10:51:21	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-21 03:24:57	Name: uuid2 Value: 3248038131172656463
.tapad.com/	1970-01-21 02:41:45	Name: TapAd_TS Value: 1732521198007
.tapad.com/	1970-01-21 02:41:45	Name: TapAd_DID Value: c71235e1-47ee-4579-a4bc-a625aaea868a
.pubmatic.com/	1970-01-21 03:24:57	Name: KTPCACOOKIE Value: true
.adsrvr.org/	1970-01-21 10:00:57	Name: TDID Value: 20fe83ce-9e2a-40f5-8b28-9316079689d8
.pubmatic.com/	1970-01-21 10:00:57	Name: KADUSERCOOKIE Value: 7B9D21CE-6374-4E40-BAC4-EDE54204A2D4
.rubiconproject.com/	1970-01-21 10:00:57	Name: khaos Value: M3WQE03K-B-71G
.rubiconproject.com/	1970-01-21 10:00:57	Name: khaos_p Value: M3WQE03K-B-71G
.wintersexpress.com/	1970-01-21 10:51:21	Name: _ga_12M2XZC8V4 Value: GS1.1.1732521198.1.1.1732521198.0.0.0
.wintersexpress.com/	1970-01-21 10:00:57	Name: ajs_anonymous_id Value: 98082e7c-dbc2-4c31-a61e-5a75cea123ff
.wintersexpress.com/	1970-01-21 10:36:57	Name: __gads Value: ID=1f21d18582fcd03b:T=1732521197:RT=1732521197:S=ALNI_MYIDY9AsZv-JHatjzKSgGhFxk7kXA
.wintersexpress.com/	1970-01-21 10:36:57	Name: __gpi Value: UID=00000e9f0484c11d:T=1732521197:RT=1732521197:S=ALNI_Mb313KBAgqJ6uANpRc-pFmF1KpQ6Q
.wintersexpress.com/	1970-01-21 05:34:33	Name: __eoi Value: ID=782452b58d416885:T=1732521197:RT=1732521197:S=AA-Afjai18PSo5SehoVv2bwPcpDx
.tapad.com/	1970-01-21 02:41:45	Name: TapAd_3WAY_SYNCS Value: 1!7927
.go.sonobi.com/	1970-01-21 10:00:57	Name: __uis Value: 31226daa-0c5f-4e81-b7a2-63101a171f28
.go.sonobi.com/	1969-12-31 23:59:59	Name: HAPLB8G Value: s86135\|Z0Qs8
.ad.gt/	1970-01-21 10:00:57	Name: au_id Value: AU1D-0100-001732521198-UPABSCL4-DAUN
.turn.com/	1970-01-21 05:34:33	Name: uid Value: 2807572217573817762
.doubleclick.net/	1970-01-21 10:51:21	Name: IDE Value: AHWqTUn_2xE7JI6yNTKiDK3wAa0Qebm0nklPKGTECkCybi42qXU0WcTwfq4pBpx0cp0
www.wintersexpress.com/	1969-12-31 23:59:59	Name: logglytrackingsession Value: 83e285d0-8e3b-4832-b00e-74be08720539
.infolinks.com/	1970-01-21 10:51:21	Name: cuid Value: fde4fc90-0d29-44f1-bc15-bd5307cedc82
.3lift.com/	1970-01-21 03:24:57	Name: tluidp Value: 2596030289413952223903
.3lift.com/	1970-01-21 03:24:57	Name: tluid Value: 2596030289413952223903
.infolinks.com/	1970-01-21 03:24:57	Name: OXUSERCOOKIE Value: 5b58af66-7b26-406e-8634-8dc1b45ab7d7
.pxl.iqm.com/	1970-01-21 01:58:33	Name: infolink Value: MTczMzczMDc5ODkyMQ==
.pxl.iqm.com/	1970-01-21 01:36:57	Name: iqm.retarget.uid Value: 4f4cc671-1876-48bc-ae30-1b2dbd8f220a
.sharethrough.com/	1970-01-21 01:58:33	Name: stx_user_id Value: 59c8dee3-908f-43fd-8be3-3cefafe82f64
.infolinks.com/	1970-01-21 03:24:57	Name: IQMUS Value: 4f4cc671-1876-48bc-ae30-1b2dbd8f220a
.intentiq.com/	1970-01-21 10:51:21	Name: intentIQ Value: ia5HfE7Op8
.intentiq.com/	1970-01-21 10:51:21	Name: IQver Value: 1.9
.infolinks.com/	1970-01-21 03:24:57	Name: SHTUSERCOOKIE Value: 59c8dee3-908f-43fd-8be3-3cefafe82f64
.infolinks.com/	1970-01-21 03:24:57	Name: R1USERCOOKIE Value: OPTOUT
.infolinks.com/	1970-01-21 03:24:57	Name: TPLSERCOOKIE Value: 2596030289413952223903
.wintersexpress.com/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .wintersexpress.com
.360yield.com/	1970-01-21 03:24:57	Name: tuuid Value: 4d503616-6202-4eb3-8a23-091f6d904aa6
.360yield.com/	1970-01-21 03:24:57	Name: tuuid_lu Value: 1732521199
.criteo.com/	1970-01-21 10:36:57	Name: uid Value: 2edd5e8c-f125-4589-b4ba-d8012b0986c4
.criteo.com/	1970-01-21 10:36:57	Name: receive-cookie-deprecation Value: 1
.adkernel.com/	1969-12-31 23:59:59	Name: DSP2F_3 Value: 336050
.adkernel.com/	1970-01-21 01:58:33	Name: ADKUID Value: A555155619140287292
.intentiq.com/	1970-01-21 10:51:21	Name: intentIQCDate Value: 1732521199050
.intentiq.com/	1970-01-21 10:51:21	Name: ASDT Value: 0
.wintersexpress.com/	1970-01-21 10:00:57	Name: FCNEC Value: %5B%5B%22AKsRol8ryFTgh5knFj_cKosxcsX3Op8tT4JfSUZ7zXvRSS4ef1rDCU02Ik5Nc6msT3-Zf9SYhTAkOKiFNtG2jKOiOkhqrFrfTJxuzMacfisIeA8WZ4rsFXJ0WmCy5JzU2RzFiFNxVHpBDkZizCpbFcz-6Wue_tpmPg%3D%3D%22%5D%5D
.casalemedia.com/	1970-01-21 10:00:57	Name: CMID Value: Z0Qs79HM6uoAAF2-AUQMbgAA
.casalemedia.com/	1970-01-21 03:24:57	Name: CMPS Value: 3872
.casalemedia.com/	1970-01-21 03:24:57	Name: CMPRO Value: 3872
.infolinks.com/	1970-01-21 03:24:57	Name: SONOBIUSERCOOKIE Value: 31226daa-0c5f-4e81-b7a2-63101a171f28
.wintersexpress.com/	1970-01-21 10:51:21	Name: _lc2_fpi Value: 42717b9848f5--01jdh4z1hkxpsj5yegcgx9mrbg
.infolinks.com/	1970-01-21 03:24:57	Name: IMDUSERCOOKIE Value: 4d503616-6202-4eb3-8a23-091f6d904aa6
.pubmatic.com/	1970-01-21 03:24:57	Name: KRTBCOOKIE_80 Value: 22987-CAESEAO3eACRkzdeH67GPOxARIc&KRTB&16514-CAESEAO3eACRkzdeH67GPOxARIc&KRTB&23025-CAESEAO3eACRkzdeH67GPOxARIc&KRTB&23386-CAESEAO3eACRkzdeH67GPOxARIc
.pubmatic.com/	1970-01-21 01:58:33	Name: PugT Value: 1732521197
.lijit.com/	1970-01-21 10:00:57	Name: ljt_reader Value: JuYZALZHfNBUc064S5qHGHzi
.infolinks.com/	1970-01-21 03:24:57	Name: EQVSERCOOKIE Value: 3287730146430589196
.infolinks.com/	1970-01-21 03:24:57	Name: OTUSERCOOKIE Value: WmSBORr20zD6asPq_zDGcqJvxu--cF6aUxMeQDumnKg
.pubmatic.com/	1970-01-21 03:24:57	Name: SyncRTB4 Value: 1733702400%3A220_201
.pubmatic.com/	1970-01-21 01:16:47	Name: pi Value: 156872:3
.pubmatic.com/	1970-01-21 03:24:57	Name: chkChromeAb67Sec Value: 3
.bidswitch.net/	1970-01-21 10:00:57	Name: tuuid Value: 5881a510-d043-47e2-a562-ddfcae6074a9
.bidswitch.net/	1970-01-21 10:00:57	Name: c Value: 1732521199
.bidswitch.net/	1970-01-21 10:00:57	Name: tuuid_lu Value: 1732521199
.infolinks.com/	1970-01-21 03:24:57	Name: URUSERCOOKIE Value: OPTOUT
.infolinks.com/	1970-01-21 03:24:57	Name: FRWHUSERCOOKIE Value: 494ede6209c2a7de1263b5d35c4cdd
.infolinks.com/	1970-01-21 03:24:57	Name: KADUSERCOOKIE Value: 7B9D21CE-6374-4E40-BAC4-EDE54204A2D4~1732528975239
.infolinks.com/	1970-01-21 03:24:57	Name: SOVRNUSERCOOKIE Value: JuYZALZHfNBUc064S5qHGHzi
.infolinks.com/	1970-01-21 03:24:57	Name: IXUSERCOOKIE Value: Z0Qs79HM6uoAAF2-AUQMbgAA&3872
.media.net/	1970-01-21 10:00:57	Name: visitor-id Value: 3755227991978308000V10
.media.net/	1970-01-21 03:24:57	Name: data-inf Value: setstatuscode~~41
.mgid.com/	1970-01-21 01:35:30	Name: lmg_usr Value: 36b81785-a931-4e3e-9dc9-75b336010b81
.mgid.com/	1970-01-21 01:35:30	Name: lmg_r Value: 13
.wintersexpress.com/	1970-01-21 10:36:57	Name: cto_bundle Value: heK4wV9ndndoWFdZdGVrOXh4SXVManFob0x4VEsyUEYyUjNIZVlSJTJGblBsb056VmlReVRSR0xybjZ6VmtLekl3UkMwVmJsbW8xMHAyekxQVnhEZU9SUEdQT1NJdzQzN29KQyUyRjJabzFYUWV6WnAzblhnZVdJYUdGTFBhcWtpY3RiaXIzWG5wNDZDWnZuZEhQTWg4S3VwRGpENiUyRjZCU2ZZQTlDeVl4S2RHY3pHOU9vNzAlM0Q
.liadm.com/	1970-01-21 10:51:21	Name: lidid Value: 0adb23e6-e6fe-4a24-ae08-90786e1c8786
.quantserve.com/	1970-01-21 10:45:35	Name: mc Value: 67442cef-4cc6e-dd1f9-0eee3
.quantserve.com/	1970-01-21 03:24:57	Name: sp Value: CgkI7ugGEgMQ_Q0=
.infolinks.com/	1970-01-21 03:24:57	Name: MNETUSERCOOKIE Value: 3755227991978308000V10
.disqus.com/	1970-01-21 10:00:57	Name: zeta-ssp-user-id Value: ua-02845a66-f93b-3aa3-acef-d2c7fcf1acc5
.infolinks.com/	1970-01-21 01:35:30	Name: MGIDUSERCOOKIE Value: 36b81785-a931-4e3e-9dc9-75b336010b81
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSsjS3NDYytDA1sDAzNbc0MTQwE-Iz1A3XNfYrcw0xcwo2cgYASNMZKyQAAAA
.rfihub.com/	1970-01-21 10:36:57	Name: rud Value: H4sIAAAAAAAA_-MSsjS3NDYytDA1sDAzNbc0MTQwE-Iz1A3XNfYrcw0xcwo2cgYASNMZKyQAAAA
.adkernel.com/	1969-12-31 23:59:59	Name: SSPR_40 Value: aHR0cHM6Ly9yb3V0ZXIuaW5mb2xpbmtzLmNvbS9keW4vMTUybXVzP3VpZD1BNTU1MTU1NjE5MTQwMjg3Mjky
.adkernel.com/	1969-12-31 23:59:59	Name: SSPZ Value: 202694
.adkernel.com/	1969-12-31 23:59:59	Name: DSP2F_40 Value: 639242
.admanmedia.com/	1970-01-21 01:35:29	Name: admtr Value: 370885a1-1116-4609-b6d5-feef930f6e10
.admanmedia.com/	1970-01-21 01:35:29	Name: ac_r Value: CS310
.infolinks.com/	1970-01-21 03:24:57	Name: QCUSERCOOKIE Value: pCkEfaB9VS-_KlMqpHsdLfYvVnC_LlUs9y2yhSCI
.infolinks.com/	1970-01-21 03:24:57	Name: ILLUUC Value: 370885a1-1116-4609-b6d5-feef930f6e10
.infolinks.com/	1970-01-21 03:24:57	Name: ZTUSERCOOKIE Value: 979321850865794106
.serverbid.com/	1970-01-21 01:36:57	Name: CONSUMABLEID Value: 8f3946ac34974e0eb946ac34977e0ece
.emxdgt.com/	1970-01-21 03:24:57	Name: uid Value: 47481732521199606480a0
.technoratimedia.com/	1970-01-21 10:51:21	Name: tads_uidp_37 Value: 7ab3aef4-d911-33ad-b24a-96acd25fac2c
.technoratimedia.com/	1970-01-21 10:51:21	Name: tads_uidp_44 Value: M3WPP6LT-1M-HUZM
.technoratimedia.com/	1970-01-21 10:51:21	Name: tads_uidp_46 Value: 8320974673051145315
.technoratimedia.com/	1970-01-21 10:51:21	Name: tads_uidp_49 Value: AQAGODYg95qTggIVjNoPAQEBAQEBAQCSYzzv8gEBAJJjPO_y
.technoratimedia.com/	1970-01-21 10:51:21	Name: tads_uidp_50 Value: dc0b19c2-4e95-42ae-b29f-a7f0b0bf2fa7
.technoratimedia.com/	1970-01-21 10:51:21	Name: tads_uidp_61 Value: 212893701593186
.technoratimedia.com/	1970-01-21 10:51:21	Name: tads_uidp_62 Value: 3755216421978380000V10
.technoratimedia.com/	1970-01-21 10:51:21	Name: tads_uidp_64 Value: otUkTkelkSWBKUwf6PhoSGzQ7Uvl5lhL
.technoratimedia.com/	1970-01-21 10:51:21	Name: tads_uidp_7 Value: fef3e266-d1d9-49bd-9c4a-a1675efeea60
.technoratimedia.com/	1970-01-21 10:51:21	Name: tads_uidp_76 Value: RX-7f7b6d42-b05a-4c2c-a760-413ca0b1eb52-003
.technoratimedia.com/	1970-01-21 01:19:40	Name: tads_uidp_79 Value: 7bd7ce92-811b-48a6-83ef-5e7f9d3e360d
.technoratimedia.com/	1970-01-21 01:19:40	Name: tads_uidp_82 Value: Z0QobtHM6HcAABGwATtiVAAA&987
.technoratimedia.com/	1970-01-21 01:19:40	Name: tads_uidp_88 Value: 1674815285988043507062
.technoratimedia.com/	1970-01-21 10:51:21	Name: tads_uid Value: 8F96CF708E744231841D68A01C851D44
.technoratimedia.com/	1970-01-21 10:51:21	Name: tads_uid_cd Value: 20241123133331+0000
.technoratimedia.com/	1970-01-21 10:51:21	Name: tads_zora Value: 2
.ads.oveeo.com/	1970-01-21 03:29:16	Name: vmuid Value: 8bd3dd135095b418
.betweendigital.com/	1970-01-21 10:00:57	Name: dc Value: was1
.betweendigital.com/	1970-01-21 10:00:57	Name: tuuid Value: 6c314a01-4363-534a-a194-bf90c6d0937f
.betweendigital.com/	1970-01-21 10:00:57	Name: ss Value: 1
.33across.com/	1970-01-21 10:00:57	Name: 33x_ps Value: u%3D212675202499225%3As1%3D1732521199605%3Ats%3D1732521199605
.contextweb.com/	1970-01-21 09:53:45	Name: V Value: 53tUTkXEYls3
.contextweb.com/	1970-01-21 09:53:45	Name: VP Value: part_53tUTkXEYls3
.contextweb.com/	1970-01-21 10:00:57	Name: pb_rtb_ev Value: 3-1uyq\|8vA.0.1
.contextweb.com/	1970-01-21 10:00:57	Name: pb_rtb_ev_part Value: 3-1uyq\|8vA.0.1
bh.contextweb.com/	1969-12-31 23:59:59	Name: INGRESSCOOKIE Value: 8ee65ce700bdb2b0
.colossusssp.com/	1970-01-21 10:00:57	Name: gtm_usr Value: df646f37-58a3-4caa-b9c7-9aca307cd1db
.colossusssp.com/	1970-01-21 10:00:57	Name: lmg_r Value: 99
.betweendigital.com/	1970-01-21 10:00:57	Name: ut Value: Z0Qs7wAJoNg4qh-KlTSFlZE6InEW14up6WgFdA==
.infolinks.com/	1970-01-21 03:24:57	Name: CONSUSERCOOKIE Value: 8f3946ac34974e0eb946ac34977e0ece
.inmobi.com/	1970-01-21 10:00:57	Name: TEST-COOKIE Value: YES
.infolinks.com/	1970-01-21 03:24:57	Name: OVEUS Value: 8bd3dd135095b418
.infolinks.com/	1970-01-21 03:24:57	Name: COLSUC Value: df646f37-58a3-4caa-b9c7-9aca307cd1db
.infolinks.com/	1970-01-21 03:24:57	Name: IMDSUC Value: 8F96CF708E744231841D68A01C851D44
.infolinks.com/	1970-01-21 03:24:57	Name: PLPOUSERCOOKIE Value: 53tUTkXEYls3
.csync.loopme.me/	1970-01-21 03:27:49	Name: viewer_token Value: 0449431c-1600-4226-86f0-67a5dca23f0e
.infolinks.com/	1970-01-21 03:24:57	Name: 33AUSERCOOKIE Value: 212675202499225
.inmobi.com/	1970-01-21 10:00:57	Name: iid Value: ID5-5-8fb52ff2-9cd4-48ad-a431-c3508ab9be0c
.infolinks.com/	1970-01-21 03:24:57	Name: LOPMUSERCOOKIE Value: 0449431c-1600-4226-86f0-67a5dca23f0e
.infolinks.com/	1970-01-21 03:24:57	Name: INMUSC Value: ID5-5-8fb52ff2-9cd4-48ad-a431-c3508ab9be0c
.ingage.tech/	1970-01-21 01:15:28	Name: instUid Value: 58004e40-28ff-4eab-9ade-17bff5b59eff
.ingage.tech/	1970-01-21 01:15:22	Name: __cf_bm Value: bklsF7UDxiDRsvm3VbKeGwjDqIur1fzQ_H3FbHWfWe8-1732521199-1.0.1.1-3qr.jvMhzjx5.6D4IQhNE7gdGWVh8Qd5.6xLeqaA0_YUuVMcIg4KVYRSCh5RbQJ78XBfaVlRVpHWx._YROxvrQ
.infolinks.com/	1970-01-21 03:24:57	Name: INSTUC Value: 58004e40-28ff-4eab-9ade-17bff5b59eff
.infolinks.com/	1970-01-21 03:24:57	Name: QORAUSERCOOKIE Value: A555155619140287292
.rubiconproject.com/	1970-01-21 03:24:57	Name: receive-cookie-deprecation Value: 1
.infolinks.com/	1970-01-21 03:24:57	Name: RBCUSERCOOKIE Value: M3WQE03K-B-71G
.adsrvr.org/	1970-01-21 10:00:57	Name: TDCPM Value: CAESFAoFdGFwYWQSCwjO9N-ciMzGPRAFEhYKB3J1Ymljb24SCwiC_ue0iMzGPRAFGAEgAigCMgsI0OriyZ7Mxj0QBTgBWgV0YXBhZGAC
.amazon-adsystem.com/	1970-01-21 10:51:21	Name: ad-privacy Value: 0
.bidr.io/	1970-01-21 10:43:51	Name: bito Value: AAn6U07OiFoAABd0whUyuQ
.bidr.io/	1970-01-21 10:43:51	Name: bitoIsSecure Value: ok
.yahoo.com/	1970-01-21 10:01:18	Name: A3 Value: d=AQABBPAsRGcCEBCmeXFLvzHuUC_vPcbsImAFEgEBAQF-RWdOZwAAAAAA_eMAAA&S=AQAAAkSj-hl2I4pT3SesT-tCgyQ
.linkedin.com/	1970-01-21 10:00:57	Name: bcookie Value: "v=2&75bd1112-6907-4fc0-8956-d1de0d7bb528"
.linkedin.com/	1970-01-21 05:34:33	Name: li_gc Value: MTswOzE3MzI1MjEyMDA7MjswMjHaPqtSAybGN2YTEVNn8NqiaChlWmfc/yeIurc9AkfCMA==
.linkedin.com/	1970-01-21 01:16:47	Name: lidc Value: "b=VGST02:s=V:r=V:a=V:p=V:g=3382:u=1:x=1:i=1732521200:t=1732607600:v=2:sig=AQHfzLRexTZXqrbc2TMzkgbAsUVPCiMg"
.wintersexpress.com/	1970-01-21 10:51:21	Name: _ga_4T2EB147B8 Value: GS1.1.1732521197.1.0.1732521200.57.0.0
.lijit.com/	1970-01-21 10:00:57	Name: _ljtrtb_80 Value: M3WQE03K-B-71G
.ipredictive.com/	1970-01-21 10:00:57	Name: cu Value: 58185c26-6a08-43fb-99c2-7abf43880eba\|1732521200910
.primis.tech/	1970-01-21 01:51:21	Name: csuuid Value: 67442cf0e7212
.yieldmo.com/	1970-01-21 10:00:57	Name: yieldmo_id Value: VFx21JJBD2J_xICEhrKQ%7C1732492800000%7C0
.rfihub.com/	1969-12-31 23:59:59	Name: euds Value: H4sIAAAAAAAA_-OSMXR2dA129c31NjTwCDNLCYsot3RN8YosyEpJCwUAU482dB4AAAA
.rfihub.com/	1970-01-21 10:36:57	Name: eud Value: H4sIAAAAAAAA_-OSMXR2dA129c31NjTwCDNLCYsot3RN8YosyEpJCw3iNTQ3NjI1MjQyMDQwMXvFiMpfJQ7jG1paGhuZAwCe0aCwTQAAAA
.intentiq.com/	1970-01-21 10:51:21	Name: IQPData Value: 2809319783#1732521201047#0#1732521199050
.intentiq.com/	1970-01-21 10:51:21	Name: CSDT Value: UEQ6MTUxMDZfMCZVVjdpT2hVIzE1MzI0XzAmVVY3aU9CSA
.travelaudience.com/	1970-01-21 10:44:09	Name: _tracker Value: %7B%22UUID%22%3A%22B0D6BB4C-45E1-46C9-3CB2-E684C3706E0E%22%7D
.pangle-ads.com/	1970-01-21 10:36:57	Name: _pangle Value: 2pKiWjtPMQxSbj3xiRR01o4RBmD
.mediago.io/	1970-01-21 10:00:57	Name: __mguid_ Value: e94ce74fa932b3352kpnyj00m3wqe2ea
.amazon-adsystem.com/	1970-01-21 06:29:16	Name: ad-id Value: A5azXqb2nEkgiNyZk7M2mnI
.rubiconproject.com/	1970-01-21 10:00:57	Name: audit_p Value: 1\|C0mnpwYb8FEkn5fK/9Qtd2+o9tFjVplXsKxig/BBn9B3rhL5Alyh5+ckBgjI09a+8CbSL4XugAJCbuL7wqM7W24/AOYgyMTzmjbisE4m2Mfme0rGRDIQp3kPQ/M2AgL5q+Rc8WYCPYbaBy7WOHgM3ccocQT6qPOJfY0V14FIbwNNc4QTpadywl9byk9TjXUW
.rubiconproject.com/	1970-01-21 10:00:57	Name: audit Value: 1\|C0mnpwYb8FEkn5fK/9Qtd2+o9tFjVplXsKxig/BBn9B3rhL5Alyh5+ckBgjI09a+8CbSL4XugAJCbuL7wqM7W24/AOYgyMTzmjbisE4m2Mfme0rGRDIQp3kPQ/M2AgL5q+Rc8WYCPYbaBy7WOHgM3ccocQT6qPOJfY0V14FIbwNNc4QTpadywl9byk9TjXUW

12 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.wintersexpress.com/shared-content/art/stats/common/tracker.gif?tnms_rs=1600x1200x24&tnms_vtum=1&tnms_vt=1&tnms_vid=1732521196675120120160012001287666008336&tnms_dt=wintersexpress.com%20%7C%20Winters%20Express&tnms_upage=1&tnms_do=www.wintersexpress.com&tnms_uri=/&tnms_ref=&rt=1732521196677 Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://www.wintersexpress.com/tncms/csrf/token/ Message: Failed to load resource: the server responded with a status of 429 ()
javascript	error	URL: https://www.wintersexpress.com/ Message: Access to fetch at 'https://id5-sync.com/bounce' from origin 'https://www.wintersexpress.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
network	error	URL: https://id5-sync.com/bounce Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.wintersexpress.com/ Message: Access to XMLHttpRequest at 'https://id5-sync.com/gm/v3' from origin 'https://www.wintersexpress.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://id5-sync.com/gm/v3 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.wintersexpress.com/ Message: Access to fetch at 'https://id5-sync.com/bounce' from origin 'https://www.wintersexpress.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
network	error	URL: https://id5-sync.com/bounce Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.wintersexpress.com/ Message: Access to XMLHttpRequest at 'https://id5-sync.com/gm/v3' from origin 'https://www.wintersexpress.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://id5-sync.com/gm/v3 Message: Failed to load resource: net::ERR_FAILED
security	warning	URL: https://resources.infolinks.com/js/1970.003-4.011/in_search.js Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
security	warning	URL: about:blank Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

846d83c2930c516597075cc9390fed92.safeframe.googlesyndication.com
a.ad.gt
aax.amazon-adsystem.com
analytics.google.com
api.intentiq.com
api.segment.io
bcp.crwdcntrl.net
bloximages.chicago2.vip.townnews.com
c.amazon-adsystem.com
cdn-ima.33across.com
cdn.hadronid.net
cdn.id5-sync.com
cdn.jsdelivr.net
cdn.prod.discovery.evvnt.com
cdn.prod.promo.evvnt.com
cdn.prod.uidapi.com
cdn.segment.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
config.aps.amazon-adsystem.com
d-code.liadm.com
d.turn.com
discovery.evvnt.com
ep1.adtrafficquality.google
ep2.adtrafficquality.google
esp.rtbhouse.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
googleads.g.doubleclick.net
gum.criteo.com
id.hadron.ad.gt
id5-sync.com
ids.ad.gt
ids4.ad.gt
idx.liadm.com
image2.pubmatic.com
imasdk.googleapis.com
invstatic101.creativecdn.com
lb.eu-1-id5-sync.com
lexicon.33across.com
match.adsrvr.org
oa.openxcdn.net
p.ad.gt
pagead2.googlesyndication.com
pixel.tapad.com
pixels.ad.gt
proton.ad.gt
resources.infolinks.com
router.infolinks.com
rp.liadm.com
rp4.liadm.com
rt3060.infolinks.com
s3.tradingview.com
secure.adnxs.com
secure.cdn.fastclick.net
securepubads.g.doubleclick.net
seg.ad.gt
static.criteo.net
stats.g.doubleclick.net
sync.go.sonobi.com
sync.intentiq.com
tags.crwdcntrl.net
td.doubleclick.net
token.rubiconproject.com
tpc.googlesyndication.com
u.openx.net
www.google-analytics.com
www.google.ca
www.google.com
www.googletagmanager.com
www.tradingview-widget.com
www.wintersexpress.com
ep1.adtrafficquality.google
id5-sync.com
104.16.132.24
104.17.24.14
104.18.29.101
104.94.117.85
108.138.70.84
142.250.31.155
142.250.31.97
142.251.111.100
142.251.16.156
142.251.16.94
142.251.167.94
15.197.193.217
162.19.138.117
162.19.138.83
172.253.115.105
172.253.122.156
172.253.63.155
172.66.42.247
18.160.10.17
18.67.76.20
192.104.182.109
2001:4860:4802:36::181
23.20.101.159
2600:1f18:730:b110:1eec:45ae:7d5c:c1ff
2600:9000:2073:3600:1b:6b7d:2300:93a1
2600:9000:2073:6000:1c:2afd:fb00:93a1
2600:9000:2199:6400:a:e047:754:f4a1
2600:9000:2199:d000:18:a82e:7180:93a1
2600:9000:2305:a600:8:4487:bd00:93a1
2600:9000:2305:a800:8:4487:bd00:93a1
2606:4700:10::6816:34ad
2606:4700:10::6816:445
2606:4700:10::ac43:17ea
2606:4700:10::ac43:266a
2607:f350:3:2569:0:10:0:c
2607:f8b0:4004:c06::84
2607:f8b0:4004:c08::5f
2607:f8b0:4004:c08::8a
2607:f8b0:4004:c17::84
2607:f8b0:4004:c17::9c
2607:f8b0:4004:c19::9d
2607:f8b0:4004:c1f::5f
2607:f8b0:4004:c1f::66
2607:f8b0:4004:c21::61
2607:f8b0:4004:c21::84
2620:100:a00b::12
2620:100:a00b::4
2620:112:f008:200::101
2a04:4e42::485
3.167.69.118
3.167.98.152
3.227.77.161
34.102.146.192
34.111.113.62
34.96.70.87
35.163.144.222
35.190.39.111
35.244.159.8
35.244.193.51
35.81.219.226
37.19.207.34
54.164.90.29
64.233.180.155
68.67.160.184
69.173.151.100
8.28.7.83
99.84.208.21
99.86.191.237
05e77dab19940dd457e00282837faecc886434cc8cc5f631575a5e6c386de774
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
0b5ae21eac1a31d5486e8ae0df768b63de6670d17855568eaa3118a747778c19
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0ddba0922a45957701891711e9f25d998cb23fc853271bba573dc0bc96dc64fc
0ee7d90acfcf61e37a67097a1f97ddb90fd685f3e9dcb6ed34931f2b94713d8d
129151ed0140041b198ce3b364a11861a3b5baa5bb60475ebf7bedb9b0fc94d6
12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254
13860d9a3ef014c4e77e4ef585e1ca512fc6e3cf6a05f85e411fce70f5873141
15a84b19341f0d72d23c8448cbb52e22631a48bee328f0f30ffe1ef4875c2ebc
1635d2075d3343c86490d2229c1fb868ad59d92958ef65e04cb65767c703e9f6
1672054d64fb96cb8e4564615657184ed3d7fb33c4ffbd252d9acf9a36264f95
1764e898369c24be8d7d1cbcb82079c27f3898fbc1883f388a5c1008dd30c9e8
1dda385aef934f6e0f667cd38b8c28c3a1c099abd8aa504a16b30b69e0637428
1e6807edce0b29407094360025d2e6c1e9cc5e4119f08eecc0e6bc5075c7afab
1ec96c782faf1fd9712c5948e37b0b34a82b3771a2272c6e95ac24b90935578f
2027d1787b66ef290a0e9901721bc22309600eb642bfbfb625e8f9ac3e23b759
252904bb838e1fb52a44c23792b4f5395783fae0ce1e9fa1d02f307c7657d1b6
296ffff5be5fa17a541df8e925d24e473ced64d535f543542bebc15759b761fd
2a514fbb52956f623e0a80bdb74df6608efe564e1ccfc7fdf10705baf917750c
2a6189f8ee4035f048eaedb4744ef6300f362a90a1f7aa6906edeac2e8e49eb4
2aaaf8171a701189f4fd0e480156dec1d2c5856cf81f3d24756faf431f061a1f
2fce813d11267f16b2fc0a5c71b3f660efef3bc1501dd5762d64cfa12731a88c
30b32e97f2e3e06deb742bf2e19daeb4f4657a956e836c2a25a7df2bc72f7500
31892c21ae4fb908a875bbe29dbf0df74c2e84171cfbcac23540f3ad8222a35a
34dd39ca5c8799cba74edb6835a6db8ee2e2a588130add89bc6260cde1219a52
36218c17023a11d958a1b9acf3782e04e7700b1045ee594a58b305cff8dab9b9
37d44df61428260da98324576010ebd04c0d5a1ce6774bbed15bbfbdfc141a0c
3a0adc6c0365fcdf6401e1b64ce76a72ad0cf4fcc4c1d717f0c485e4c9bb30f9
3a640e9eca4059f8a87f5815bce61c6799babfc358762166e398eb599a96959f
3bdc29109b621ad2c793d86fdc3f61e810d4aeafc3b8419f8f2aeb9c7ce0d364
3bf4f940a69cf7d1af0797f0371ddae937a8274190b22ebe165f0f7223b0e670
3c54d182acc0386729c7c8d502abecb6ca96c29794ffb1149c50edffb24c71a6
3d05096c2a13ec3370b57c4fcac3e66906deb13f85728d4f66c19949b3415fec
3de72960e19da7e5aefea643b35ec1c1bfb9770e6fefaa3e1f30c33a6d0c3685
3e5d4f2cbb3948d73f8ded1de3dba8b7d8b18dd04ed5ad4f59b2acbef9f167c9
3eb03286cfecb19f6e1290e06e301e8aa08ad44f7b6503ef50d1c81cc2dffbc5
429c09ef872b45d80fa51a8ed156e581ed31fd094c179e4d6dd1d3f1bf18f20b
435b1ece4a55f4f8d06866b32c1aee3cc4661eb905265894795f15a57bf1b33d
438b495b58aff2c18739f6ac7b88c6b857b51b5beef4070832cd77b901540cd5
43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff
448e1a4179ffa476609ed1e8909867082486239c06fb2e277f7843e3269d427b
458af683b8dbd6454c2ab93f5d228801d4c9edb8a8a8930c28563c6406a849f3
45b1551d108bf6c7e80dfa083a293ae5467d720227cf680f0348b5821f5ac374
45f1b654ec61c60215f597e30df063b0fee38c8a42f7046f99bf9bf3376971dc
46311b08c6775f4a3598bec2532b2767d4c9ef866b8af6399e6cfa57079c4c38
47220c4c850d2a71293522af7071da5706951e1cecc6dddce7bc78343f48de1e
4908103eb097a575d25aecab0b105c51313e35ce211bb70d82ea0ce6e75ed2b3
492db2ca577f4d221e3e28239c19e7db05f1701b298bf278fc4d1fcb92563586
4a0cd0f521435487b3c84c790aebafaffa89f22e5a58959e1e1ac44abac17431
4b093bf8fe11ce768e5543697030a064da71b347431594daf7efb86f94a201c0
4bacb894ffaca1f46145cb872ef65ee9b8a18341c296c4c1c3f6609266891e12
4e1ad9009b927e35bc8d997f2bd7ad0ce3fced1ed3ede5279bc63853b023fa86
50eea9da4f4a1b43ff0b25615da2dcf7dcb6fd9173b4ab1b472663d204acc258
514e5a7257d3f4823ba63d457f53ba3659e7fdb2f18d99da9daf0a615bda8440
5173b4d675defadf69b4164310fe856f6d8f002695e9e4bd259862a1b7b01cb2
5399dd664069ceeea8667991398b745cf5eddf8ac2f8bfb638d70dfc13d9dd07
541df9709e639a31e400f0b9d0255d2b096ec4cefefe496c38450b96f6e7ff0e
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
557c67c76c13a84e8b483ee1a0dfdd807399d960909266e7c6a83ddfadca9c81
55d34a887dca0076789b740d486f5914396e2b8951caa8d3f48900582cbd0977
55ecbba63a08d0f60cfe9da13af30f1e0c3aa69bce0705828c2d249085ada589
56274ad982a24770370b1a8e9e1623f67d391d29fe822c6d72f63c80f9ec3e7f
58f4eda94248d1e320dea3ea133e130ff1951ea42d0e092122e45dd36df1fed9
5973328c7a47736227218616372ba3ac2284bc56aeb4a5d96be40a627a2f695c
59855ab21479dde905cf48ff3e82c9c15fcf97c96f99276952e263ede1f58916
5b012409edbcd903043eebec6b10090d195a2e324fb4b7fe5f37e26135219dd9
5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08
60ff7e6a931797ade90b7e2ffee8bcb15b6463b47b48299377f463c59ff23ef2
64d2ce701b1f0b1d910bff7f252ae7a53d5f90cf3efb970163811c757b889d57
6696ed43d6d776de48975f4c28e254e10917c6af9e789d85a0747dd0df73b011
679efbb3d57180134b17a7588e21434311cd215ad954a9716216b5e26c4189cd
6af1d81975e307f4f1bf7f8e1cec7c374cb12471c871b3e5f1a868df4e6c7184
6cacbac181ea7b10547c7c001f30cc674f47321d227672dffa3b862a77f09c8f
7116e73e282e128b2827e5e618b27f80ea54502476ce62c583785e1e48f0b34f
7458edd9b7b53f7b32c80f4856a8a0d1c4b7557c589f7c6b860c30a43829ac3a
778ddd4dd74db059c0b76267e415e95fca61d5396f6d485e3d7a75028f371fbd
7834d7d1a04f735530e24e6fe9b6b7ca55591c6eefb068d22b568b095e18b716
78680443b8482ebd2d59d90323f15e53781a62b25ca7d2452d25eba4f631aaff
7ae3c9adc871688ead37386c3e23c75e07568f077ab4851da3c8c8914362868e
7f4049e8923ddb3b759697aebae3d69181b42fa677abba4d875f4a1ba7beff89
809111d7ccdcd1d1db57c493c9291fab54dd753cd62c1d3d9e96d4164c925cd0
80f074e9be412b958715081710266bb3b8cd89550bf21ec03c7e13ec36073c1e
820b5f698595fdd1cc6c8603eff1d20ebd4bffeacadde63f6979911de705f6c0
839e11d5ea35fe60fd65d0da091762640d7b98144b58f553a8742d863bc60795
83e269d9ebe58bd5f2879e6455046b42e718e388c5c933b0c32d1767bac6a904
89ae1743656b75948be30cc4909efd3c61771b7bd9f6d53eb14cd9731d486b57
8b8506928501a437418ca18498b5fcbd474b0c4bfc96b438bc9e09baa53adce5
8c622e6e1126cb3c4c6bd2af17186a3c0738e89f59507f8c57227ff4aad3f612
8cd455f2a1cfc7b9e95833204dad2ac12dc465312607b7cffb9de864ce035ad5
8cf6f020c4fe1dfc77d6ad29dfe4c4591e317d397baf3ee31edaf44ce3da098a
8d2678ff0715284456a48f52fa21c43a417bea04bcb4b6fcd516ab11dc047192
8dead0a117fea5970954d57aedeaceed0892f625167b611af70c0de5ba5ba2c3
8df5c96e35652aabff552b369a84a4284a28eb19a9419de62d103801b35b21a9
8e2e76a2c8f2f6f9c896fbb1ce20d97d0b72045e6ed931e7886041cad6ccc52e
8f60c8e46ff2161132091c8bdaf0628c161918a67a1d65854c21bc6bdff7eb91
8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d
93eac8b1fb14d0863561633dfdf563013c023393aabfb122e3be7256629d9235
944a37f694b55de268a0bf52dbae4e12f12c4ae09ee5c8d213ba05075c2865dd
95ef68ed59b460d83ce14aadc7b21dd0b267e6331ca2a561f51256d7c7038b7f
960fd21cbf90bff7c4d4c58f8bb70000683e93504ef9042e417b8a3b982ff9e8
977bd6573db0c146bae702f95e3af7a1f5d00899c3c9fb1afff078a71a893149
9cff82a35dc75fb0dc6e967417b2901887356bfcc4bddc211feb2fe55c4ef5f6
9d655a64bb99a6e14f79f3fdd9ba33433979e90070b5393fa0f5028966da4d5b
9fe769bfc93145d27bc2efa853ca49895d7a44af9c5dd2566c3233b66c9d14b4
9ffa45453324362cbc5cc78288e04513100c2d61baf3a969717ea5df3d0dbb39
a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e
a73c1339e9733df332038af7288d412dde2a2c650d99c2a4169484c4c702d950
a77683cc59e081980f341379634accbffbd7ae20e6b53988df23fae02d1e5af0
a8dd5310f1564e14e30c03c9c260a31c490ce92ac9b5123d50dc2af9193a485f
a8e394af1a49c3a2cbb6d8476b62b1ac14fda7fafffae0db03df202f818c6871
aa4391f03da55de95caebed478d3e1183fb01a3e8f1c5891a48e75717ed2bed9
ab2ce7a605858febda81cd3408ddb9897e109b417d514d9c12cf0e1a89658ae4
ac7122884b38204552690d708b153eb45da3022bf418101c778f72c482d2a194
ac78a65e854b0b27cf82d07a92bcdeb62fbda95e8987656b76540a3cb81ce08d
af911cd0b69092767985f5342a6b3c6971ea52df38adcb35e8bb30430dfc0f9c
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b07d02c8ede625dd16b97254a7d58fb54d63c5906d0c9390a494998d99d495ba
b15dec3d30115400e55a13974894241063aeb3500c18474e50a0b1fca5226e02
b251749e04ba1d0a4dcd53781ebf83415823829c9f36ee5102372f98ab40d8a2
b4ae6f9c190a587611393357e1ef80131bdee6a1b62cfe786167a87f7fa38d8d
b58afd1c343ecc242a39f65193fb69135edf92aabb8784816aa8301ab7865fe3
b6325f88b44aca54eccdb053f48f095be90b97336ea75141feda9b088bfc14a0
b78d297615e175f921ea0444a6d2e6b6f9f810c44acd35f48a278623fef3e677
b95fe6fcb4925330bf629fda90a1362a336b4a8b87bf9573d87927d78c186062
bad3f4a20b737202b4cb52ce0124a2ae5d54be0002feb42790867ee446425332
bc40838a707dba656095bdce002939c726b0fe7de618b613ff3a29a39aef0938
be264be208f4320ddbab1ae6bf6d5556b7efb13e37f29e26ac5202222ad6ca7e
c016ae81681aa024b9f246d58196402fa80d99d08402ebd00fef802803ea366b
c0b5dfb7fdb5fc92bb0a9b997b8f1c72eb4ae3e0f7b7c308c71c03ce299e02ad
c0bc803ded3eb30a6da6c3a037589f7554a759eb01357fe52de1adc19193d87b
c52b9a30cb5d84dcfb2a4f9967f37abd86c3e709554ed4f168a03222e033bb93
c61fcc1401e2278735bea5d306ca0cc32b93ccdf62ec8179ed0c999545b5502b
c7b9fa70e938248d77e1f1ee044eb34307b4ffe78e77d9d0637d8a07363388fd
c8d068269c9e28500717132d2ac92d922b218e7cc920d18f5b4d8d3d7c50f60c
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cf3e21aad61783d6e6908e5631c43656c05a34a9c7f64eab44dcd7fc58562aa8
cfef577828ce1c4938cba233349fdb3cd5fcaac42bc919ccc976f892a19018df
d036d654e0622364d1afd83a7d7f4badf6c0efd242e3bd1476b225f1d4971581
d1955c7004fb7e187c686837acd2ef206e17381beea159d58786ccda164c513f
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
d2ecd417b587e339d8454ffde22329d9b753340fa08b4b5f1427f4899b7d9ec6
d31a20c7aa35343affd5eaf512e5fdb532bdf6211a22aafd620358a0bc3b5150
d4f9f58109ef96d36ca52f8bd18a21b75340937871d95cec6e11ed6a7370e6ab
d50881e8cf2ac03741c7c31b98dcabdf91d458ed76766efc511b26a2b796dd0f
de713a96c9cd834b5c18f79743b62bd50c534bff732e265ca0b8d215c7fda9aa
e1c35b709f85d2f8fcbe980f34cd2e8cceebcf578928fb274c4419bb39e83c09
e2ff429aac35e1b55d4b5e1e299237b84fd6469fa4abc13770b2896981fdb050
e31c42447e764b1195ff393437950867800ce2465dd3724c95640f4f5b34487c
e32cc4f4194010d53238f1ea3483aa3cd1b272630e87730057bc5f57389d2a53
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e49c23480a4201c1ceda93745f113687ac437311eb8d8c48e46dfe50311092e7
e790d4a8d8aa7e73e8a014f77dc25e8e5d7e717a24c273ea01f53eba41495bee
eb84aa93d407741c01d2655b587a6de47bad9046e89d37e97fabd629d85cb76a
ec6e69b151d4572666e72a5325d27be9590d9b2ddeca17bf3a197ad496af008d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
efb4c7a950bf4f16b1e83d9c57ba2bc27569230487d4853db37900a15143dd7d
f1c47b530099b2d4785e3e97e6d84c67a1fef2563fe7499715948fd060a80e68
f30673a2e4a0eac691ae17c3bfd089302541e12f45ade488f4919f70dc42f681
f8fb86afe5b79eaff2c4a5a44459de5444d04a7b395fd7bd627e70b95e5e5347
f9a805141d588150c5edf51153e94504ea61a2db7d47920ea89b9c310cddae0e
fdfa5618d1b43e123fa394f1f52a20379ff4eabca85c9db42852842ae869fff5
fefad5f6070dc4f588391d1328cfe1927a0387a96e395b94f448e4bc4118dda6
ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

www.wintersexpress.com Open in urlscan Pro 192.104.182.109 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

238 Requests

92 %HTTPS

40 %IPv6

43 Domains

73 Subdomains

61 IPs

3 Countries

4300 kBTransfer

10719 kBSize

173 Cookies

13 Outgoing links

Redirected requests

238 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.wintersexpress.com Open in urlscan Pro
192.104.182.109 Public Scan

Screenshot
Live screenshot

Full Image

238
Requests

92 %
HTTPS

40 %
IPv6

43
Domains

73
Subdomains

61
IPs

3
Countries

4300 kB
Transfer

10719 kB
Size

173
Cookies

238 HTTP transactions
7 data transactions