blog.jonlu.ca Open in urlscan Pro
2606:4700:3108::ac42:2b57 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blog.jonlu.ca/posts/safeway
Submission: On December 08 via manual (December 8th 2022, 9:18:11 pm UTC) from US — Scanned from CA

Summary HTTP 109 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 33 IPs in 2 countries across 34 domains to perform 109 HTTP transactions. The main IP is 2606:4700:3108::ac42:2b57, located in United States and belongs to CLOUDFLARENET, US. The main domain is blog.jonlu.ca.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 11th 2022. Valid for: a year.

This is the only time blog.jonlu.ca was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
17	2606:4700:310... 2606:4700:3108::ac42:2b57	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:3865	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2607:f8b0:400... 2607:f8b0:4006:824::2008	15169 (GOOGLE) (GOOGLE)
2	2606:4700:440... 2606:4700:4400::ac40:9a0b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	199.232.196.134 199.232.196.134	54113 (FASTLY) (FASTLY)
1	2607:f8b0:400... 2607:f8b0:4006:809::200e	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c08::9c	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:809::2003	15169 (GOOGLE) (GOOGLE)
19	2600:9000:24f... 2600:9000:24f1:6800:6:8656:f5c0:93a1	16509 (AMAZON-02) (AMAZON-02)
8	151.101.0.134 151.101.0.134	54113 (FASTLY) (FASTLY)
6	2600:9000:220... 2600:9000:2209:9600:4:b4b9:d3c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a04:4e42:400... 2a04:4e42:400::729	54113 (FASTLY) (FASTLY)
2	199.232.198.49 199.232.198.49	54113 (FASTLY) (FASTLY)
2	2a03:2880:f01... 2a03:2880:f012:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
2	2607:f8b0:400... 2607:f8b0:4006:823::200e	15169 (GOOGLE) (GOOGLE)
2	199.232.192.134 199.232.192.134	54113 (FASTLY) (FASTLY)
2	108.138.128.110 108.138.128.110	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4006:824::2002	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f11... 2a03:2880:f112:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2607:f8b0:400... 2607:f8b0:4006:821::2004	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4006:808::200d	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:817::2003	15169 (GOOGLE) (GOOGLE)
1	199.232.196.64 199.232.196.64	54113 (FASTLY) (FASTLY)
2 3	108.138.106.51 108.138.106.51	16509 (AMAZON-02) (AMAZON-02)
1 4	107.178.254.65 107.178.254.65	15169 (GOOGLE) (GOOGLE)
1 3	54.147.12.232 54.147.12.232	14618 (AMAZON-AES) (AMAZON-AES)
1 1	34.200.201.129 34.200.201.129	14618 (AMAZON-AES) (AMAZON-AES)
21 36	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
4 4	142.251.35.162 142.251.35.162	15169 (GOOGLE) (GOOGLE)
1 1	34.98.67.3 34.98.67.3	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	104.18.102.194 104.18.102.194	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4 4	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
3 3	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	74.121.140.14 74.121.140.14	30419 (MEDIAMATH...) (MEDIAMATH-INC)
1 3	52.46.143.56 52.46.143.56	16509 (AMAZON-02) (AMAZON-02)
4 4	68.67.161.208 68.67.161.208	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	199.38.167.131 199.38.167.131	54312 (ROCKETFUEL) (ROCKETFUEL)
3 3	2620:100:a001::c 2620:100:a001::c	19750 (AS-CRITEO) (AS-CRITEO)
2 3	107.178.246.49 107.178.246.49	15169 (GOOGLE) (GOOGLE)
2 2	52.41.79.126 52.41.79.126	16509 (AMAZON-02) (AMAZON-02)
1 1	3.229.38.178 3.229.38.178	14618 (AMAZON-AES) (AMAZON-AES)
1	54.80.144.2 54.80.144.2	14618 (AMAZON-AES) (AMAZON-AES)
1 1	72.247.65.183 72.247.65.183	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.18.20.134 104.18.20.134	13335 (CLOUDFLAR...) (CLOUDFLARENET)
109	33

17 2606:4700:3108::ac42:2b57 (United States)

ASN13335 (CLOUDFLARENET, US)

blog.jonlu.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
j.jonlu.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:3865 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:824::2008 (Nutley, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:4400::ac40:9a0b (United States)

ASN13335 (CLOUDFLARENET, US)

jonluca.substack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 199.232.196.134 (United States)

ASN54113 (FASTLY, US)

jonluca.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:809::200e (Nutley, United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c08::9c (Ashburn, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:809::2003 (Nutley, United States)

ASN15169 (GOOGLE, US)

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2600:9000:24f1:6800:6:8656:f5c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 151.101.0.134 (United States)

ASN54113 (FASTLY, US)

disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:9000:2209:9600:4:b4b9:d3c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

substackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::729 (United States)

ASN54113 (FASTLY, US)

js.sentry-cdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 199.232.198.49 (United States)

ASN54113 (FASTLY, US)

a.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:8:face:b00c:0:1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:823::200e (Nutley, United States)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 199.232.192.134 (United States)

ASN54113 (FASTLY, US)

referrer.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.138.128.110 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-128-110.jfk50.r.cloudfront.net

cdn.viglink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:824::2002 (Nutley, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f112:83:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:821::2004 (Nutley, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:808::200d (Nutley, United States)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:817::2003 (Nutley, United States)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.196.64 (United States)

ASN54113 (FASTLY, US)

glitter.services.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 108.138.106.51 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: server-108-138-106-51.jfk50.r.cloudfront.net

live.rezync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 107.178.254.65 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 65.254.178.107.bc.googleusercontent.com

pippio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.147.12.232 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-147-12-232.compute-1.amazonaws.com

io.narrative.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.200.201.129 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-200-201-129.compute-1.amazonaws.com

obgpm76tt0a0sgozk8l.npdredinuid.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

36 35.190.60.146 (Kansas City, United States) 21 redirects

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ei.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rc.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.35.162 (United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s78-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.67.3 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 3.67.98.34.bc.googleusercontent.com

tags.rd.linksynergy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.102.194 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

p.adsymptotic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.33.220.150 (United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.98.64.218 (Kansas City, United States) 3 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.121.140.14 (Reston, United States) 2 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.46.143.56 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 68.67.161.208 (New York, United States) 4 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 199.38.167.131 (United States) 2 redirects

ASN54312 (ROCKETFUEL, US)

p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:100:a001::c (United States) 3 redirects

ASN19750 (AS-CRITEO, US)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 107.178.246.49 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 49.246.178.107.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.41.79.126 (Boardman, United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-41-79-126.us-west-2.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.229.38.178 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-229-38-178.compute-1.amazonaws.com

usermatch.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.80.144.2 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-80-144-2.compute-1.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.247.65.183 (New York, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-65-183.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.20.134 (None, )

ASN13335 (CLOUDFLARENET, US)

idsync.reson8.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
36	rlcdn.com 21 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 334 ei.rlcdn.com — Cisco Umbrella Rank: 2195 rc.rlcdn.com — Cisco Umbrella Rank: 2305	3 KB
21	disquscdn.com c.disquscdn.com — Cisco Umbrella Rank: 4680 a.disquscdn.com — Cisco Umbrella Rank: 9417	783 KB
17	jonlu.ca blog.jonlu.ca j.jonlu.ca	156 KB
13	disqus.com jonluca.disqus.com disqus.com — Cisco Umbrella Rank: 1021 referrer.disqus.com — Cisco Umbrella Rank: 6967 glitter.services.disqus.com — Cisco Umbrella Rank: 11245 links.services.disqus.com Failed	117 KB
7	google.com analytics.google.com — Cisco Umbrella Rank: 354 apis.google.com — Cisco Umbrella Rank: 92 www.google.com — Cisco Umbrella Rank: 2 accounts.google.com — Cisco Umbrella Rank: 75	46 KB
6	substackcdn.com substackcdn.com — Cisco Umbrella Rank: 21910	624 KB
6	doubleclick.net 4 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 74 googleads.g.doubleclick.net — Cisco Umbrella Rank: 34 cm.g.doubleclick.net — Cisco Umbrella Rank: 205	3 KB
4	adnxs.com 4 redirects ib.adnxs.com — Cisco Umbrella Rank: 208	4 KB
4	adsrvr.org 4 redirects match.adsrvr.org — Cisco Umbrella Rank: 316	2 KB
4	pippio.com 1 redirects pippio.com — Cisco Umbrella Rank: 697	6 KB
3	tapad.com 2 redirects pixel.tapad.com — Cisco Umbrella Rank: 419	803 B
3	criteo.com 3 redirects gum.criteo.com — Cisco Umbrella Rank: 392	1021 B
3	amazon-adsystem.com 1 redirects s.amazon-adsystem.com — Cisco Umbrella Rank: 274	2 KB
3	openx.net 3 redirects us-u.openx.net — Cisco Umbrella Rank: 405	419 B
3	narrative.io 1 redirects io.narrative.io — Cisco Umbrella Rank: 2041	997 B
3	rezync.com 2 redirects live.rezync.com — Cisco Umbrella Rank: 1936	3 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 47	179 KB
2	krxd.net 1 redirects usermatch.krxd.net — Cisco Umbrella Rank: 1304 beacon.krxd.net — Cisco Umbrella Rank: 540	502 B
2	demdex.net 2 redirects dpm.demdex.net — Cisco Umbrella Rank: 198	2 KB
2	rfihub.com 2 redirects p.rfihub.com — Cisco Umbrella Rank: 716	2 KB
2	mathtag.com 2 redirects sync.mathtag.com — Cisco Umbrella Rank: 447	1 KB
2	adsymptotic.com 1 redirects p.adsymptotic.com — Cisco Umbrella Rank: 483	410 B
2	viglink.com cdn.viglink.com — Cisco Umbrella Rank: 8744	775 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 146	87 KB
2	google.ca www.google.ca — Cisco Umbrella Rank: 8290	565 B
2	substack.com jonluca.substack.com	8 KB
1	reson8.com idsync.reson8.com — Cisco Umbrella Rank: 2009	97 B
1	bluekai.com 1 redirects tags.bluekai.com — Cisco Umbrella Rank: 519	615 B
1	linksynergy.com 1 redirects tags.rd.linksynergy.com — Cisco Umbrella Rank: 3997	390 B
1	imrworldwide.com 1 redirects obgpm76tt0a0sgozk8l.npdredinuid.imrworldwide.com — Cisco Umbrella Rank: 46120	300 B
1	gstatic.com www.gstatic.com	35 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 108
1	sentry-cdn.com js.sentry-cdn.com — Cisco Umbrella Rank: 5415	1 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 977	6 KB
109	34

	Domain	Requested by
19	idsync.rlcdn.com	4 redirects live.rezync.com
19	c.disquscdn.com	jonluca.disqus.com disqus.com c.disquscdn.com
16	rc.rlcdn.com	16 redirects
15	blog.jonlu.ca	blog.jonlu.ca static.cloudflareinsights.com
8	disqus.com	jonluca.disqus.com c.disquscdn.com
6	substackcdn.com	jonluca.substack.com
4	ib.adnxs.com	4 redirects
4	match.adsrvr.org	4 redirects
4	cm.g.doubleclick.net	4 redirects
4	pippio.com	1 redirects c.disquscdn.com
3	pixel.tapad.com	2 redirects live.rezync.com
3	gum.criteo.com	3 redirects
3	s.amazon-adsystem.com	1 redirects
3	us-u.openx.net	3 redirects
3	io.narrative.io	1 redirects
3	live.rezync.com	2 redirects c.disquscdn.com
3	accounts.google.com	apis.google.com blog.jonlu.ca www.gstatic.com
3	www.googletagmanager.com	blog.jonlu.ca substackcdn.com www.googletagmanager.com
2	dpm.demdex.net	2 redirects
2	p.rfihub.com	2 redirects
2	sync.mathtag.com	2 redirects
2	p.adsymptotic.com	1 redirects
2	cdn.viglink.com
2	referrer.disqus.com
2	apis.google.com	c.disquscdn.com apis.google.com
2	connect.facebook.net	c.disquscdn.com connect.facebook.net
2	a.disquscdn.com	c.disquscdn.com
2	www.google.ca	blog.jonlu.ca
2	j.jonlu.ca	blog.jonlu.ca j.jonlu.ca
2	jonluca.disqus.com	blog.jonlu.ca jonluca.disqus.com
2	jonluca.substack.com	blog.jonlu.ca jonluca.substack.com
1	idsync.reson8.com
1	tags.bluekai.com	1 redirects
1	beacon.krxd.net
1	usermatch.krxd.net	1 redirects
1	tags.rd.linksynergy.com	1 redirects
1	ei.rlcdn.com	1 redirects
1	obgpm76tt0a0sgozk8l.npdredinuid.imrworldwide.com	1 redirects
1	glitter.services.disqus.com	c.disquscdn.com
1	www.gstatic.com	accounts.google.com
1	www.google.com
1	www.facebook.com	c.disquscdn.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	js.sentry-cdn.com	jonluca.substack.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	analytics.google.com	www.googletagmanager.com
1	static.cloudflareinsights.com	blog.jonlu.ca
0	links.services.disqus.com Failed	c.disquscdn.com
109	48

This site contains links to these domains. Also see Links.

Domain
curl.trillworks.com
jwt.io
developer.okta.com
www.reddit.com
news.ycombinator.com
twitter.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-11` - `2023-05-11`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.disqus.com Sectigo RSA Domain Validation Secure Server CA	`2022-04-20` - `2023-04-20`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.google.ca GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
a.disquscdn.com Amazon	`2022-09-30` - `2023-10-29`	a year	crt.sh
substackcdn.com Amazon	`2022-04-13` - `2023-05-12`	a year	crt.sh
*.sentry-cdn.com GlobalSign Atlas R3 DV TLS CA 2022 Q3	`2022-09-28` - `2023-10-30`	a year	crt.sh
*.disquscdn.com GlobalSign Atlas R3 DV TLS CA 2022 Q3	`2022-10-07` - `2023-11-08`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-09-17` - `2022-12-16`	3 months	crt.sh
*.apis.google.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
viglink.com Amazon	`2022-10-13` - `2023-11-11`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
accounts.google.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
*.services.disqus.com GlobalSign Atlas R3 DV TLS CA 2022 Q4	`2022-11-04` - `2023-12-06`	a year	crt.sh
*.rezync.com Amazon	`2022-11-25` - `2023-12-23`	a year	crt.sh
pippio.com GTS CA 1D4	`2022-11-21` - `2023-02-19`	3 months	crt.sh

This page contains 7 frames:

Primary Page: https://blog.jonlu.ca/posts/safeway
Frame ID: 6B3120A86FCB527DBC25B48DFB493AFA
Requests: 37 HTTP requests in this frame

Frame: https://jonluca.substack.com/embed
Frame ID: D63C3A4BCCAABC7488AA713BBF5FD3CC
Requests: 14 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
Frame ID: DAC3E659281512D7FA5CB031582DC60B
Requests: 23 HTTP requests in this frame

Frame: https://disqus.com/recommendations/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing
Frame ID: 98D57C7B8DDBA7C46BA7D02E5984C85A
Requests: 8 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/iframe
Frame ID: F6D310D6A669CBB140F1EF6C78894A98
Requests: 4 HTTP requests in this frame

Frame: https://live.rezync.com/pixel.html?c=4656c20ee35215f78e9273796625d90b&cid=cefoale1i6d9fa&pctry=CA&referrer=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway
Frame ID: D0370E5E884858E8644E7B6FB54BBE6F
Requests: 4 HTTP requests in this frame

Frame: https://pippio.com/api/sync?pid=1391&ref=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&it=1&iv=cefoale1i6d9fa
Frame ID: 6AD02D996DB24415A6135D5F9C3C1EE7
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Reversing private APIs, Safeway, and not-so-extreme couponing - JonLuca's Blog

Detected technologies

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/[a-z]*\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

109
Requests

76 %
HTTPS

41 %
IPv6

34
Domains

48
Subdomains

33
IPs

2
Countries

2057 kB
Transfer

5416 kB
Size

45
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://curl.trillworks.com/
Title: curlconverter

Search URL Search Domain Scan URL

URL: https://jwt.io/
Title: jwt

Search URL Search Domain Scan URL

URL: https://developer.okta.com/docs/reference/api/authn/#primary-authentication-with-public-application
Title: heavily documented on their own site

Search URL Search Domain Scan URL

URL: https://www.reddit.com/r/jonluca/comments/dhshj3/reversing_private_apis_safeway_and_notsoextreme/
Title: reddit

Search URL Search Domain Scan URL

URL: https://news.ycombinator.com/item?id=21250421
Title: hackernews

Search URL Search Domain Scan URL

URL: https://twitter.com/jonluca
Title: Follow @jonluca

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 84

https://io.narrative.io/?companyId=19&id=disqus_id%3Acefoale1i6d9fa&ret=img&ref=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway HTTP 302
https://io.narrative.io/?io.narrative.guid.v2=cfb85d30-773d-11ed-b672-0280929c123f&companyId=19&id=disqus_id%3Acefoale1i6d9fa&ret=img&ref=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway

Request Chain 85

https://obgpm76tt0a0sgozk8l.npdredinuid.imrworldwide.com/narr?gdpr=0&gdpr_consent=&url=https%3A%2F%2Fio.narrative.io%2F%3FcompanyId%3D19%26gdpr%3D0%26gdpr_consent%3D%26id%3Ddisqus_id%3Acefoale1i6d9fa HTTP 302
https://io.narrative.io/?companyId=19&gdpr=0&gdpr_consent=&id=disqus_id:cefoale1i6d9fa&gdpr_consent=&puid=cfba0ae0-773d-11ed-a7b8-fdbc9c0b8db6

Request Chain 87

https://idsync.rlcdn.com/462246.gif?partner_uid=cefoale1i6d9fa HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CKabHBIaChYIARDI-AEaDmNlZm9hbGUxaTZkOWZhEAAaDQiQqcmcBhIFCOgHEABCAEoA HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=fe94ad39b80b42581f2fba2dc667cda0ed1b0adbac314c1752afb2457bf2fecd791426b5417dce21&_=2

Request Chain 88

https://ei.rlcdn.com/448046.gif?n=1&partner_site_id=1017&cparams=placement%3D1391 HTTP 307
https://pippio.com/api/sync?pid=5324&_=2

Request Chain 89

https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CO8KEhkKFQgBEPkHGg5jZWZvYWxlMWk2ZDlmYRAAGpcBCI-pyZwGEgQIAhAAEgUIlCkQABIFCOUrEAASBQjmKxAAEgUI5ysQABIFCOgrEAASBQjpKxAAEgUI6isQABIFCOsrEAASBQjsKxAAEgUI7SsQABIFCO4rEAASBQjVQxAAEgUI3k4QABIGCOOvKxAAEgYI7a8rEAASBgjurysQABIGCO-vKxAAEgYI8K8rEAASBgjxrysQAEIASgA HTTP 302
https://pippio.com/api/sync/ddp?pid=2&m=CO8KEhkKFQgBEPkHGg5jZWZvYWxlMWk2ZDlmYRAAGpcBCI-pyZwGEgQIAhAAEgUIlCkQABIFCOUrEAASBQjmKxAAEgUI5ysQABIFCOgrEAASBQjpKxAAEgUI6isQABIFCOsrEAASBQjsKxAAEgUI7SsQABIFCO4rEAASBQjVQxAAEgUI3k4QABIGCOOvKxAAEgYI7a8rEAASBgjurysQABIGCO-vKxAAEgYI8K8rEAASBgjxrysQAEIASgA&google_error=3 HTTP 307
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3= HTTP 303
https://idsync.rlcdn.com/458249.gif?partner_uid=bf5aadd7-f519-4c7a-928d-1dfa209a52f8

Request Chain 90

https://p.adsymptotic.com/d/px?_pid=13553&_psign=9e62e5c043ecadc9479a0ccac401dd7d HTTP 302
https://p.adsymptotic.com/d/px?_pid=13553&_psign=9e62e5c043ecadc9479a0ccac401dd7d&_expected_cookie=7bea1812b1923acd194097d3be6a356f

Request Chain 91

https://rc.rlcdn.com/456809.gif?n=1&cparams=placement%3D1391 HTTP 307
https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveramp&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=liveramp&ttd_tpi=1 HTTP 302
https://idsync.rlcdn.com/362588.gif?partner_uid=c14987e2-e3a8-430d-8c1b-09f9c5e550ee

Request Chain 92

https://rc.rlcdn.com/456809.gif?n=2&cparams=placement%3D1391 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEBxfpLdC57KEcX5m8pZh1_Y&google_cver=1

Request Chain 93

https://rc.rlcdn.com/456809.gif?n=3&cparams=placement%3D1391 HTTP 307
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D HTTP 302
https://us-u.openx.net/w/1.0/cm?cc=1&id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D HTTP 302
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=cd0828ff-3b81-44ff-b00d-8d9457122db2

Request Chain 94

https://rc.rlcdn.com/456809.gif?n=4&cparams=placement%3D1391 HTTP 307
https://sync.mathtag.com/sync/img?mt_exid=10017&redir=https%3A%2F%2Fidsync.rlcdn.com%2F47154.gif%3Fserved_by%3Devergreen%26partner_uid%3D%5BMM_UUID%5D HTTP 302
https://idsync.rlcdn.com/47154.gif?served_by=evergreen&partner_uid=4e666392-5490-4f00-8fec-ddf31ed2bcc7

Request Chain 95

https://rc.rlcdn.com/456809.gif?n=5&cparams=placement%3D1391 HTTP 307
https://s.amazon-adsystem.com/dcm?pid=1f9f6bba-5ede-4cb5-997f-f0d0b894f672&id=&cb=00777933 HTTP 302
https://s.amazon-adsystem.com/dcm?pid=1f9f6bba-5ede-4cb5-997f-f0d0b894f672&id=&cb=00777933&dcc=t

Request Chain 96

https://rc.rlcdn.com/456809.gif?n=6&cparams=placement%3D1391 HTTP 307
https://ib.adnxs.com/getuid?https%3A%2F%2Fidsync.rlcdn.com%2F52154.gif%3Fserved_by%3Devergreen%26partner_uid%3D%24UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fidsync.rlcdn.com%252F52154.gif%253Fserved_by%253Devergreen%2526partner_uid%253D%2524UID HTTP 302
https://idsync.rlcdn.com/52154.gif?served_by=evergreen&partner_uid=8925242131578874964

Request Chain 97

https://ib.adnxs.com/getuid?https%3A//live.rezync.com/sync%3Fc%3D4656c20ee35215f78e9273796625d90b%26p%3D093016b0419d19c905c78c859b815219%26pid%3D%24UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%2F%2Flive.rezync.com%2Fsync%253Fc%253D4656c20ee35215f78e9273796625d90b%2526p%253D093016b0419d19c905c78c859b815219%2526pid%253D%2524UID HTTP 302
https://live.rezync.com/sync?c=4656c20ee35215f78e9273796625d90b&p=093016b0419d19c905c78c859b815219&pid=8690835558948192211 HTTP 302
https://p.rfihub.com/cm?pub=39342&in=1&userid=83952af9-e506-44b0-af87-9cb7a65d75b7%3A1670534288.0149646&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3Dcefoale1i6d9fa HTTP 302
https://idsync.rlcdn.com/501709.gif?partner_uid=cefoale1i6d9fa HTTP 307
https://gum.criteo.com/sync?c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397676.gif%3Fserved_by%3Devergreen%26partner_uid%3D%40USERID%40 HTTP 302
https://idsync.rlcdn.com/397676.gif?served_by=evergreen&partner_uid=WsrtMx6nnzkV7bCpOHSHJvx_IpYwbvpD

Request Chain 98

https://p.rfihub.com/cm?pub=39342&in=1&userid=83952af9-e506-44b0-af87-9cb7a65d75b7%3A1670534288.0149646&forward=https%3A//live.rezync.com/sync%3Fc%3D4656c20ee35215f78e9273796625d90b%26p%3D260a954059a0ab1986e4ee8c5c88c54c%26pid%3D%7Buserid%7D HTTP 302
https://live.rezync.com/sync?c=4656c20ee35215f78e9273796625d90b&p=260a954059a0ab1986e4ee8c5c88c54c&pid=970314636239741992 HTTP 302
https://idsync.rlcdn.com/501709.gif?partner_uid=cefoale1i6d9fa HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEBxfpLdC57KEcX5m8pZh1_Y&google_cver=1

Request Chain 99

https://pixel.tapad.com/idsync/ex/receive?partner_id=3181&partner_device_id=83952af9-e506-44b0-af87-9cb7a65d75b7%3A1670534288.0149646 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3181&partner_device_id=83952af9-e506-44b0-af87-9cb7a65d75b7%3A1670534288.0149646 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=1030a28d-1870-4584-99af-b8202f4a2969%252C&gdpr=0&gdpr_consent= HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=c14987e2-e3a8-430d-8c1b-09f9c5e550ee&ttd_puid=1030a28d-1870-4584-99af-b8202f4a2969%2C

Request Chain 100

https://rc.rlcdn.com/456809.gif?n=7&cparams=placement%3D1391 HTTP 307
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D HTTP 302
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=cd0828ff-3b81-44ff-b00d-8d9457122db2

Request Chain 101

https://rc.rlcdn.com/456809.gif?n=8&cparams=placement%3D1391 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEBxfpLdC57KEcX5m8pZh1_Y&google_cver=1

Request Chain 102

https://rc.rlcdn.com/456809.gif?n=9&cparams=placement%3D1391 HTTP 307
https://sync.mathtag.com/sync/img?mt_exid=10017&redir=https%3A%2F%2Fidsync.rlcdn.com%2F47154.gif%3Fserved_by%3Devergreen%26partner_uid%3D%5BMM_UUID%5D HTTP 302
https://idsync.rlcdn.com/47154.gif?served_by=evergreen&partner_uid=4e666392-5490-4f00-8fec-ddf31ed2bcc7

Request Chain 103

https://rc.rlcdn.com/456809.gif?n=10&cparams=placement%3D1391 HTTP 307
https://s.amazon-adsystem.com/dcm?pid=1f9f6bba-5ede-4cb5-997f-f0d0b894f672&id=45dcbfe0cd7bed8d9ff26e707f9e24e2b37a0350115223dd0cfb53c4ce3da7b4c0cb235b3774c97e&cb=02911725

Request Chain 104

https://rc.rlcdn.com/456809.gif?n=11&cparams=placement%3D1391 HTTP 307
https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveramp&ttd_tpi=1 HTTP 302
https://idsync.rlcdn.com/362588.gif?partner_uid=c14987e2-e3a8-430d-8c1b-09f9c5e550ee

Request Chain 105

https://rc.rlcdn.com/456809.gif?n=12&cparams=placement%3D1391 HTTP 307
https://dpm.demdex.net/ibs:dpid=477&dpuuid=ab1a330e8a6599085dc05e63bf5f4e42ceb2c79585beb999487716651c7eecd3b0da87c991749652&redir=https%3A%2F%2Fidsync.rlcdn.com%2F362248.gif%3Fpartner_uid%3D%24%7BDD_UUID%7D HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=477&dpuuid=ab1a330e8a6599085dc05e63bf5f4e42ceb2c79585beb999487716651c7eecd3b0da87c991749652&redir=https%3A%2F%2Fidsync.rlcdn.com%2F362248.gif%3Fpartner_uid%3D%24%7BDD_UUID%7D HTTP 302
https://idsync.rlcdn.com/362248.gif?partner_uid=19320867297869364443730348400978783029

Request Chain 106

https://rc.rlcdn.com/456809.gif?n=13&cparams=placement%3D1391 HTTP 307
https://usermatch.krxd.net/um/v2?partner=liveramp HTTP 302
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=liveramp

Request Chain 107

https://rc.rlcdn.com/456809.gif?n=14&cparams=placement%3D1391 HTTP 307
https://tags.bluekai.com/site/2035?phint=rluid=f7ba6da6b4ab93e807f9df5d81c931ae7f8265185e95b7dedaa121ba9a1ae7472971936f2f944561&redir=https%3A%2F%2Fidsync.rlcdn.com%2F401696.gif%3Fpartner_uid%3D%24BK_UUID_25515 HTTP 302
https://idsync.rlcdn.com/401696.gif?partner_uid=FAfN1PCA999fB8JM

Request Chain 108

https://rc.rlcdn.com/456809.gif?n=15&cparams=placement%3D1391 HTTP 307
https://gum.criteo.com/sync?c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397676.gif%3Fserved_by%3Devergreen%26partner_uid%3D%40USERID%40 HTTP 302
https://gum.criteo.com/sync?s=1&c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397676.gif%3Fserved_by%3Devergreen%26partner_uid%3D%40USERID%40 HTTP 302
https://idsync.rlcdn.com/397676.gif?served_by=evergreen&partner_uid=-UyXbaLKB-KLOEUN2K_vA3PDaiFLKwkv

Request Chain 109

https://rc.rlcdn.com/456809.gif?n=16&cparams=placement%3D1391 HTTP 307
https://idsync.reson8.com/sources/pixel/v1/sync?sourcekey=01EC61A11KAM4QCFG5RN38VQJZ

109 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request safeway Show response
blog.jonlu.ca/posts/ 77 KB
15 KB 178ms
134ms Document
text/html 2606:4700:3108::ac42:2b57
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.jonlu.ca/posts/safeway

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b57 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1996a5a1c1f5b77c4f79b2f4a1dbd032eeafc94954dc14ac975bb083fd1ac75c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
age: 316
cache-control: max-age=2678400
cf-cache-status: HIT
cf-ray: 776888172bb87145-YUL
content-encoding: br
content-type: text/html
date: Thu, 08 Dec 2022 21:18:06 GMT
last-modified: Fri, 21 Oct 2022 03:18:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fw8dkiwpwLzOf87%2FQ%2BMXpOS83rBQNut6GLBEPuizjCAKAC6hZeMDrTbNo68m3ipdrtHTOIFyaanMabvEdc3Z%2B6LDRT%2BEunXlk1J6EA6JVqXfxkMZcGaL8tKbMmBis2jj6YoQJMxQJWJtKfw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H2 200 style.css
blog.jonlu.ca/stylesheets/ 3 KB
1 KB 31ms
30ms Stylesheet
text/css 2606:4700:3108::ac42:2b57
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.jonlu.ca/stylesheets/style.css

Requested by

Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b57 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f4bf0526811a58a52c05b50c0c124e68cdca1ad88a70c8809635b5deedf841d0

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/posts/safeway
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:06 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 316
cf-polished: origSize=3726
cf-bgj: minify
last-modified: Mon, 30 May 2022 01:00:35 GMT
server: cloudflare
etag: W/"62941733-e8e"
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QSL7wOCquziwYg63NPUDs4r2r16QWoLCqKo7glvQxu322ufsUymEqo1Al0fPlJYNbPZ%2BQrfI2Z6E%2FRK8Vxv557sHIwQZQ0O3%2Fg%2F4jyurzg6IqGuduvDxELNDUjJP4asjwJ9xNUFek2J%2FtAc%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=2678400
vary: Accept-Encoding
cf-ray: 776888180d6f7145-YUL
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 highlighter.css
blog.jonlu.ca/stylesheets/ 2 KB
862 B 52ms
52ms Stylesheet
text/css 2606:4700:3108::ac42:2b57
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.jonlu.ca/stylesheets/highlighter.css

Requested by

Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b57 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a7e4e399ba1cd535c0c5af818d9282b7fed39cf44c0fe9842f2c56e3d2579df6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/posts/safeway
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:06 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 316
cf-polished: origSize=2672
cf-bgj: minify
last-modified: Mon, 30 May 2022 01:00:35 GMT
server: cloudflare
etag: W/"62941733-a70"
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n2IC%2BiK5fIC%2FteRnWybjpzzsnz7LScz9NSz4D04NSfUoZVBu%2FlmprmZptm0fkwqtk1DCgaapTLvYJR1mD4P%2B5K1d9SfsCxo7vu5sdE4JuUdarADSKJxTFoh9iry9Ve2kAbN6OBdwKYyvF3Y%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=2678400
vary: Accept-Encoding
cf-ray: 776888180d707145-YUL
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 safeway_offers-800-1cab10cd5.webp
blog.jonlu.ca/images/generated/ 14 KB
14 KB 41ms
40ms Image
image/webp 2606:4700:3108::ac42:2b57
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.jonlu.ca/images/generated/safeway_offers-800-1cab10cd5.webp

Requested by

Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b57 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c462fbe989bc7e25420ac5f49e8733967731313c58fd0ea0bd7efc0967a91075

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/posts/safeway
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 316
content-length: 14336
last-modified: Sun, 29 May 2022 21:59:15 GMT
server: cloudflare
etag: "6293ecb3-3800"
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/webp
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iWU%2BpWtowDuXX3yIyaUJFvEChFU69x9BF%2FabvF4EBfzKe3tfQF102jKzw5awq3khuDgG2p119aVlx9jH0XQ8oRL%2B32b7zsVyFtpWy5enVwuOtS%2BfeJrRtehh0oaJwr9yJZQ1U2n7pBDpa44%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=2678400
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 776888183db67145-YUL
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 safeway_add-800-592145cf1.webp
blog.jonlu.ca/images/generated/ 5 KB
5 KB 53ms
43ms Image
image/webp 2606:4700:3108::ac42:2b57
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.jonlu.ca/images/generated/safeway_add-800-592145cf1.webp

Requested by

Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b57 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9438cca9781769927e394ec9c578bd1387f4fc37fc92ad8090a8a90823047e55

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/posts/safeway
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 316
content-length: 5268
last-modified: Sun, 29 May 2022 21:59:16 GMT
server: cloudflare
etag: "6293ecb4-1494"
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/webp
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zPKbr9x%2FA1wggcVvflI%2BiEJvEJYtdaxyxGS3WPLAI7ZJX2rjkj6g0xBRye7keIGLCrCSIetFaiG3QnKAY3VXNREcoBGMyfDh4Z0wUivhmGkZ%2B9QsIpvjrGxlpiNF%2B%2BNG2Af7ibDCqvSvH%2FE%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=2678400
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 776888185dcc7145-YUL
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 safeway_comp-800-3b6cee424.webp
blog.jonlu.ca/images/generated/ 9 KB
9 KB 52ms
42ms Image
image/webp 2606:4700:3108::ac42:2b57
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.jonlu.ca/images/generated/safeway_comp-800-3b6cee424.webp

Requested by

Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b57 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f84d896a162d364e92e52e8d5abc58cac18e479fa315d637d9daace960d42648

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/posts/safeway
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 316
content-length: 9026
last-modified: Sun, 29 May 2022 21:59:17 GMT
server: cloudflare
etag: "6293ecb5-2342"
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/webp
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qKqC%2BciyhDUzSrEF8%2BsA6eRERa0RG4kKx73VT1qgkNIpUU99tld7srAsBg5Yx4JlGWeoqXRTgnH79rYy81STJ8DnCEk%2BM0VATlc4e9mEI1%2BrpIyTAj%2BY5eZhPKP0KiTvJBtjRDyAjkUXDOo%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=2678400
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 776888185dd17145-YUL
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 safeway_local-800-b3004ed0f.webp
blog.jonlu.ca/images/generated/ 13 KB
13 KB 49ms
40ms Image
image/webp 2606:4700:3108::ac42:2b57
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.jonlu.ca/images/generated/safeway_local-800-b3004ed0f.webp

Requested by

Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b57 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

148b9c1402554a9ea9226860dfe63aa3f8d0ad59d1cd6a4370fd3e44af6154a3

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/posts/safeway
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 316
content-length: 12874
last-modified: Sun, 29 May 2022 21:59:18 GMT
server: cloudflare
etag: "6293ecb6-324a"
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/webp
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xtilqdLz7lHDXFk32eorhpsFHYLkhsQAwn2%2F9vBoZd9nU%2B7Ujj4mlrs3k1N10A1TQJgkjK0ArWdYon1y%2B%2FtW8qLi8QLUXwVzvMT7s5TC6GfS7jQKKxAVeloqw4fSGLt8NxxWh0K4P%2BGQvbA%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=2678400
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 776888185dd27145-YUL
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 safeway_add_coupon-800-0996bed3e.webp
blog.jonlu.ca/images/generated/ 21 KB
22 KB 36ms
27ms Image
image/webp 2606:4700:3108::ac42:2b57
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.jonlu.ca/images/generated/safeway_add_coupon-800-0996bed3e.webp

Requested by

Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b57 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1707dd92cee6511bbf265dec2a1449691a93086b170a83e49fe37d674371a2be

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/posts/safeway
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 316
content-length: 21958
last-modified: Sun, 29 May 2022 21:59:19 GMT
server: cloudflare
etag: "6293ecb7-55c6"
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/webp
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fyvy5m9m%2FCRf8%2BbTaUnq84KIIJ4DiEB2ZAfhPtsBxWxY02LwskTRhRpCFxqTxy8H0hP7jh1ccaOeooaQ3FR2Pc%2BaxF9ErIJhpow8j9d0E%2Bg8X0cUEzXcxLkOhuAIMWSTfcwQSQhqL2RcUqc%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=2678400
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 776888185dd37145-YUL
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 safeway_upc-786-62383700e.webp
blog.jonlu.ca/images/generated/ 18 KB
19 KB 53ms
45ms Image
image/webp 2606:4700:3108::ac42:2b57
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.jonlu.ca/images/generated/safeway_upc-786-62383700e.webp

Requested by

Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b57 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8e39c669fe173ad27c5bccbc4cb462a4280bfc648b848eaf431d35e9d5f91217

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/posts/safeway
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 316
content-length: 18732
last-modified: Sun, 29 May 2022 21:59:22 GMT
server: cloudflare
etag: "6293ecba-492c"
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/webp
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YSNp1fVoNFYA6FJ7wWQPwigMOF1scfwrYKfMnv%2BvKubSkwOGwyweBNAgHFSXLkGjjqVqYl7fx%2FGsSxzDyt4LBTo3L0p4ia%2For0zFVsyCxIrTmu728xVYdMi5o13xLOunJgXdqn%2FvVaZvY0Y%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=2678400
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 776888185dd57145-YUL
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 safeway_added-800-2fcf5ff0d.webp
blog.jonlu.ca/images/generated/ 27 KB
27 KB 60ms
53ms Image
image/webp 2606:4700:3108::ac42:2b57
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.jonlu.ca/images/generated/safeway_added-800-2fcf5ff0d.webp

Requested by

Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b57 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dbe12aeb98f08ca84530a563776d55df27c010dddaafe7e872614dad01e3d8d2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/posts/safeway
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 316
content-length: 27136
last-modified: Sun, 29 May 2022 21:59:23 GMT
server: cloudflare
etag: "6293ecbb-6a00"
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/webp
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HfNvaxIsy2IEDJdJSBamiufSGr1ZZl%2BDrXIQuXRchPfw%2BgvWooQISQ5upmSS%2Fd%2BsWbKOJ3AkmYGHcqprf49zHDs34x3OZ8fyc3vfydu0RZwDNxLQDenKNP3tP2CEHsobRJuZRpfyCqyw49M%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=2678400
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 776888185dd67145-YUL
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 mini-profile-100-eafe4e7a1.webp
blog.jonlu.ca/images/generated/ 2 KB
2 KB 50ms
44ms Image
image/webp 2606:4700:3108::ac42:2b57
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.jonlu.ca/images/generated/mini-profile-100-eafe4e7a1.webp

Requested by

Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b57 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

932e95948cd89a021728e29ff82ab9a24fcdc247cf9a4871e2251b6ad9a728da

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/posts/safeway
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 316
content-length: 2156
last-modified: Mon, 30 May 2022 03:25:25 GMT
server: cloudflare
etag: "62943925-86c"
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/webp
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HeTsvUI21Jk02Yp3DYGy3i%2F24OBEd6LAhNFASZ7rREaR5EBBkAHiGEHvdyW%2F2CYbGaLTSqiKD2Iv4GotOHqb71sxQu2QY1FI5gEls0Ya2rtk3v3%2Bmsyxiwcik%2BIXBFFrVTUzZbJyC2M4Bf0%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=2678400
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 776888185dd77145-YUL
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 vaafb692b2aea4879b33c060e79fe94621666317369993 Show response
static.cloudflareinsights.com/beacon.min.js/ 17 KB
6 KB 94ms
59ms Script
text/javascript 2606:4700::6810:3865
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993
Requested by: Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:3865 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f48c5678ce459a596423b0e55344e7ad8eb3d3b1b27c54cd76a9d4cee7dd6c3

Request headers

Referer: https://blog.jonlu.ca/
Origin: https://blog.jonlu.ca
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:06 GMT
content-encoding: gzip
last-modified: Fri, 21 Oct 2022 01:56:09 GMT
server: cloudflare
etag: W/2022.10.1
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 77688818885b715a-YUL

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 220 KB
77 KB 91ms
40ms Script
application/javascript 2607:f8b0:4006:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-L7B5KF4CGL

Requested by

Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4876df16c05a59bd5af8ecbfa095b6ad57ac3ed6e434b793721271c952e7e140

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 78303
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 08 Dec 2022 21:18:06 GMT

GET
H2 200 external.js Show response
blog.jonlu.ca/js/ 978 B
825 B 23ms
21ms Script
application/javascript 2606:4700:3108::ac42:2b57
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.jonlu.ca/js/external.js

Requested by

Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b57 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0943ffff1fc17a422bfae370455f154310db3e87e17dae66ca21d1c5679443d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/posts/safeway
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:06 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 316
cf-polished: origSize=1141
cf-bgj: minify
last-modified: Mon, 30 May 2022 15:17:37 GMT
server: cloudflare
etag: W/"6294e011-475"
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KuDqo3CLwYcdUR5xxuul1eR%2BDuwnQqwBwFUoC%2Fg1xVgEw7nQAwSBMQEA0YVsTLUthPR6RVlT6%2FGlhiJH02HY16E9qEzaxlw7GLROikTmmYb7%2BadM7hLdnRGE4AH5eKR58VEm7qqsVdVKc5U%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=2678400
vary: Accept-Encoding
cf-ray: 776888185dd97145-YUL
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 footer.css
blog.jonlu.ca/stylesheets/ 978 B
830 B 40ms
39ms Stylesheet
text/css 2606:4700:3108::ac42:2b57
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.jonlu.ca/stylesheets/footer.css

Requested by

Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b57 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bb61e2816e5d5e791c393c2c7b4f1ceb77988410a9453bb9cf187af0734e825c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/posts/safeway
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:06 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 316
cf-polished: origSize=1226
cf-bgj: minify
last-modified: Mon, 30 May 2022 15:07:18 GMT
server: cloudflare
etag: W/"6294dda6-4ca"
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ATrBCEAofCha8aqDcV9%2BhhRk7yw0NI4KhfeE1T6YaXfegPbRGtTVsq4A97rd8ciWVD4DE4M10afy935skKZbu9MQLZtsRhOr2sNTXDc%2B%2BbP7rGJ7vnxvG%2F9stjPY4bJa1ledR4S%2FfUG5y8c%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=2678400
vary: Accept-Encoding
cf-ray: 776888185dda7145-YUL
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 embed Show response
jonluca.substack.com/ Frame D63C 25 KB
7 KB 264ms
215ms Document
text/html 2606:4700:4400::ac40:9a0b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://jonluca.substack.com/embed

Requested by

Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9a0b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

0c92d67c95143296cdb2f70d3c8399e3f5216be6d95d60309d9a978f127925f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://blog.jonlu.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: EXPIRED
cf-ray: 77688818bcd24bd0-YUL
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 08 Dec 2022 21:18:06 GMT
etag: W/"654e-eB3FlVt92YZMJ9IfonGikt+ffBI"
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-cluster: substack
x-powered-by: Express
x-served-by: Substack

GET
H/1.1 200
OK embed.js Show response
jonluca.disqus.com/ 78 KB
25 KB 110ms
63ms Script
application/javascript 199.232.196.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://jonluca.disqus.com/embed.js

Requested by

Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.196.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

66292fcb3995cbb5d7720043436c11b4c3c42a3fcba0f861144864008f88047a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 21:18:06 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=300; includeSubdomains
Server: openresty
Age: 0
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: private, max-age=60
X-Service: router
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 25621

GET
H2 200 / Show response
j.jonlu.ca/js/ 64 KB
22 KB 216ms
195ms Script
application/javascript 2606:4700:3108::ac42:2b57
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://j.jonlu.ca/js/
Requested by: Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/js/external.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b57 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d7fc375178c93a2fc15fd888e30170eedf4ef3d04497e7f951ab7bfe0c921693

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:06 GMT
content-encoding: br
referrer-policy: origin
cf-cache-status: DYNAMIC
last-modified: Wed, 23 Nov 2022 20:45:31 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b%2BiO1dEaOtmsLBwWXaxnPNtKCa9vknu8SjzkFp72TDveVsWqx8tOP4IB57TI3XCYv6zor7UajMeFy0ebsmoyas%2B6qhGRhVyATjka8iEwPc4NDv1tBSOzqeCwIbfSuRS%2BoMvNnE2NN1Q%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: public, must-revalidate
content-disposition: inline; filename=matomo.js
cf-ray: 776888189e437145-YUL
expires: Sun, 18 Dec 2022 21:18:06 GMT

GET
DATA 200
OK truncated
/ 822 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 s.js Show response
blog.jonlu.ca/cdn-cgi/zaraz/ 6 KB
3 KB 22ms
21ms Script
text/javascript 2606:4700:3108::ac42:2b57
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.jonlu.ca/cdn-cgi/zaraz/s.js?z=JTdCJTIyZXhlY3V0ZWQlMjIlM0ElNUIlNUQlMkMlMjJ0JTIyJTNBJTIyJTVDbiUyMCUyMCUyMCUyMCUyMCUyMFJldmVyc2luZyUyMHByaXZhdGUlMjBBUElzJTJDJTIwU2FmZXdheSUyQyUyMGFuZCUyMG5vdC1zby1leHRyZW1lJTIwY291cG9uaW5nJTIwLSUyMEpvbkx1Y2EncyUyMEJsb2clNUNuJTIwJTIwJTIwJTIwJTIyJTJDJTIyeCUyMiUzQTAuOTM4ODY3MjAxMDA5NTA5MiUyQyUyMnclMjIlM0ExNjAwJTJDJTIyaCUyMiUzQTEyMDAlMkMlMjJqJTIyJTNBMTIwMCUyQyUyMmUlMjIlM0ExNjAwJTJDJTIybCUyMiUzQSUyMmh0dHBzJTNBJTJGJTJGYmxvZy5qb25sdS5jYSUyRnBvc3RzJTJGc2FmZXdheSUyMiUyQyUyMnIlMjIlM0ElMjIlMjIlMkMlMjJrJTIyJTNBMjQlMkMlMjJuJTIyJTNBJTIyVVRGLTglMjIlMkMlMjJvJTIyJTNBMCUyQyUyMnElMjIlM0ElNUIlN0IlMjJtJTIyJTNBJTIyc2V0JTIyJTJDJTIyYSUyMiUzQSU1QiUyMjAlMjIlMkMlMjJjb25maWclMjIlMkMlN0IlMjJzY29wZSUyMiUzQSUyMnBhZ2UlMjIlN0QlNUQlN0QlMkMlN0IlMjJtJTIyJTNBJTIyc2V0JTIyJTJDJTIyYSUyMiUzQSU1QiUyMjElMjIlMkMlMjJHLUw3QjVLRjRDR0wlMjIlMkMlN0IlMjJzY29wZSUyMiUzQSUyMnBhZ2UlMjIlN0QlNUQlN0QlNUQlN0Q=
Requested by: Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b57 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afd59f64bc9e93d71345d0d92af50053c45205475ecd0347c61bb80930775bfd

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:06 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
access-control-max-age: 600
vary: Origin, Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://blog.jonlu.ca
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fw4TNzJsfek6SyssVVexbwuvsXg70yXIz6NMdLk5zhvLW0K9lX5Vr26sjqY6KUVHTLbubckMp%2FAza4N0m4rEYm4QT5NDNqTOxCvNMG3lhXNhPsi30V%2FPrBja%2B%2Bqd3JnGN1L0TGPf6osgB0E%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
access-control-allow-credentials: true
cf-ray: 776888190ece7145-YUL
access-control-allow-headers: Content-Type, Set-Cookie, Cache-Control

POST
H2 204 collect
analytics.google.com/g/ 0
346 B 102ms
33ms Ping
text/plain 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-L7B5KF4CGL&gtm=2oebu0&_p=1946229516&_gaz=1&cid=411949651.1670534286&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1670534286&sct=1&seg=0&dl=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&dt=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing%20-%20JonLuca%27s%20Blog&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-L7B5KF4CGL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:809::200e Nutley, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 21:18:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.jonlu.ca
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
346 B 90ms
32ms Ping
text/plain 2607:f8b0:4004:c08::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-L7B5KF4CGL&cid=411949651.1670534286&gtm=2oebu0&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-L7B5KF4CGL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c08::9c Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 21:18:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.jonlu.ca
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
501 B 87ms
37ms Image
image/gif 2607:f8b0:4006:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-L7B5KF4CGL&cid=411949651.1670534286&gtm=2oebu0&aip=1&z=1496054635

Requested by

Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 21:18:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 lounge.8a641259c3ce0d776498fcaa87e6df01.css
c.disquscdn.com/next/embed/styles/ 0
31 KB 113ms
22ms Other
text/css 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.8a641259c3ce0d776498fcaa87e6df01.css

Requested by

Host: jonluca.disqus.com
URL: https://jonluca.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 08 Dec 2022 17:32:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 d60ae27dae636821c1e43441a8146e02.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
age: 13530
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 30696
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Thu, 08 Dec 2022 17:26:42 GMT
server: nginx
etag: "63921e52-77e8"
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: jYfAe96bgMMnO-CpqEe7rIi9_eIH8QneapvLkyDPbVasK1gcNEk8LA==
expires: Fri, 08 Dec 2023 17:32:36 GMT

GET
H2 200 common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js
c.disquscdn.com/next/embed/ 0
93 KB 129ms
38ms Other
application/javascript 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js

Requested by

Host: jonluca.disqus.com
URL: https://jonluca.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 01 Dec 2022 15:48:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 d60ae27dae636821c1e43441a8146e02.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
age: 624566
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 94892
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Wed, 30 Nov 2022 00:18:36 GMT
server: nginx
etag: "6386a15c-172ac"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: Qxsz6x1yXZVcCT2Aza2quYfq83nlkNj0gVGuphX_CtwnHvcID7NFRA==
expires: Fri, 01 Dec 2023 15:48:40 GMT

GET
H2 200 lounge.bundle.5018287d05b2fa3bc388022cb540d0b3.js
c.disquscdn.com/next/embed/ 0
127 KB 162ms
71ms Other
application/javascript 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.5018287d05b2fa3bc388022cb540d0b3.js

Requested by

Host: jonluca.disqus.com
URL: https://jonluca.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 08 Dec 2022 17:32:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 d60ae27dae636821c1e43441a8146e02.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
age: 13530
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 128803
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Thu, 08 Dec 2022 17:26:42 GMT
server: nginx
etag: "63921e52-1f723"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: f7Vfs1Yis_cqBX91kPDgFrx7gj2sGbSl7fm4n9Y2stkQltDKG4PiwQ==
expires: Fri, 08 Dec 2023 17:32:36 GMT

GET
H/1.1 200
OK config.js
disqus.com/next/ 0
17 KB 40ms
11ms Other
application/javascript 151.101.0.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: jonluca.disqus.com
URL: https://jonluca.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 21:18:06 GMT
Strict-Transport-Security: max-age=300; includeSubdomains
X-Content-Type-Options: nosniff
Server: nginx
Age: 52
X-Frame-Options: SAMEORIGIN
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Content-Type: application/javascript; charset=UTF-8
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 16911
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK recommendations.js Show response
jonluca.disqus.com/ 64 KB
22 KB 45ms
45ms Script
application/javascript 199.232.196.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://jonluca.disqus.com/recommendations.js

Requested by

Host: jonluca.disqus.com
URL: https://jonluca.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.196.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

fe0fdfaa945380dbfd0bc522d79704c34bd81dc0b933bb2e9651861bd001e8f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 21:18:06 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=300; includeSubdomains
Server: openresty
Age: 0
Vary: Accept-Encoding, Accept, Accept-Encoding, X-Forwarded-Proto, X-Disqus-Shortname, X-Disqus-Device, X-Disqus-Experiment, X-Disqus-Is-Private, X-Disqus-Development-Base
Content-Type: application/javascript; charset=utf-8
Cache-Control: stale-while-revalidate=60, public, stale-if-error=86400, max-age=60
X-Service: router
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 21345

GET
H2 200 recommendations.10022a97346f1c6e3798931bbd8e4bb5.css
c.disquscdn.com/next/recommendations/styles/ 0
3 KB 106ms
105ms Other
text/css 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/styles/recommendations.10022a97346f1c6e3798931bbd8e4bb5.css

Requested by

Host: jonluca.disqus.com
URL: https://jonluca.disqus.com/recommendations.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 18 Aug 2022 10:59:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 d60ae27dae636821c1e43441a8146e02.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
age: 9713940
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 2978
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Wed, 17 Aug 2022 14:11:20 GMT
server: nginx
etag: "62fcf708-ba2"
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: JYxvwG-MnIrgj8vnOR96fKRUKmExiwqdM5OhF8OZbZe9rkQw1T0p5g==
expires: Fri, 18 Aug 2023 10:59:06 GMT

GET
H2 200 common.bundle.57ff60ef3dfb240c302805882f9ab7a8.js
c.disquscdn.com/next/recommendations/ 0
88 KB 110ms
109ms Other
application/javascript 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/common.bundle.57ff60ef3dfb240c302805882f9ab7a8.js

Requested by

Host: jonluca.disqus.com
URL: https://jonluca.disqus.com/recommendations.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 01 Dec 2022 15:48:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 d60ae27dae636821c1e43441a8146e02.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
age: 624565
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 88904
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Wed, 30 Nov 2022 00:18:36 GMT
server: nginx
etag: "6386a15c-15b48"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: 5Dw_RtiUwNdMYRzLZM4XHdlO_pi3xp3Ws1K7Q-IxRCMh2UwZy5aQdA==
expires: Fri, 01 Dec 2023 15:48:41 GMT

GET
H2 200 recommendations.bundle.540d77a9b22358647ed01c5c9f5cd435.js
c.disquscdn.com/next/recommendations/ 0
20 KB 134ms
133ms Other
application/javascript 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/recommendations.bundle.540d77a9b22358647ed01c5c9f5cd435.js

Requested by

Host: jonluca.disqus.com
URL: https://jonluca.disqus.com/recommendations.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 06 Dec 2022 22:30:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 d60ae27dae636821c1e43441a8146e02.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
age: 168448
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 20312
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 06 Dec 2022 22:10:19 GMT
server: nginx
etag: "638fbdcb-4f58"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: 9JiwpylRAAPSDx4lfMIQ3JkQR_mrtqfRvMwO24p5zDYaWKbAE4jTJg==
expires: Wed, 06 Dec 2023 22:30:38 GMT

GET
H2 200 main.css
substackcdn.com/theme/ Frame D63C 544 KB
70 KB 97ms
22ms Stylesheet
text/css 2600:9000:2209:9600:4:b4b9:d3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://substackcdn.com/theme/main.css?v=fb025144828425dd444c4db2d72faed8

Requested by

Host: jonluca.substack.com
URL: https://jonluca.substack.com/embed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2209:9600:4:b4b9:d3c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

/ Express

Resource Hash

66effb180c503ebd83897179839500ba0718e2350243f068c910f7c5ff4f6bdc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://jonluca.substack.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 18:49:52 GMT
x-cluster: substack
content-encoding: gzip
strict-transport-security: max-age=31536000
via: 1.1 0812978283e8debc2d404f4a7b32d866.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-P1
age: 8894
x-powered-by: Express
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-served-by: Substack
etag: W/"87e6e-jNF+LZi1ncfDirPs8g78jFqx/f0"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: public, max-age=31557600
x-amz-cf-id: fRoor3d79L-i3Zz1omGd_mITS6WjONk-dbDzuWmsLVVTrp2RcNFULg==

GET
H2 200 image_thumbnails.css
substackcdn.com/theme/ Frame D63C 28 KB
6 KB 170ms
96ms Stylesheet
text/css 2600:9000:2209:9600:4:b4b9:d3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://substackcdn.com/theme/image_thumbnails.css?v=cd413cfc7543ffbff729ea05d05b1be5

Requested by

Host: jonluca.substack.com
URL: https://jonluca.substack.com/embed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2209:9600:4:b4b9:d3c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

/ Express

Resource Hash

789cf6f93d6e14e0beaecf688e2996bfc6e96ba9fa8275ccf0051e1bd7c2d931

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://jonluca.substack.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Mon, 14 Nov 2022 22:24:17 GMT
x-cluster: substack
content-encoding: gzip
strict-transport-security: max-age=31536000
via: 1.1 0812978283e8debc2d404f4a7b32d866.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-P1
age: 2069629
x-powered-by: Express
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-served-by: Substack
etag: W/"6f09-pQcAGwAluhFNMXjBiwHi+9dCnec"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: public, max-age=31557600
x-amz-cf-id: 1AkWkpq-GfHJNmp30CwOrWOxR32y2Sjx3cAYNM-zXYeh9OxjlgaAQg==

GET
H2 200 main.css
substackcdn.com/min/ Frame D63C 136 KB
19 KB 125ms
52ms Stylesheet
text/css 2600:9000:2209:9600:4:b4b9:d3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://substackcdn.com/min/main.css?v=22060-184f3068e60

Requested by

Host: jonluca.substack.com
URL: https://jonluca.substack.com/embed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2209:9600:4:b4b9:d3c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

/ Express

Resource Hash

0e227650d404119f37b12014b92a4f681ca4f9249e61b686eb19eae43b824895

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://jonluca.substack.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 18:49:41 GMT
x-cluster: substack
content-encoding: gzip
strict-transport-security: max-age=31536000
via: 1.1 0812978283e8debc2d404f4a7b32d866.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-P1
age: 8905
x-powered-by: Express
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-served-by: Substack
last-modified: Thu, 08 Dec 2022 18:36:44 GMT
etag: W/"22060-184f3068e60"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000000
x-amz-cf-id: 9oroNWahFhlzDRiwxwnZth-EkEgsa2laWyZUXjsXb8tNqnyedcxLng==

GET
H2 200 https%3A%2F%2Fsubstack.com%2Fimg%2Fsubstack_wordmark.black.png
substackcdn.com/image/fetch/w_200,c_limit,f_auto,q_auto:good,fl_progressive:steep/ Frame D63C 3 KB
4 KB 158ms
95ms Image
image/png 2600:9000:2209:9600:4:b4b9:d3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://substackcdn.com/image/fetch/w_200,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack.com%2Fimg%2Fsubstack_wordmark.black.png
Requested by: Host: jonluca.substack.com
URL: https://jonluca.substack.com/embed
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2209:9600:4:b4b9:d3c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: imgproxy /
Resource Hash: fd75f8a07fe97547a72567714651409cb00381c822320f534a05a0ff93c2b1fd

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://jonluca.substack.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 01:08:08 GMT
via: 1.1 0812978283e8debc2d404f4a7b32d866.cloudfront.net (CloudFront)
server: imgproxy
x-amz-cf-pop: EWR53-P1
age: 850198
etag: "aUSYZOwx8_8DQNfdyad_mCD-kBjyY0l_EvDsr5MS94g/RVy8iM2ZkMC0xODRjMDYyMTQyMCI"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: public, max-age=0
content-disposition: inline; filename="substack_wordmark.black.png"
alt-svc: h3=":443"; ma=86400
content-length: 3462
x-amz-cf-id: xpC4sWuXiFn_pCimEDXh-61YCn9nMTY3rx9Mp_XEZiClDx2egXs3Jg==
x-request-id: AaymfJTV2TVo3pCpzceeI

GET
H2 200 c41771aeccbb43fbbffbc4755e65c9be.min.js Show response
js.sentry-cdn.com/ Frame D63C 2 KB
1 KB 41ms
11ms Script
text/javascript 2a04:4e42:400::729
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.sentry-cdn.com/c41771aeccbb43fbbffbc4755e65c9be.min.js

Requested by

Host: jonluca.substack.com
URL: https://jonluca.substack.com/embed

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:400::729 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

031ae69b49b033571c622c2a4a447270636170abb5454c1dc7dc892471cf5a47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://jonluca.substack.com/
Origin: https://jonluca.substack.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
age: 47
x-envoy-upstream-service-time: 38
content-length: 1018
x-xss-protection: 1; mode=block
x-served-by: getsentry-web-default-common-production-77b6f7797c-4m5wn, cache-yul12830-YUL
x-frame-options: deny
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
x-envoy-attempt-count: 1
accept-ranges: bytes
timing-allow-origin: https://sentry.io

GET
H2 200 main.bundle.js Show response
substackcdn.com/min/ Frame D63C 2 MB
520 KB 118ms
54ms Script
application/javascript 2600:9000:2209:9600:4:b4b9:d3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://substackcdn.com/min/main.bundle.js?v=1b0317-184f3068e60

Requested by

Host: jonluca.substack.com
URL: https://jonluca.substack.com/embed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2209:9600:4:b4b9:d3c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

/ Express

Resource Hash

7775ea04f586b364771eaedb8d6c0eb4aec9ef8eb063afae02f10479acde6800

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://jonluca.substack.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 18:49:46 GMT
x-cluster: substack
content-encoding: gzip
strict-transport-security: max-age=31536000
via: 1.1 0812978283e8debc2d404f4a7b32d866.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-P1
age: 8900
x-powered-by: Express
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-served-by: Substack
last-modified: Thu, 08 Dec 2022 18:36:44 GMT
etag: W/"1b0317-184f3068e60"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000000
x-amz-cf-id: aYkuG3uGF_zGgfJYR4wmpYaXVeLWuM8gxgryvz4L4EEinv1nKdVtDQ==

GET
H/1.1 200
OK / Show response
disqus.com/embed/comments/ Frame DAC3 6 KB
4 KB 84ms
83ms Document
text/html 151.101.0.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default

Requested by

Host: jonluca.disqus.com
URL: https://jonluca.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

61301b185cdc60dac7e560179a8f95541e850b8cc6ec975a8c6fed2d221b12a8

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.jonlu.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Age: 0
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 2765
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Content-Type: text/html; charset=utf-8
Cross-Origin-Resource-Policy: cross-origin
Date: Thu, 08 Dec 2022 21:18:06 GMT
ETag: W/"lounge:view:9209129708.8b855ff6a5d0937ae56e1d5a0623cedf.2"
Last-Modified: Wed, 08 Jun 2022 17:58:02 GMT
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Referrer-Policy: no-referrer-when-downgrade
Server: nginx
Strict-Transport-Security: max-age=300; includeSubdomains
Timing-Allow-Origin: *
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"

POST
H2 204 / Show response
j.jonlu.ca/js/ 0
366 B 173ms
172ms XHR
text/plain 2606:4700:3108::ac42:2b57
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://j.jonlu.ca/js/
Requested by: Host: j.jonlu.ca
URL: https://j.jonlu.ca/js/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b57 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.jonlu.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Thu, 08 Dec 2022 21:18:06 GMT
referrer-policy: origin
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gcHuL%2BY37OQLUtFMfwe0OzJVKKdykoPEYknP8SPKFaq4n%2F7PErpa%2BUjWo3nCr6yRaiimclyWmCHPh8i6BXiLBhE9DkhoirmFdUKcXZJOwunJVefbwKlmNdGMZnyCfuSAHnQIidKg97A%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://blog.jonlu.ca
access-control-allow-credentials: true
cf-ray: 7768881a68a97145-YUL

GET
H/1.1 200
OK / Show response
disqus.com/recommendations/ Frame 98D5 5 KB
3 KB 60ms
53ms Document
text/html 151.101.0.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/recommendations/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing

Requested by

Host: jonluca.disqus.com
URL: https://jonluca.disqus.com/recommendations.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

1271c635c43cb3864573fb589576861a385125cce25146e1d7b9617571c70836

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.jonlu.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Age: 0
Cache-Control: stale-while-revalidate=30, no-cache, must-revalidate, stale-if-error=3600, public
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 2336
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Content-Type: text/html; charset=utf-8
Cross-Origin-Resource-Policy: cross-origin
Date: Thu, 08 Dec 2022 21:18:06 GMT
Last-Modified: Tue, 07 Jun 2022 21:16:43 GMT
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Server: nginx
Strict-Transport-Security: max-age=300; includeSubdomains
Timing-Allow-Origin: *
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"

GET
H2 200 lounge.load.586cf16a4aea9b47994dd412bb125d5c.js Show response
c.disquscdn.com/next/embed/ Frame DAC3 958 B
1 KB 56ms
19ms Script
application/javascript 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.load.586cf16a4aea9b47994dd412bb125d5c.js

Requested by

Host: disqus.com
URL: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

178391f38859ccdf417361a9333f2dbc8b0555937bd8ed14b9755affed0aed5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
Origin: https://disqus.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 08 Dec 2022 17:32:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 205b9099637a29b949f9be6dceccecec.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
age: 13530
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 494
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Thu, 08 Dec 2022 17:26:42 GMT
server: nginx
etag: "63921e52-1ee"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: mH9DK7R4t_z8CZEaJjSq-8AJk10wEGgYSTnsNH5Bk8UuwU4EgF-opw==
expires: Fri, 08 Dec 2023 17:32:36 GMT

GET
H2 200 recommendations.load.45d803678709df462a062a65814e3d01.js Show response
c.disquscdn.com/next/recommendations/ Frame 98D5 923 B
1 KB 19ms
18ms Script
application/javascript 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/recommendations.load.45d803678709df462a062a65814e3d01.js

Requested by

Host: disqus.com
URL: https://disqus.com/recommendations/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e54bda451bb81f99cf473297523f48b6c313510fee73931956737575456ab9fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/
Origin: https://disqus.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 06 Dec 2022 22:30:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 205b9099637a29b949f9be6dceccecec.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
age: 168448
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 447
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Tue, 06 Dec 2022 22:10:19 GMT
server: nginx
etag: "638fbdcb-1bf"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: YTsrogK2VUeG88hdkYWpVhd1FM-teasNXpRdLocjfHz6eQ6bgEvOoQ==
expires: Wed, 06 Dec 2023 22:30:38 GMT

GET
H2 200 common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js Show response
c.disquscdn.com/next/embed/ Frame DAC3 282 KB
93 KB 23ms
22ms Script
application/javascript 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.load.586cf16a4aea9b47994dd412bb125d5c.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

278f7c9d80a080385d0ac988d5dc97b7ec33d0ae378a4d8ae58afb6f03cb156d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 01 Dec 2022 15:48:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 d60ae27dae636821c1e43441a8146e02.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
age: 624566
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 94892
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Wed, 30 Nov 2022 00:18:36 GMT
server: nginx
etag: "6386a15c-172ac"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: Uj1eIj4EkPPzNgSf68g_X-4A-8pFTAx1qP477R-cFsSiX11p3Des8Q==
expires: Fri, 01 Dec 2023 15:48:40 GMT

GET
H3 200 firehose
jonluca.substack.com/api/v1/ Frame D63C 35 B
690 B 116ms
99ms Image
image/gif 2606:4700:4400::ac40:9a0b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jonluca.substack.com/api/v1/firehose?_=1670534286748&d=eyJldmVudCI6IlBhZ2VzIiwicHJvcGVydGllcyI6eyJicm93c2VyU2Vzc2lvbklkIjoiNjR6d2NoaHhleWkiLCJpZnJhbWVWaXNpdElkIjp7ImlkIjoiYjhlMTI0ZjctNDU4Zi00OWJiLWFjNTQtNTNiNDc0NTk1YmU3IiwidGltZXN0YW1wIjoiMjAyMi0xMi0wOFQyMToxODowNi43NDdaIn19LCJjb250ZXh0Ijp7ImNsaWVudF90eXBlIjoid2ViIiwicGFnZSI6eyJyZWZlcnJlciI6Imh0dHBzOi8vYmxvZy5qb25sdS5jYS8iLCJ0aXRsZSI6Ikpvbkx1Y2EncyBCbG9nIHwgU3Vic3RhY2siLCJ1cmwiOiJodHRwczovL2pvbmx1Y2Euc3Vic3RhY2suY29tL2VtYmVkIn19fQ%3D%3D

Requested by

Host: jonluca.substack.com
URL: https://jonluca.substack.com/embed

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::ac40:9a0b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://jonluca.substack.com/embed
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:07 GMT
x-cluster: substack
strict-transport-security: max-age=31536000
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: image/gif
cache-control: no-cache
cf-ray: 7768881d4f4d4bc5-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 35
x-served-by: Substack

GET
H3 200 https%3A%2F%2Fsubstack.com%2Fimg%2Fsubstack_wordmark.png
substackcdn.com/image/fetch/w_200,c_limit,f_auto,q_auto:good,fl_progressive:steep/ Frame D63C 4 KB
4 KB 41ms
18ms Image
image/png 2600:9000:2209:9600:4:b4b9:d3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://substackcdn.com/image/fetch/w_200,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack.com%2Fimg%2Fsubstack_wordmark.png
Requested by: Host: jonluca.substack.com
URL: https://jonluca.substack.com/embed
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:2209:9600:4:b4b9:d3c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: imgproxy /
Resource Hash: 40de9653ef9baab8690a292219530676e022cf68f5e68d65fced61537e259182

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://jonluca.substack.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 01:08:08 GMT
via: 1.1 acbc1e922360be31edf0371abdc7a3a4.cloudfront.net (CloudFront)
server: imgproxy
age: 850198
x-amz-cf-pop: EWR53-P1
etag: "aUSYZOwx8_8DQNfdyad_mCD-kBjyY0l_EvDsr5MS94g/RVy8iNGE0OC0xODRjMDYyMTQyMCI"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: public, max-age=0
content-disposition: inline; filename="substack_wordmark.png"
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: jyS-FdU0ZLSbCefh-hsTGSsQYoEI5GKvxpobYZ2YzuEuiXlMwoqJIw==
content-length: 4170
x-request-id: gYw9O5zKnpu1lPRV5spvh

GET
H2 200 common.bundle.57ff60ef3dfb240c302805882f9ab7a8.js Show response
c.disquscdn.com/next/recommendations/ Frame 98D5 262 KB
88 KB 21ms
21ms Script
application/javascript 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/common.bundle.57ff60ef3dfb240c302805882f9ab7a8.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/recommendations.load.45d803678709df462a062a65814e3d01.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

6b14bffa5a0f903538cbde31fe3455a23f8515152156fdf8a21aeb131b89dd54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 01 Dec 2022 15:48:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 d60ae27dae636821c1e43441a8146e02.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
age: 624565
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 88904
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Wed, 30 Nov 2022 00:18:36 GMT
server: nginx
etag: "6386a15c-15b48"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: MzEBAA_Yi6wcRnPCaIRn2wva6rXcHlUXkYZdShtB_XGzhyC3hoPmew==
expires: Fri, 01 Dec 2023 15:48:41 GMT

GET
H2 200 lounge.8a641259c3ce0d776498fcaa87e6df01.css
c.disquscdn.com/next/embed/styles/ Frame DAC3 202 KB
31 KB 25ms
24ms Stylesheet
text/css 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.8a641259c3ce0d776498fcaa87e6df01.css

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

92ef0af03bcaadbec78568a8476b7db5b33195b94df73319c79f3370e8e060c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 08 Dec 2022 17:32:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 d60ae27dae636821c1e43441a8146e02.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
age: 13531
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 30696
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Thu, 08 Dec 2022 17:26:42 GMT
server: nginx
etag: "63921e52-77e8"
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: o7v-XhRKQaEbkl7Bh1RHk6rkaWz8P2fbgn89PDDtAgD64v0ROcJb8Q==
expires: Fri, 08 Dec 2023 17:32:36 GMT

GET
H2 200 lounge.bundle.5018287d05b2fa3bc388022cb540d0b3.js Show response
c.disquscdn.com/next/embed/ Frame DAC3 504 KB
127 KB 26ms
24ms Script
application/javascript 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.5018287d05b2fa3bc388022cb540d0b3.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d38131b25cf8046eea120b271d661da4e1b47e95c52f82eb34a9ab7bb90ee883

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 08 Dec 2022 17:32:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 d60ae27dae636821c1e43441a8146e02.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
age: 13531
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 128803
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Thu, 08 Dec 2022 17:26:42 GMT
server: nginx
etag: "63921e52-1f723"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: HMtHh5uELCbJtFJmIWzU3CdTc4yLt33nnOWi7Gev5JRhpSKMMYW0pQ==
expires: Fri, 08 Dec 2023 17:32:36 GMT

GET
H/1.1 200
OK config.js Show response
disqus.com/next/ Frame DAC3 17 KB
17 KB 11ms
11ms Script
application/javascript 151.101.0.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

9e5c15580c6b9b0db29719a0db5a12864ffaeace46e7a7bd9ef3944e90ddc5aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 21:18:07 GMT
Strict-Transport-Security: max-age=300; includeSubdomains
X-Content-Type-Options: nosniff
Server: nginx
Age: 53
X-Frame-Options: SAMEORIGIN
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Content-Type: application/javascript; charset=UTF-8
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 16911
X-XSS-Protection: 1; mode=block

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame D63C 93 KB
37 KB 83ms
38ms Script
application/javascript 2607:f8b0:4006:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=undefined&l=localGaDataLayer

Requested by

Host: substackcdn.com
URL: https://substackcdn.com/min/main.bundle.js?v=1b0317-184f3068e60

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5b84a6efef52101adc547e4cea0fd0db030c7d4ed36e9161ebc58c49057f0f5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://jonluca.substack.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37451
x-xss-protection: 0
last-modified: Thu, 08 Dec 2022 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Dec 2022 21:18:07 GMT

GET
H2 200 recommendations.10022a97346f1c6e3798931bbd8e4bb5.css
c.disquscdn.com/next/recommendations/styles/ Frame 98D5 14 KB
3 KB 18ms
18ms Stylesheet
text/css 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/styles/recommendations.10022a97346f1c6e3798931bbd8e4bb5.css

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.57ff60ef3dfb240c302805882f9ab7a8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3eee15d11eb29b6f2258cabfeeca39b3b900a7cae96fc7919b27789f3470b9f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 18 Aug 2022 10:59:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 d60ae27dae636821c1e43441a8146e02.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
age: 9713941
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 2978
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Wed, 17 Aug 2022 14:11:20 GMT
server: nginx
etag: "62fcf708-ba2"
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: HPq_mHyCAc7SzaQBozlMCb1V10-aVz3QOzH1ZpNvaPcWzC0ig_qLgQ==
expires: Fri, 18 Aug 2023 10:59:06 GMT

POST
H2 204 rum Show response
blog.jonlu.ca/cdn-cgi/ 0
150 B 15ms
14ms XHR
text/plain 2606:4700:3108::ac42:2b57
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.jonlu.ca/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b57 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://blog.jonlu.ca/posts/safeway
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
content-type: application/json

Response headers

date: Thu, 08 Dec 2022 21:18:07 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://blog.jonlu.ca
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 7768881e1e1d7145-YUL

GET
H2 200 recommendations.bundle.540d77a9b22358647ed01c5c9f5cd435.js Show response
c.disquscdn.com/next/recommendations/ Frame 98D5 65 KB
20 KB 21ms
21ms Script
application/javascript 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/recommendations.bundle.540d77a9b22358647ed01c5c9f5cd435.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.57ff60ef3dfb240c302805882f9ab7a8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

8dd28e7681ada525cd32f48f07ae01c558153b1cdecf40c597478621b2988043

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 06 Dec 2022 22:30:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 d60ae27dae636821c1e43441a8146e02.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
age: 168449
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 20312
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 06 Dec 2022 22:10:19 GMT
server: nginx
etag: "638fbdcb-4f58"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: qUzRxV4Pz0SYRiXcvM9BVazGlTKBUqyS3ihrEn37HF8mhI1o0xyvJw==
expires: Wed, 06 Dec 2023 22:30:38 GMT

GET
H/1.1 200
OK config.js Show response
disqus.com/next/ Frame 98D5 17 KB
17 KB 12ms
11ms Script
application/javascript 151.101.0.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.57ff60ef3dfb240c302805882f9ab7a8.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

9e5c15580c6b9b0db29719a0db5a12864ffaeace46e7a7bd9ef3944e90ddc5aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://disqus.com/recommendations/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 21:18:07 GMT
Strict-Transport-Security: max-age=300; includeSubdomains
X-Content-Type-Options: nosniff
Server: nginx
Age: 53
X-Frame-Options: SAMEORIGIN
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Content-Type: application/javascript; charset=UTF-8
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 16911
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK details Show response
disqus.com/api/3.0/forums/ Frame DAC3 3 KB
3 KB 42ms
42ms XHR
application/json 151.101.0.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/forums/details?forum=jonluca&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

0a076ccbecfffcdd0c389dafdb5e1b4712faf8c953e8040721b7465330a66b2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
X-Requested-With: XMLHttpRequest
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 21:18:07 GMT
Strict-Transport-Security: max-age=300; includeSubdomains
X-Content-Type-Options: nosniff
Server: nginx
Age: 0
X-Frame-Options: SAMEORIGIN
Vary: Origin, Cookie
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: application/json
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 3086
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK details Show response
disqus.com/api/3.0/forums/ Frame 98D5 3 KB
3 KB 13ms
13ms XHR
application/json 151.101.0.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/forums/details?forum=jonluca&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.57ff60ef3dfb240c302805882f9ab7a8.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

0a076ccbecfffcdd0c389dafdb5e1b4712faf8c953e8040721b7465330a66b2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://disqus.com/recommendations/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing
X-Requested-With: XMLHttpRequest
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 21:18:07 GMT
Strict-Transport-Security: max-age=300; includeSubdomains
X-Content-Type-Options: nosniff
Server: nginx
Age: 0
X-Frame-Options: SAMEORIGIN
Vary: Origin, Cookie
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: application/json
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 3086
X-XSS-Protection: 1; mode=block

GET
H2 200 noavatar92.png
a.disquscdn.com/1668443441/images/ Frame DAC3 2 KB
2 KB 45ms
11ms Image
image/png 199.232.198.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.disquscdn.com/1668443441/images/noavatar92.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.198.49 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:07 GMT
strict-transport-security: max-age=300; includeSubdomains
x-content-type-options: nosniff
last-modified: Fri, 26 Feb 2021 20:50:09 GMT
server: nginx
x-amz-cf-pop: YUL62-C1
age: 1836047
etag: "60395f01-66c"
content-type: image/png
cache-control: max-age=2592000
cross-origin-resource-policy: cross-origin
content-length: 1644
x-amz-cf-id: nlMva8PiEb0EOYPbFhgePSF4tw-OL8Fk-mxxASb8nnZlz2f_CQvtqQ==
x-xss-protection: 1; mode=block
expires: Sat, 17 Dec 2022 15:17:19 GMT

GET
DATA 200
OK truncated
/ Frame DAC3 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame DAC3 13 KB
13 KB 21ms
21ms Image
image/svg+xml 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.8a641259c3ce0d776498fcaa87e6df01.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.8a641259c3ce0d776498fcaa87e6df01.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Sun, 03 Jul 2022 15:15:27 GMT
via: 1.1 d60ae27dae636821c1e43441a8146e02.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: JFK50-P4
age: 13672960
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 13079
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Wed, 29 Jun 2022 08:38:50 GMT
server: nginx
etag: "62bc0f9a-3317"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: giq-4erkS-mWHZ3Gk1lNZhq4y_iJt5UxO0Jl__AY0OtP3PFtqDtZSQ==
expires: Mon, 03 Jul 2023 15:15:27 GMT

GET
H2 200 loader.ba7c86e8b4b6135bb668d05223f8f127.gif
c.disquscdn.com/next/embed/assets/img/ Frame DAC3 3 KB
3 KB 20ms
20ms Image
image/gif 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/loader.ba7c86e8b4b6135bb668d05223f8f127.gif

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.8a641259c3ce0d776498fcaa87e6df01.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.8a641259c3ce0d776498fcaa87e6df01.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 17 May 2022 07:40:37 GMT
via: 1.1 d60ae27dae636821c1e43441a8146e02.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: JFK50-P4
age: 17761050
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 2971
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Tue, 10 May 2022 13:06:19 GMT
server: nginx
etag: "627a634b-b9b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 5_ExXatcYOIUpMjxIoyBKOiYFYKmzrEkOxpD_WQJmvOiLfnx5FAq4Q==
expires: Wed, 17 May 2023 07:40:37 GMT

GET
H2 200 sprite.ad630a07080a45451f139a7487853ff8.png
c.disquscdn.com/next/embed/assets/img/ Frame DAC3 2 KB
2 KB 20ms
19ms Image
image/png 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/sprite.ad630a07080a45451f139a7487853ff8.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.8a641259c3ce0d776498fcaa87e6df01.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

9714221c828961b20f45a782c3281c0596f6652cfe1299bee18097f98e8fb7b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.8a641259c3ce0d776498fcaa87e6df01.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 16 Aug 2022 08:14:20 GMT
via: 1.1 d60ae27dae636821c1e43441a8146e02.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: JFK50-P4
age: 9896627
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 1763
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Mon, 15 Aug 2022 15:49:09 GMT
server: nginx
etag: "62fa6af5-6e3"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: qdpvJKIeScnQRDt6Cu-oDtXk_tq80LqoHOFHT7VaUdbeT0Jo6FWQLg==
expires: Wed, 16 Aug 2023 08:14:20 GMT

GET
H2 200 icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2
c.disquscdn.com/next/embed/assets/font/ Frame DAC3 8 KB
8 KB 21ms
20ms Font
application/octet-stream 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/assets/font/icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.8a641259c3ce0d776498fcaa87e6df01.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.8a641259c3ce0d776498fcaa87e6df01.css
Origin: https://disqus.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Mon, 06 Jun 2022 11:28:19 GMT
via: 1.1 205b9099637a29b949f9be6dceccecec.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: JFK50-P4
age: 16019388
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 7900
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Fri, 03 Jun 2022 17:03:15 GMT
server: nginx
etag: "629a3ed3-1edc"
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: c2-4d5nvLx9Fln-sVEEtvoENcCw32fg1Yuzp0yyDqXMrqVG49EtL5g==
expires: Tue, 06 Jun 2023 11:28:19 GMT

GET
H2 200 alfie_v4.63f1ab6d6b9d5807dc0c94ef3fe0b851.js Show response
c.disquscdn.com/next/embed/ 78 KB
27 KB 22ms
21ms Script
application/javascript 2600:9000:24f1:6800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/alfie_v4.63f1ab6d6b9d5807dc0c94ef3fe0b851.js

Requested by

Host: jonluca.disqus.com
URL: https://jonluca.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:6800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

9efb3d5e1b082a66bd94908b42afb4cf6fe0e8eb8f50b8d2a18f6a5da03e6a18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-cache-hits: 0
date: Sun, 29 May 2022 06:17:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 d60ae27dae636821c1e43441a8146e02.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
age: 16729253
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 26578
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Tue, 10 May 2022 13:06:19 GMT
server: nginx
etag: "627a634b-67d2"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: qqtVOLqNwYqE4X3firoWpX-vm0DP09HSBbYH1WjOFpb67-kI9KdJkQ==
expires: Mon, 29 May 2023 06:17:14 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame D63C 179 KB
65 KB 34ms
34ms Script
application/javascript 2607:f8b0:4006:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-316245675&l=localGaDataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=undefined&l=localGaDataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7ff7fcb452fcd96b53604bafd046840b2f16d9fd89b60b5607fffdaef27805dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://jonluca.substack.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 66892
x-xss-protection: 0
last-modified: Thu, 08 Dec 2022 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Dec 2022 21:18:07 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ Frame DAC3 3 KB
2 KB 80ms
25ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

cf2bf77432c68a007189bfc6945cc1a4a2f9faf0df326a1db13f7fca61c7e2df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 08 Dec 2022 21:18:07 GMT
content-md5: 728tvHEVbetbQ1Cm57+70w==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1686
x-fb-rlafr: 0
x-fb-debug: HVlBczt4wL35nepwBMD/A89zFfjOC1RhBwfiLmBg08yV0pay2SP02MWxXCIF9/s6/ftufVVo1wKrMCB3kqzpcw==
x-fb-trip-id: 1512268381
x-fb-content-md5: 7f59b8c534f7bfa7a6c50f0e90be7179
cross-origin-opener-policy: same-origin-allow-popups
etag: "499489e46a5d0056ed6422e0ad2ff5c9"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
priority: u=3,i
expires: Thu, 08 Dec 2022 21:29:19 GMT

GET
H2 200 api.js Show response
apis.google.com/js/ Frame DAC3 17 KB
7 KB 138ms
74ms Script
text/javascript 2607:f8b0:4006:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/api.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

56a8c951ff996aaea9015fff286bf02ec6ccf89517f3a368e04ab415d2f551af

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 08 Dec 2022 21:18:07 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6893
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "62e346024404732b"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 08 Dec 2022 21:18:07 GMT

GET
H/1.1 200
OK listRecommendations.json Show response
disqus.com/api/3.0/discovery/ Frame 98D5 3 KB
3 KB 12ms
11ms XHR
application/json 151.101.0.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/discovery/listRecommendations.json?forum=jonluca&thread=url%3Ahttps%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&limit=8&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.57ff60ef3dfb240c302805882f9ab7a8.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

9cd7b0340ae7f0f4e88ef42b617e74bd9275632ab74c1ad2d4815810de414285

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://disqus.com/recommendations/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing
X-Requested-With: XMLHttpRequest
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 21:18:07 GMT
Strict-Transport-Security: max-age=300; includeSubdomains
X-Content-Type-Options: nosniff
Server: nginx
Age: 316
X-Frame-Options: SAMEORIGIN
Vary: Origin
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: application/json
Cache-Control: stale-while-revalidate=450, public, max-age=1800
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 2778
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK stat.gif
referrer.disqus.com/juggler/ 43 B
339 B 51ms
24ms Image
image/gif 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://referrer.disqus.com/juggler/stat.gif?event=failed_recommendations.server.undefined

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 21:18:07 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Content-Type: image/gif
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block

GET
H2 200 pixel.gif
cdn.viglink.com/images/ 43 B
388 B 84ms
19ms Image
image/gif 108.138.128.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.viglink.com/images/pixel.gif?ch=1&rn=6.538578881039371
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-110.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:01 GMT
via: 1.1 6d9771d39a0475d92b50bdd9caae11c2.cloudfront.net (CloudFront)
last-modified: Tue, 10 Feb 2015 03:29:39 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
age: 7
etag: "221d8352905f2c38b3cb2bd191d630b0"
x-cache: Hit from cloudfront
content-type: image/gif
cache-control: max-age=15, must-revalidate
accept-ranges: bytes
content-length: 43
x-amz-cf-id: TqYr8uB_QpDjhukoQImf10k4RVOna8zq4NA-Swc2ChwTXzJc7BCIgQ==

GET
H2 200 pixel.gif
cdn.viglink.com/images/ 43 B
387 B 85ms
20ms Image
image/gif 108.138.128.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.viglink.com/images/pixel.gif?ch=2&rn=6.538578881039371
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-110.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://blog.jonlu.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:01 GMT
via: 1.1 6d9771d39a0475d92b50bdd9caae11c2.cloudfront.net (CloudFront)
last-modified: Tue, 10 Feb 2015 03:29:39 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
age: 7
etag: "221d8352905f2c38b3cb2bd191d630b0"
x-cache: Hit from cloudfront
content-type: image/gif
cache-control: max-age=15, must-revalidate
accept-ranges: bytes
content-length: 43
x-amz-cf-id: c1txOzCTbIEv2jEOc1c4IZ3BcqBCzISD0kjAa-kko8PXuTyDL5KmnQ==

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/316245675/ Frame D63C 2 KB
2 KB 111ms
41ms Script
text/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/316245675/?random=1670534287367&cv=11&fst=1670534287367&bg=ffffff&guid=ON&async=1&gtm=2oabu0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=2&url=https%3A%2F%2Fjonluca.substack.com%2Fembed&ref=https%3A%2F%2Fblog.jonlu.ca%2F&tiba=JonLuca%27s%20Blog%20%7C%20Substack&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-316245675&l=localGaDataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ce71406626378fc3a0b8c6ecca5acfd34abcebde15bdd4e4fc897f086f54652b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://jonluca.substack.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 21:18:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 909
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ Frame DAC3 301 KB
85 KB 44ms
19ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=f67e88f03f037354d7ee8546fcd9e819

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e89612ac8ad22756479b5a0d74e88b551986ef649b9ea237841fed6f6c27f4d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
Origin: https://disqus.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 08 Dec 2022 21:18:07 GMT
content-md5: tQmOj3gyJr88mq5/60RPNw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 86980
x-fb-rlafr: 0
x-fb-debug: yGV/9pqcUcP8/1+HZyAVKra0OS3fCxLH4P8lvBebBRu65m9KdU5RzNbN2wk+JwSbp+i1ujPW7wd40xTmpneHtw==
x-fb-content-md5: e5c303fb3ba903990ac1d8d932ab0f11
cross-origin-opener-policy: same-origin-allow-popups
etag: "f4b2f63f13a1d892128777e31f911e80"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
priority: u=3,i
expires: Fri, 08 Dec 2023 18:42:45 GMT

GET
H3 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.geaHZXF2-fw.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9yYF5eCIYPx4UH9gpJptM2Q_GGxQ/ Frame DAC3 108 KB
36 KB 66ms
21ms Script
text/javascript 2607:f8b0:4006:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.geaHZXF2-fw.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9yYF5eCIYPx4UH9gpJptM2Q_GGxQ/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/api.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e39944fc01cf990f5549bd859de637dde3e36c0f00904e269ed1cf54ab7f8387

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 07 Dec 2022 18:40:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 95875
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36738
x-xss-protection: 0
last-modified: Tue, 01 Nov 2022 15:24:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 07 Dec 2023 18:40:12 GMT

GET
H2 200 status
www.facebook.com/x/oauth/ Frame DAC3 0
0 100ms
43ms Fetch
text/plain 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?ancestor_origins=https%3A%2F%2Fblog.jonlu.ca&client_id=52254943976&input_token&origin=1&redirect_uri=https%3A%2F%2Fdisqus.com%2Fembed%2Fcomments%2F%3Fbase%3Ddefault%26f%3Djonluca%26t_u%3Dhttps%253A%252F%252Fblog.jonlu.ca%252Fposts%252Fsafeway%26t_d%3DReversing%2520private%2520APIs%252C%2520Safeway%252C%2520and%2520not-so-extreme%2520couponing%26t_t%3DReversing%2520private%2520APIs%252C%2520Safeway%252C%2520and%2520not-so-extreme%2520couponing%26s_o%3Ddefault%23version%3D586cf16a4aea9b47994dd412bb125d5c&sdk=joey&wants_cookie_data=false

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
date: Thu, 08 Dec 2022 21:18:07 GMT
x-content-type-options: nosniff
nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01}
document-policy: force-load-at-top
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
alt-svc: h3=":443"; ma=86400
content-length: 0
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: zY7jF5aIdosokonVxfUhVxdofhfnbPGDhgDkHOyzcsReX/afIVcK/o6pKGucZVhffCiPmDEXwUeRk876CCwmIw==
fb-s: unknown
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}],"group":"network-errors"}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://disqus.com
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/316245675/ Frame D63C 42 B
548 B 99ms
51ms Image
image/gif 2607:f8b0:4006:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/316245675/?random=1670534287367&cv=11&fst=1670533200000&bg=ffffff&guid=ON&async=1&gtm=2oabu0&u_w=1600&u_h=1200&frm=2&url=https%3A%2F%2Fjonluca.substack.com%2Fembed&ref=https%3A%2F%2Fblog.jonlu.ca%2F&tiba=JonLuca%27s%20Blog%20%7C%20Substack&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2684576918&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://jonluca.substack.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 21:18:07 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/316245675/ Frame D63C 42 B
64 B 77ms
37ms Image
image/gif 2607:f8b0:4006:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/316245675/?random=1670534287367&cv=11&fst=1670533200000&bg=ffffff&guid=ON&async=1&gtm=2oabu0&u_w=1600&u_h=1200&frm=2&url=https%3A%2F%2Fjonluca.substack.com%2Fembed&ref=https%3A%2F%2Fblog.jonlu.ca%2F&tiba=JonLuca%27s%20Blog%20%7C%20Substack&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2684576918&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:809::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://jonluca.substack.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 21:18:07 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 iframe Show response
accounts.google.com/o/oauth2/ Frame F6D3 283 B
1 KB 109ms
44ms Document
text/html 2607:f8b0:4006:808::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframe

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.geaHZXF2-fw.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9yYF5eCIYPx4UH9gpJptM2Q_GGxQ/cb=gapi.loaded_0?le=scs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:808::200d Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7685c78aaa682d40bbe211fb19d2b57099e29873b4b857d7b95f7017e2043671

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/IdpIFrameHttp/cspreport script-src 'report-sample' 'nonce-81AKFExdy1f3RPZGPugk4w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdpIFrameHttp/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdpIFrameHttp/cspreport/allowlist
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script';report-uri /_/IdpIFrameHttp/cspreport script-src 'report-sample' 'nonce-81AKFExdy1f3RPZGPugk4w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdpIFrameHttp/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdpIFrameHttp/cspreport/allowlist
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 21:18:07 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
server: ESF
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 400 cspreport
accounts.google.com/_/IdpIFrameHttp/ Frame F6D3 2 KB
848 B 86ms
43ms Other
text/html 2607:f8b0:4006:808::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/_/IdpIFrameHttp/cspreport

Requested by

Host: blog.jonlu.ca
URL: https://blog.jonlu.ca/posts/safeway

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:808::200d Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

643f01ab2f82837a96bd3f28b57dc43124635f54f1f883f95d49bf681d2f24cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://accounts.google.com/o/oauth2/iframe
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 21:18:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 1; mode=block
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 m=base Show response
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdpIFrameHttp.en_US.uSgmreNAE_8.es5.O/d=1/rs=AOaEmlFgRLLVVHhyzx03eTJrAWiL0RWjOw/ Frame F6D3 99 KB
35 KB 66ms
20ms Script
text/javascript 2607:f8b0:4006:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdpIFrameHttp.en_US.uSgmreNAE_8.es5.O/d=1/rs=AOaEmlFgRLLVVHhyzx03eTJrAWiL0RWjOw/m=base

Requested by

Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/iframe

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d1118592143115c85dad3633afcff52f7b804d22c1a89844f8fac23d943c011d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 06 Dec 2022 23:04:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 166423
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34872
x-xss-protection: 0
last-modified: Sat, 12 Nov 2022 07:40:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/identity-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/identity-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/identity-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Wed, 06 Dec 2023 23:04:24 GMT

GET
H3 200 iframerpc Show response
accounts.google.com/o/oauth2/ Frame F6D3 49 B
97 B 42ms
41ms XHR
application/json 2607:f8b0:4006:808::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframerpc?action=checkOrigin&origin=https%3A%2F%2Fdisqus.com&client_id=508198334196-bgmagrg0a2rub674g0shidj8fnd50dji.apps.googleusercontent.com

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdpIFrameHttp.en_US.uSgmreNAE_8.es5.O/d=1/rs=AOaEmlFgRLLVVHhyzx03eTJrAWiL0RWjOw/m=base

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:808::200d Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4836b6031bc4af96767f0121fa458714583340054aea6338ef99a1bc4011f43b

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/IdpIFrameHttp/cspreport, script-src 'report-sample' 'nonce-jhqe1cZIu6HMoj1ueocSKg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdpIFrameHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdpIFrameHttp/cspreport/allowlist
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/o/oauth2/iframe
X-Requested-With: XmlHttpRequest
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: require-trusted-types-for 'script';report-uri /_/IdpIFrameHttp/cspreport, script-src 'report-sample' 'nonce-jhqe1cZIu6HMoj1ueocSKg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdpIFrameHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdpIFrameHttp/cspreport/allowlist
content-encoding: gzip
cross-origin-embedder-policy: require-corp
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: same-site
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin; report-to="IdpIFrameHttp"
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site, Origin
report-to: {"group":"IdpIFrameHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdpIFrameHttp/external"}]}
content-type: application/json; charset=utf-8
cache-control: private, max-age=3600
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Thu, 08 Dec 2022 21:18:07 GMT

GET
H/1.1 200
OK / Show response
glitter.services.disqus.com/urls/ Frame DAC3 723 B
885 B 79ms
40ms Script
application/javascript 199.232.196.64
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://glitter.services.disqus.com/urls/?callback=dsqGlitterResponseHandler&forum_shortname=jonluca&thread_id=9209129708&referer=

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.196.64 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

22aed0e16c781cd7243db01056f515fc1c154d2a57e7be0637f2a527f19011d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 21:18:07 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=300; includeSubdomains
Server: openresty
X-Frame-Options: DENY
Vary: Accept-Encoding, Cookie
Content-Type: application/javascript
transfer-encoding: chunked
Cache-Control: no-cache
X-Service: glitter
Content-Disposition: attachment; filename=f.txt
Connection: keep-alive
Cross-Origin-Resource-Policy: cross-origin

GET
H2 200 noavatar92.png
a.disquscdn.com/1668443441/images/ Frame DAC3 2 KB
2 KB 11ms
11ms Image
image/png 199.232.198.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.disquscdn.com/1668443441/images/noavatar92.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.5018287d05b2fa3bc388022cb540d0b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.198.49 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:07 GMT
strict-transport-security: max-age=300; includeSubdomains
x-content-type-options: nosniff
last-modified: Fri, 26 Feb 2021 20:50:09 GMT
server: nginx
x-amz-cf-pop: YUL62-C1
age: 1836048
etag: "60395f01-66c"
content-type: image/png
cache-control: max-age=2592000
cross-origin-resource-policy: cross-origin
content-length: 1644
x-amz-cf-id: nlMva8PiEb0EOYPbFhgePSF4tw-OL8Fk-mxxASb8nnZlz2f_CQvtqQ==
x-xss-protection: 1; mode=block
expires: Sat, 17 Dec 2022 15:17:19 GMT

POST ping
links.services.disqus.com/api/ 0
0

GET
H2 200 pixel.html Show response
live.rezync.com/ Frame D037 687 B
1 KB 154ms
84ms Document
text/html 108.138.106.51
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.rezync.com/pixel.html?c=4656c20ee35215f78e9273796625d90b&cid=cefoale1i6d9fa&pctry=CA&referrer=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway
Requested by: Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.106.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-106-51.jfk50.r.cloudfront.net
Software: lighttpd/1.4.59 /
Resource Hash: ce82776e9e088f0353ac14cb7afded5c8148776cecd9584bcdc4b19935d0dddb

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-length: 687
content-type: text/html; charset=utf-8
date: Thu, 08 Dec 2022 21:18:08 GMT
server: lighttpd/1.4.59
vary: Cookie
via: 1.1 134f499632d1e15750219cb766bdc50c.cloudfront.net (CloudFront)
x-amz-cf-id: 3tL5he0HF_IxD9cXtfys8MivVsiFJhLQFFCHAY0RI2KM4a-Fo97fog==
x-amz-cf-pop: JFK50-P3
x-cache: Miss from cloudfront

GET
H2 200 sync Show response
pippio.com/api/ Frame 6AD0 5 KB
5 KB 74ms
45ms Document
text/html 107.178.254.65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pippio.com/api/sync?pid=1391&ref=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&it=1&iv=cefoale1i6d9fa
Requested by: Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.6dd0bd4924a2cd12ee7c955bcb3718e4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.254.65 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: 1106c3a5a81e19be23ce21a29cc75a13eb4b44662c7824c8801701beb7810320

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store
content-type: text/html
date: Thu, 08 Dec 2022 21:18:07 GMT
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
timing-allow-origin: *
via: 1.1 google

GET
H/1.1

200
OK

/
io.narrative.io/ Frame DAC3
Redirect Chain

https://io.narrative.io/?companyId=19&id=disqus_id%3Acefoale1i6d9fa&ret=img&ref=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway
https://io.narrative.io/?io.narrative.guid.v2=cfb85d30-773d-11ed-b672-0280929c123f&companyId=19&id=disqus_id%3Acefoale1i6d9fa&ret=img&ref=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway

35 B
319 B

24ms
24ms

Image
image/gif

54.147.12.232
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://io.narrative.io/?io.narrative.guid.v2=cfb85d30-773d-11ed-b672-0280929c123f&companyId=19&id=disqus_id%3Acefoale1i6d9fa&ret=img&ref=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway
Protocol: HTTP/1.1
Server: 54.147.12.232 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-147-12-232.compute-1.amazonaws.com
Software: nginx/1.22.0 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 21:18:08 GMT
Cache-Control: no-cache
Server: nginx/1.22.0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif

Redirect headers

Location: https://io.narrative.io/?io.narrative.guid.v2=cfb85d30-773d-11ed-b672-0280929c123f&companyId=19&id=disqus_id%3Acefoale1i6d9fa&ret=img&ref=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway
Date: Thu, 08 Dec 2022 21:18:08 GMT
Server: nginx/1.22.0
Connection: keep-alive
Content-Length: 0

GET
H/1.1

204
No Content

/
io.narrative.io/ Frame DAC3
Redirect Chain

https://obgpm76tt0a0sgozk8l.npdredinuid.imrworldwide.com/narr?gdpr=0&gdpr_consent=&url=https%3A%2F%2Fio.narrative.io%2F%3FcompanyId%3D19%26gdpr%3D0%26gdpr_consent%3D%26id%3Ddisqus_id%3Acefoale1i6d9fa
https://io.narrative.io/?companyId=19&gdpr=0&gdpr_consent=&id=disqus_id:cefoale1i6d9fa&gdpr_consent=&puid=cfba0ae0-773d-11ed-a7b8-fdbc9c0b8db6

0
247 B

43ms
28ms

Image
text/plain

54.147.12.232
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://io.narrative.io/?companyId=19&gdpr=0&gdpr_consent=&id=disqus_id:cefoale1i6d9fa&gdpr_consent=&puid=cfba0ae0-773d-11ed-a7b8-fdbc9c0b8db6
Protocol: HTTP/1.1
Server: 54.147.12.232 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-147-12-232.compute-1.amazonaws.com
Software: nginx/1.22.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 21:18:08 GMT
Cache-Control: no-cache
Server: nginx/1.22.0
Connection: keep-alive

Redirect headers

location: https://io.narrative.io/?companyId=19&gdpr=0&gdpr_consent=&id=disqus_id:cefoale1i6d9fa&gdpr_consent=&puid=cfba0ae0-773d-11ed-a7b8-fdbc9c0b8db6
date: Thu, 08 Dec 2022 21:18:08 GMT
cross-origin-resource-policy: cross-origin
content-length: 0

GET
H/1.1 200
OK event.gif
referrer.disqus.com/juggler/ Frame DAC3 43 B
339 B 30ms
29ms Image
image/gif 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://referrer.disqus.com/juggler/event.gif?abe=0&embed_hidden=0&load_time=857&event=init_embed&thread=9209129708&forum=jonluca&forum_id=7368111&imp=efoaid2jphopi&prev_imp&thread_slug=reversing_private_apis_safeway_and_not_so_extreme_couponing_75&user_type=anon&referrer=https%3A%2F%2Fblog.jonlu.ca%2F&theme=next&dnt=0&tracking_enabled=1&experiment=network_default&variant=fallthrough&service=dynamic&promoted_enabled=true&max_enabled=false

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=jonluca&t_u=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway&t_d=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&t_t=Reversing%20private%20APIs%2C%20Safeway%2C%20and%20not-so-extreme%20couponing&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 21:18:07 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Content-Type: image/gif
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block

GET
H3

200

sync
pippio.com/api/ Frame 6AD0
Redirect Chain

https://idsync.rlcdn.com/462246.gif?partner_uid=cefoale1i6d9fa
https://idsync.rlcdn.com/1000.gif?memo=CKabHBIaChYIARDI-AEaDmNlZm9hbGUxaTZkOWZhEAAaDQiQqcmcBhIFCOgHEABCAEoA
https://pippio.com/api/sync?pid=5324&it=1&iv=fe94ad39b80b42581f2fba2dc667cda0ed1b0adbac314c1752afb2457bf2fecd791426b5417dce21&_=2

42 B
59 B

86ms
85ms

Image
image/gif

107.178.254.65
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pippio.com/api/sync?pid=5324&it=1&iv=fe94ad39b80b42581f2fba2dc667cda0ed1b0adbac314c1752afb2457bf2fecd791426b5417dce21&_=2
Protocol: H3
Server: 107.178.254.65 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://pippio.com/api/sync?pid=5324&it=1&iv=fe94ad39b80b42581f2fba2dc667cda0ed1b0adbac314c1752afb2457bf2fecd791426b5417dce21&_=2
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

sync
pippio.com/api/ Frame 6AD0
Redirect Chain

https://ei.rlcdn.com/448046.gif?n=1&partner_site_id=1017&cparams=placement%3D1391
https://pippio.com/api/sync?pid=5324&_=2

42 B
59 B

131ms
90ms

Image
image/gif

107.178.254.65
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pippio.com/api/sync?pid=5324&_=2
Protocol: H3
Server: 107.178.254.65 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://pippio.com/api/sync?pid=5324&_=2
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

458249.gif
idsync.rlcdn.com/ Frame 6AD0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CO8KEhkKFQgBEPkHGg5jZWZvYWxlMWk2ZDlmYRAAGpcBCI-pyZwGEgQIAhAAEgUIlCkQABIFCOUrEAASBQjmKxAAEgUI5ysQABIFCOgrEAASBQjpKxA...
https://pippio.com/api/sync/ddp?pid=2&m=CO8KEhkKFQgBEPkHGg5jZWZvYWxlMWk2ZDlmYRAAGpcBCI-pyZwGEgQIAhAAEgUIlCkQABIFCOUrEAASBQjmKxAAEgUI5ysQABIFCOgrEAASBQjpKxAAEgUI6isQABIFCOsrEAASBQjsKxAAEgUI7SsQABIFC...
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
https://idsync.rlcdn.com/458249.gif?partner_uid=bf5aadd7-f519-4c7a-928d-1dfa209a52f8

42 B
60 B

43ms
42ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/458249.gif?partner_uid=bf5aadd7-f519-4c7a-928d-1dfa209a52f8
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/458249.gif?partner_uid=bf5aadd7-f519-4c7a-928d-1dfa209a52f8
date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
x-samesite: secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111
content-type: text/html; charset=utf-8

GET
H2

200

px
p.adsymptotic.com/d/ Frame 6AD0
Redirect Chain

https://p.adsymptotic.com/d/px?_pid=13553&_psign=9e62e5c043ecadc9479a0ccac401dd7d
https://p.adsymptotic.com/d/px?_pid=13553&_psign=9e62e5c043ecadc9479a0ccac401dd7d&_expected_cookie=7bea1812b1923acd194097d3be6a356f

43 B
141 B

90ms
88ms

Image
image/gif

104.18.102.194
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.adsymptotic.com/d/px?_pid=13553&_psign=9e62e5c043ecadc9479a0ccac401dd7d&_expected_cookie=7bea1812b1923acd194097d3be6a356f
Protocol: H2
Server: 104.18.102.194 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

p3p: CP='NON DSP COR CONi OUR BUS CNT'
date: Thu, 08 Dec 2022 21:18:08 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 77688824f92ea20e-YYZ
content-length: 43
content-type: image/gif

Redirect headers

location: https://p.adsymptotic.com/d/px?_pid=13553&_psign=9e62e5c043ecadc9479a0ccac401dd7d&_expected_cookie=7bea1812b1923acd194097d3be6a356f
date: Thu, 08 Dec 2022 21:18:08 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 776888244ff0a20e-YYZ
content-length: 0

GET
H3

200

362588.gif
idsync.rlcdn.com/ Frame 6AD0
Redirect Chain

https://rc.rlcdn.com/456809.gif?n=1&cparams=placement%3D1391
https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveramp&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=liveramp&ttd_tpi=1
https://idsync.rlcdn.com/362588.gif?partner_uid=c14987e2-e3a8-430d-8c1b-09f9c5e550ee

42 B
60 B

42ms
42ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362588.gif?partner_uid=c14987e2-e3a8-430d-8c1b-09f9c5e550ee
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

pragma: no-cache
date: Thu, 08 Dec 2022 21:18:08 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://idsync.rlcdn.com/362588.gif?partner_uid=c14987e2-e3a8-430d-8c1b-09f9c5e550ee
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 199

GET
H3

200

362358.gif
idsync.rlcdn.com/ Frame 6AD0
Redirect Chain

https://rc.rlcdn.com/456809.gif?n=2&cparams=placement%3D1391
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEBxfpLdC57KEcX5m8pZh1_Y&google_cver=1

42 B
60 B

43ms
42ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEBxfpLdC57KEcX5m8pZh1_Y&google_cver=1
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

pragma: no-cache
date: Thu, 08 Dec 2022 21:18:08 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEBxfpLdC57KEcX5m8pZh1_Y&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 289
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

396846.gif
idsync.rlcdn.com/ Frame 6AD0
Redirect Chain

https://rc.rlcdn.com/456809.gif?n=3&cparams=placement%3D1391
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://us-u.openx.net/w/1.0/cm?cc=1&id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=cd0828ff-3b81-44ff-b00d-8d9457122db2

42 B
60 B

43ms
42ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=cd0828ff-3b81-44ff-b00d-8d9457122db2
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Thu, 08 Dec 2022 21:18:08 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=cd0828ff-3b81-44ff-b00d-8d9457122db2
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

47154.gif
idsync.rlcdn.com/ Frame 6AD0
Redirect Chain

https://rc.rlcdn.com/456809.gif?n=4&cparams=placement%3D1391
https://sync.mathtag.com/sync/img?mt_exid=10017&redir=https%3A%2F%2Fidsync.rlcdn.com%2F47154.gif%3Fserved_by%3Devergreen%26partner_uid%3D%5BMM_UUID%5D
https://idsync.rlcdn.com/47154.gif?served_by=evergreen&partner_uid=4e666392-5490-4f00-8fec-ddf31ed2bcc7

42 B
60 B

42ms
41ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/47154.gif?served_by=evergreen&partner_uid=4e666392-5490-4f00-8fec-ddf31ed2bcc7
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

Date: Thu, 08 Dec 2022 21:18:08 GMT
Server: MT3 180 1fd3e2d master iad-pixel-x18 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://idsync.rlcdn.com/47154.gif?served_by=evergreen&partner_uid=4e666392-5490-4f00-8fec-ddf31ed2bcc7
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 08 Dec 2022 21:18:07 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 6AD0
Redirect Chain

https://rc.rlcdn.com/456809.gif?n=5&cparams=placement%3D1391
https://s.amazon-adsystem.com/dcm?pid=1f9f6bba-5ede-4cb5-997f-f0d0b894f672&id=&cb=00777933
https://s.amazon-adsystem.com/dcm?pid=1f9f6bba-5ede-4cb5-997f-f0d0b894f672&id=&cb=00777933&dcc=t

43 B
855 B

46ms
45ms

Image
image/gif

52.46.143.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=1f9f6bba-5ede-4cb5-997f-f0d0b894f672&id=&cb=00777933&dcc=t

Protocol

HTTP/1.1

Server

52.46.143.56 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 21:18:08 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: T4NCYQGNB6X0BAY6YW37
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 21:18:08 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: Y9EPBBPF5ZETMA2T05F5
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=1f9f6bba-5ede-4cb5-997f-f0d0b894f672&id=&cb=00777933&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

52154.gif
idsync.rlcdn.com/ Frame 6AD0
Redirect Chain

https://rc.rlcdn.com/456809.gif?n=6&cparams=placement%3D1391
https://ib.adnxs.com/getuid?https%3A%2F%2Fidsync.rlcdn.com%2F52154.gif%3Fserved_by%3Devergreen%26partner_uid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fidsync.rlcdn.com%252F52154.gif%253Fserved_by%253Devergreen%2526partner_uid%253D%2524UID
https://idsync.rlcdn.com/52154.gif?served_by=evergreen&partner_uid=8925242131578874964

42 B
60 B

42ms
41ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/52154.gif?served_by=evergreen&partner_uid=8925242131578874964
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 21:18:08 GMT
AN-X-Request-Uuid: 2b839625-aa20-43b0-8703-16bd9d946e7c
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://idsync.rlcdn.com/52154.gif?served_by=evergreen&partner_uid=8925242131578874964
Connection: keep-alive
X-Proxy-Origin: 149.56.153.186; 149.56.153.186; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

397676.gif
idsync.rlcdn.com/ Frame D037
Redirect Chain

https://ib.adnxs.com/getuid?https%3A//live.rezync.com/sync%3Fc%3D4656c20ee35215f78e9273796625d90b%26p%3D093016b0419d19c905c78c859b815219%26pid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%2F%2Flive.rezync.com%2Fsync%253Fc%253D4656c20ee35215f78e9273796625d90b%2526p%253D093016b0419d19c905c78c859b815219%2526pid%253D%2524UID
https://live.rezync.com/sync?c=4656c20ee35215f78e9273796625d90b&p=093016b0419d19c905c78c859b815219&pid=8690835558948192211
https://p.rfihub.com/cm?pub=39342&in=1&userid=83952af9-e506-44b0-af87-9cb7a65d75b7%3A1670534288.0149646&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3Dcefoale1i6d9fa
https://idsync.rlcdn.com/501709.gif?partner_uid=cefoale1i6d9fa
https://gum.criteo.com/sync?c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397676.gif%3Fserved_by%3Devergreen%26partner_uid%3D%40USERID%40
https://idsync.rlcdn.com/397676.gif?served_by=evergreen&partner_uid=WsrtMx6nnzkV7bCpOHSHJvx_IpYwbvpD

42 B
60 B

41ms
41ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/397676.gif?served_by=evergreen&partner_uid=WsrtMx6nnzkV7bCpOHSHJvx_IpYwbvpD
Requested by: Host: live.rezync.com
URL: https://live.rezync.com/pixel.html?c=4656c20ee35215f78e9273796625d90b&cid=cefoale1i6d9fa&pctry=CA&referrer=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://live.rezync.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/397676.gif?served_by=evergreen&partner_uid=WsrtMx6nnzkV7bCpOHSHJvx_IpYwbvpD
date: Thu, 08 Dec 2022 21:18:07 GMT
cache-control: private, max-age=0, no-cache, no-store, must-revalidate
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 2946416
content-length: 0

GET
H3

200

362358.gif
idsync.rlcdn.com/ Frame D037
Redirect Chain

https://p.rfihub.com/cm?pub=39342&in=1&userid=83952af9-e506-44b0-af87-9cb7a65d75b7%3A1670534288.0149646&forward=https%3A//live.rezync.com/sync%3Fc%3D4656c20ee35215f78e9273796625d90b%26p%3D260a95405...
https://live.rezync.com/sync?c=4656c20ee35215f78e9273796625d90b&p=260a954059a0ab1986e4ee8c5c88c54c&pid=970314636239741992
https://idsync.rlcdn.com/501709.gif?partner_uid=cefoale1i6d9fa
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEBxfpLdC57KEcX5m8pZh1_Y&google_cver=1

42 B
60 B

42ms
41ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEBxfpLdC57KEcX5m8pZh1_Y&google_cver=1
Requested by: Host: live.rezync.com
URL: https://live.rezync.com/pixel.html?c=4656c20ee35215f78e9273796625d90b&cid=cefoale1i6d9fa&pctry=CA&referrer=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://live.rezync.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

pragma: no-cache
date: Thu, 08 Dec 2022 21:18:08 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEBxfpLdC57KEcX5m8pZh1_Y&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 289
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame D037
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3181&partner_device_id=83952af9-e506-44b0-af87-9cb7a65d75b7%3A1670534288.0149646
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3181&partner_device_id=83952af9-e506-44b0-af87-9cb7a65d75b7%3A1670534288.0149646
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=1030a28d-1870-4584-99af-b8202f4a2969%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=c14987e2-e3a8-430d-8c1b-09f9c5e550ee&ttd_puid=1030a28d-1870-4584-99af-b8202f4a2969%2C

95 B
122 B

40ms
40ms

Image
image/png

107.178.246.49
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=c14987e2-e3a8-430d-8c1b-09f9c5e550ee&ttd_puid=1030a28d-1870-4584-99af-b8202f4a2969%2C

Requested by

Host: live.rezync.com
URL: https://live.rezync.com/pixel.html?c=4656c20ee35215f78e9273796625d90b&cid=cefoale1i6d9fa&pctry=CA&referrer=https%3A%2F%2Fblog.jonlu.ca%2Fposts%2Fsafeway

Protocol

Server

107.178.246.49 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

49.246.178.107.bc.googleusercontent.com

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://live.rezync.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type: image/png
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

pragma: no-cache
date: Thu, 08 Dec 2022 21:18:08 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=c14987e2-e3a8-430d-8c1b-09f9c5e550ee&ttd_puid=1030a28d-1870-4584-99af-b8202f4a2969%2C
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 353

GET
H3

200

396846.gif
idsync.rlcdn.com/ Frame 6AD0
Redirect Chain

https://rc.rlcdn.com/456809.gif?n=7&cparams=placement%3D1391
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=cd0828ff-3b81-44ff-b00d-8d9457122db2

42 B
60 B

43ms
42ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=cd0828ff-3b81-44ff-b00d-8d9457122db2
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Thu, 08 Dec 2022 21:18:08 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=cd0828ff-3b81-44ff-b00d-8d9457122db2
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

362358.gif
idsync.rlcdn.com/ Frame 6AD0
Redirect Chain

https://rc.rlcdn.com/456809.gif?n=8&cparams=placement%3D1391
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEBxfpLdC57KEcX5m8pZh1_Y&google_cver=1

42 B
60 B

42ms
42ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEBxfpLdC57KEcX5m8pZh1_Y&google_cver=1
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

pragma: no-cache
date: Thu, 08 Dec 2022 21:18:08 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEBxfpLdC57KEcX5m8pZh1_Y&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 289
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

47154.gif
idsync.rlcdn.com/ Frame 6AD0
Redirect Chain

https://rc.rlcdn.com/456809.gif?n=9&cparams=placement%3D1391
https://sync.mathtag.com/sync/img?mt_exid=10017&redir=https%3A%2F%2Fidsync.rlcdn.com%2F47154.gif%3Fserved_by%3Devergreen%26partner_uid%3D%5BMM_UUID%5D
https://idsync.rlcdn.com/47154.gif?served_by=evergreen&partner_uid=4e666392-5490-4f00-8fec-ddf31ed2bcc7

42 B
60 B

45ms
44ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/47154.gif?served_by=evergreen&partner_uid=4e666392-5490-4f00-8fec-ddf31ed2bcc7
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

Date: Thu, 08 Dec 2022 21:18:08 GMT
Server: MT3 180 1fd3e2d master iad-pixel-x3 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://idsync.rlcdn.com/47154.gif?served_by=evergreen&partner_uid=4e666392-5490-4f00-8fec-ddf31ed2bcc7
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 08 Dec 2022 21:18:07 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 6AD0
Redirect Chain

https://rc.rlcdn.com/456809.gif?n=10&cparams=placement%3D1391
https://s.amazon-adsystem.com/dcm?pid=1f9f6bba-5ede-4cb5-997f-f0d0b894f672&id=45dcbfe0cd7bed8d9ff26e707f9e24e2b37a0350115223dd0cfb53c4ce3da7b4c0cb235b3774c97e&cb=02911725

43 B
855 B

31ms
30ms

Image
image/gif

52.46.143.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=1f9f6bba-5ede-4cb5-997f-f0d0b894f672&id=45dcbfe0cd7bed8d9ff26e707f9e24e2b37a0350115223dd0cfb53c4ce3da7b4c0cb235b3774c97e&cb=02911725

Protocol

HTTP/1.1

Server

52.46.143.56 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 21:18:08 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 9QVWTMV7TD6G40D5VC4N
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://s.amazon-adsystem.com/dcm?pid=1f9f6bba-5ede-4cb5-997f-f0d0b894f672&id=45dcbfe0cd7bed8d9ff26e707f9e24e2b37a0350115223dd0cfb53c4ce3da7b4c0cb235b3774c97e&cb=02911725
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

362588.gif
idsync.rlcdn.com/ Frame 6AD0
Redirect Chain

https://rc.rlcdn.com/456809.gif?n=11&cparams=placement%3D1391
https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveramp&ttd_tpi=1
https://idsync.rlcdn.com/362588.gif?partner_uid=c14987e2-e3a8-430d-8c1b-09f9c5e550ee

42 B
60 B

42ms
41ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362588.gif?partner_uid=c14987e2-e3a8-430d-8c1b-09f9c5e550ee
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

pragma: no-cache
date: Thu, 08 Dec 2022 21:18:08 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://idsync.rlcdn.com/362588.gif?partner_uid=c14987e2-e3a8-430d-8c1b-09f9c5e550ee
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 199

GET
H3

200

362248.gif
idsync.rlcdn.com/ Frame 6AD0
Redirect Chain

https://rc.rlcdn.com/456809.gif?n=12&cparams=placement%3D1391
https://dpm.demdex.net/ibs:dpid=477&dpuuid=ab1a330e8a6599085dc05e63bf5f4e42ceb2c79585beb999487716651c7eecd3b0da87c991749652&redir=https%3A%2F%2Fidsync.rlcdn.com%2F362248.gif%3Fpartner_uid%3D%24%7BD...
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=477&dpuuid=ab1a330e8a6599085dc05e63bf5f4e42ceb2c79585beb999487716651c7eecd3b0da87c991749652&redir=https%3A%2F%2Fidsync.rlcdn.com%2F362248.gif%3...
https://idsync.rlcdn.com/362248.gif?partner_uid=19320867297869364443730348400978783029

42 B
60 B

42ms
42ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362248.gif?partner_uid=19320867297869364443730348400978783029
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

DCS: dcs-prod-usw2-1-v041-0cd2b8174.edge-usw2.demdex.com 14 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: 8D71gJWITxg=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://idsync.rlcdn.com/362248.gif?partner_uid=19320867297869364443730348400978783029
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame 6AD0
Redirect Chain

https://rc.rlcdn.com/456809.gif?n=13&cparams=placement%3D1391
https://usermatch.krxd.net/um/v2?partner=liveramp
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=liveramp

0
339 B

79ms
23ms

Image
text/plain

54.80.144.2
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=liveramp
Protocol: H2
Server: 54.80.144.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-80-144-2.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-served-by: beacon-n033-ash-prod.krxd.net
date: Thu, 08 Dec 2022 21:18:08 GMT
cache-control: private, no-cache, no-store
x-request-time: D=50 t=1670534288
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=liveramp
date: Thu, 08 Dec 2022 21:18:08 GMT
x-cache-hits: 0
x-age: 0
content-length: 0
x-cache: MISS
x-served-by: usermatch-a004-ash-prod.krxd.net

GET
H3

200

401696.gif
idsync.rlcdn.com/ Frame 6AD0
Redirect Chain

https://rc.rlcdn.com/456809.gif?n=14&cparams=placement%3D1391
https://tags.bluekai.com/site/2035?phint=rluid=f7ba6da6b4ab93e807f9df5d81c931ae7f8265185e95b7dedaa121ba9a1ae7472971936f2f944561&redir=https%3A%2F%2Fidsync.rlcdn.com%2F401696.gif%3Fpartner_uid%3D%24...
https://idsync.rlcdn.com/401696.gif?partner_uid=FAfN1PCA999fB8JM

42 B
60 B

42ms
41ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/401696.gif?partner_uid=FAfN1PCA999fB8JM
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/401696.gif?partner_uid=FAfN1PCA999fB8JM
date: Thu, 08 Dec 2022 21:18:08 GMT
content-length: 0
bk-server: fa16
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET
H3

200

397676.gif
idsync.rlcdn.com/ Frame 6AD0
Redirect Chain

https://rc.rlcdn.com/456809.gif?n=15&cparams=placement%3D1391
https://gum.criteo.com/sync?c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397676.gif%3Fserved_by%3Devergreen%26partner_uid%3D%40USERID%40
https://gum.criteo.com/sync?s=1&c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397676.gif%3Fserved_by%3Devergreen%26partner_uid%3D%40USERID%40
https://idsync.rlcdn.com/397676.gif?served_by=evergreen&partner_uid=-UyXbaLKB-KLOEUN2K_vA3PDaiFLKwkv

42 B
60 B

45ms
44ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/397676.gif?served_by=evergreen&partner_uid=-UyXbaLKB-KLOEUN2K_vA3PDaiFLKwkv
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/397676.gif?served_by=evergreen&partner_uid=-UyXbaLKB-KLOEUN2K_vA3PDaiFLKwkv
date: Thu, 08 Dec 2022 21:18:08 GMT
cache-control: private, max-age=0, no-cache, no-store, must-revalidate
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 2447932
content-length: 0

GET
H2

204

sync
idsync.reson8.com/sources/pixel/v1/ Frame 6AD0
Redirect Chain

https://rc.rlcdn.com/456809.gif?n=16&cparams=placement%3D1391
https://idsync.reson8.com/sources/pixel/v1/sync?sourcekey=01EC61A11KAM4QCFG5RN38VQJZ

0
97 B

145ms
81ms

Image
text/plain

104.18.20.134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://idsync.reson8.com/sources/pixel/v1/sync?sourcekey=01EC61A11KAM4QCFG5RN38VQJZ

Protocol

Server

104.18.20.134 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 21:18:08 GMT
strict-transport-security: max-age=15552000
server: cloudflare
cf-ray: 77688826683a5413-YYZ
vary: Accept-Encoding

Redirect headers

date: Thu, 08 Dec 2022 21:18:08 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://idsync.reson8.com/sources/pixel/v1/sync?sourcekey=01EC61A11KAM4QCFG5RN38VQJZ
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: links.services.disqus.com
URL: https://links.services.disqus.com/api/ping

Verdicts & Comments Add Verdict or Comment

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

45 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
blog.jonlu.ca/posts	1969-12-31 23:59:59	Name: _ga4s Value: 1
blog.jonlu.ca/posts	1969-12-31 23:59:59	Name: _ga4sid Value: 690416871
.jonlu.ca/	1970-01-20 17:38:14	Name: _ga_L7B5KF4CGL Value: GS1.1.1670534286.1.0.1670534286.60.0.0
.jonlu.ca/	1970-01-20 17:38:14	Name: _ga Value: GA1.1.411949651.1670534286
.jonlu.ca/	1970-01-20 17:38:14	Name: _ga4 Value: 89502ec0-ec7a-4244-a299-cb4a3e0e5302
.jonlu.ca/	1970-01-20 17:28:09	Name: _pk_id.1.ed34 Value: 3f76d60e315da28d.1670534286.
.jonlu.ca/	1970-01-20 08:02:16	Name: _pk_ses.1.ed34 Value: 1
.substack.com/	1970-01-20 08:02:16	Name: __cf_bm Value: a21oKnFZL.Vp1X0yoSAX3t14cokMmY0ko2kvUjBv270-1670534286-0-AWu++Ax5/IYonb2zcrpUa/5qGWPDPM/adou3v/L4PymI80OOXCMGVwBqqWCFZDLDN5tOl/qWr0R6PjrQMFEF4M0=
.disqus.com/	1970-01-20 16:47:50	Name: disqus_unique Value: efoale1i6d9fa
disqus.com/	1970-01-20 08:02:16	Name: __jid Value: efoa6q3lult8u
.google.com/	1970-01-20 12:25:45	Name: NID Value: 511=vfVqxtGUvb10ihm8tpBN1iaB4RtsZhTybcnuEqOaBxJEaDNhPsqIi7mf6TU6Ceqmh6KnO7Yifn27hn9B4AH37kF7tXUg8BzFvlRGfFeRf3nyljTSGKeaOEkhEvK6vIXtZkPOB0NRExGmrfJ4jj3mBIGsPvgBmELnc7fLDmVR44E
.pippio.com/	1970-01-20 16:47:50	Name: did Value: vPofJbmZG03mKCaw
.pippio.com/	1970-01-20 16:47:50	Name: didts Value: 1670534287
.pippio.com/	1970-01-20 09:28:38	Name: nnls Value:
io.narrative.io/	1970-01-20 17:38:14	Name: io.narrative.guid.v2 Value: cfb85d30-773d-11ed-b672-0280929c123f
.rezync.com/	1970-01-20 17:23:21	Name: zync-uuid Value: 83952af9-e506-44b0-af87-9cb7a65d75b7:1670534288.0149646
live.rezync.com/	1970-01-20 17:23:50	Name: sd-session-id Value: .eJwNyUsOhCAQANG79FomoNB8LmMaaBISB2dEV8a7y65e6ob1x8eXGrcTwnlcPEHa6lCHcEOu_X-NgsRlp41VxewLwTNB597r3taax3aLNzMVL9hIFFpHKag4K3yKltBka6INCq00i56d-0ilPWqE5wW4ECar.Y5JUkA.vyOF6JHyDkXE766Fm8jTOahd4Ug
.rlcdn.com/	1970-01-20 16:47:50	Name: rlas3 Value: heniLvnPOLxYuTvhO2MELz24BfH3f/xLuoN8qmn77pA=
.doubleclick.net/	1970-01-20 17:38:14	Name: IDE Value: AHWqTUlpD7rdXxLc8N9FGh4MMCoRPwiPLacBmyhuQxGFO9-LnJxbDN1vExx1qrMukuI
.openx.net/	1970-01-20 16:47:50	Name: i Value: 4b6268c0-5f41-4d68-b5a2-c58f0aae7f97\|1670534288
.adsymptotic.com/	1970-01-20 10:11:50	Name: U Value: 7bea1812b1923acd194097d3be6a356f
.adsrvr.org/	1970-01-20 16:47:50	Name: TDID Value: c14987e2-e3a8-430d-8c1b-09f9c5e550ee
.tapad.com/	1970-01-20 09:28:38	Name: TapAd_TS Value: 1670534288137
.tapad.com/	1970-01-20 09:28:38	Name: TapAd_DID Value: 1030a28d-1870-4584-99af-b8202f4a2969
.rfihub.com/	1970-01-20 17:23:50	Name: rud Value: H4sIAAAAAAAA_-MSsjQ3MDY0MTM2MzK2NDcxtLQ0EuIz1HVLLjasdI7MKgiKzwMAmVcTACQAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: euds Value: H4sIAAAAAAAA_wXBwRGAMAgEwI_t4JDk4MBuQE0hVu7udzBW2qyd8pq6AK1SOyh5N8vtoTWv4VRbmBGnDqTDf6L3teQ6AAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSsjQ3MDY0MTM2MzK2NDcxtLQ0EuIz1HVLLjasdI7MKgiKzwMAmVcTACQAAAA
.mathtag.com/	1970-01-20 17:28:09	Name: uuid Value: 4e666392-5490-4f00-8fec-ddf31ed2bcc7
.adnxs.com/	1970-01-20 10:11:50	Name: uuid2 Value: 8925242131578874964
.pippio.com/	1970-01-20 09:28:38	Name: pxrc Value: CI+pyZwGEgUIlCkQABIFCOUrEAASBQjmKxAAEgUI5ysQABIFCOgrEAASBQjpKxAAEgUI6isQABIFCOsrEAASBQjsKxAAEgUI7SsQABIFCO4rEAASBQjVQxAAEgUI3k4QABIGCOOvKxAAEgYI7a8rEAASBgjurysQABIGCO+vKxAAEgYI8K8rEAASBgjxrysQAA==
.amazon-adsystem.com/	1970-01-20 12:57:26	Name: ad-id Value: A_j6aeU9yU59mxKKjm0cJCQ
.amazon-adsystem.com/	1970-01-20 17:38:14	Name: ad-privacy Value: 0
.tapad.com/	1970-01-20 09:28:38	Name: TapAd_3WAY_SYNCS Value: 1!8229
.linksynergy.com/	1970-01-20 16:47:50	Name: rmuid Value: bf5aadd7-f519-4c7a-928d-1dfa209a52f8
.linksynergy.com/	1970-01-20 16:47:50	Name: icts Value: 2022-12-08T21:18:08Z
.adsrvr.org/	1970-01-20 16:47:50	Name: TDCPM Value: CAESFAoFdGFwYWQSCwiOxr_F99qsOxAFGAEgASgCMgsItKGF843brDsQBTgBWghsaXZlcmFtcGAC
.rfihub.com/	1970-01-20 17:23:50	Name: eud Value: H4sIAAAAAAAA_0XIuxWAMAgAwAmsMgc-CH-3ATUDWTqtpVfeMzw4ddZKuBUNRBqhVjjk2V6ml2v7QeaoLDNiR5I0sXdsf_KkDwONe-hKAAAA
.criteo.com/	1970-01-20 17:23:50	Name: uid Value: 01958560-2249-4eb9-a879-e5ccade1eb92
.rlcdn.com/	1970-01-20 09:28:38	Name: pxrc Value: CJCpyZwGEgYItuoBEAASBgi+6gEQABIGCOrqARAA
.krxd.net/	1970-01-20 12:21:26	Name: _kuid_ Value: PPwXzqG6
.bluekai.com/	1970-01-20 12:21:26	Name: bkdc Value: phx
.bluekai.com/	1970-01-20 12:21:26	Name: bkpa Value: KJyPMgWvyM9xxnXZMgVU8JnKDWxHxj050bVUt/eVALqOFf4YZ28ql7fBBK8NSdYyEcZr4UkILFEJOlqYnkQmjsnUIAuuDeGR0xOc7pg+We31C1anasqxWJMTcblU8/s1up3H+KCQPbnA6AINn3L0HbDFsN7Vfpyt8E7vl/pFNbjLYT8zXXCJZzFYozbheBrx1ZKkfKAtlmdUXb9H9UIKTM4i
.bluekai.com/	1970-01-20 12:21:26	Name: bku Value: Xyz99JODAZ1Pn4Dh
.demdex.net/	1970-01-20 12:21:26	Name: demdex Value: 19320867297869364443730348400978783029
.dpm.demdex.net/	1970-01-20 12:21:26	Name: dpm Value: 19320867297869364443730348400978783029

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	(Line 6) Message: This document requires 'TrustedScript' assignment.
network	error	URL: https://accounts.google.com/_/IdpIFrameHttp/cspreport Message: Failed to load resource: the server responded with a status of 400 ()
javascript	error	URL: https://blog.jonlu.ca/posts/safeway Message: Access to XMLHttpRequest at 'https://links.services.disqus.com/api/ping' from origin 'https://blog.jonlu.ca' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://links.services.disqus.com/api/ping Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.disquscdn.com
accounts.google.com
analytics.google.com
apis.google.com
beacon.krxd.net
blog.jonlu.ca
c.disquscdn.com
cdn.viglink.com
cm.g.doubleclick.net
connect.facebook.net
disqus.com
dpm.demdex.net
ei.rlcdn.com
glitter.services.disqus.com
googleads.g.doubleclick.net
gum.criteo.com
ib.adnxs.com
idsync.reson8.com
idsync.rlcdn.com
io.narrative.io
j.jonlu.ca
jonluca.disqus.com
jonluca.substack.com
js.sentry-cdn.com
links.services.disqus.com
live.rezync.com
match.adsrvr.org
obgpm76tt0a0sgozk8l.npdredinuid.imrworldwide.com
p.adsymptotic.com
p.rfihub.com
pippio.com
pixel.tapad.com
rc.rlcdn.com
referrer.disqus.com
s.amazon-adsystem.com
static.cloudflareinsights.com
stats.g.doubleclick.net
substackcdn.com
sync.mathtag.com
tags.bluekai.com
tags.rd.linksynergy.com
us-u.openx.net
usermatch.krxd.net
www.facebook.com
www.google.ca
www.google.com
www.googletagmanager.com
www.gstatic.com
links.services.disqus.com
104.18.102.194
104.18.20.134
107.178.246.49
107.178.254.65
108.138.106.51
108.138.128.110
142.251.35.162
151.101.0.134
199.232.192.134
199.232.196.134
199.232.196.64
199.232.198.49
199.38.167.131
2600:9000:2209:9600:4:b4b9:d3c0:93a1
2600:9000:24f1:6800:6:8656:f5c0:93a1
2606:4700:3108::ac42:2b57
2606:4700:4400::ac40:9a0b
2606:4700::6810:3865
2607:f8b0:4004:c08::9c
2607:f8b0:4006:808::200d
2607:f8b0:4006:809::2003
2607:f8b0:4006:809::200e
2607:f8b0:4006:817::2003
2607:f8b0:4006:821::2004
2607:f8b0:4006:823::200e
2607:f8b0:4006:824::2002
2607:f8b0:4006:824::2008
2620:100:a001::c
2a03:2880:f012:8:face:b00c:0:1
2a03:2880:f112:83:face:b00c:0:25de
2a04:4e42:400::729
3.229.38.178
3.33.220.150
34.200.201.129
34.98.64.218
34.98.67.3
35.190.60.146
52.41.79.126
52.46.143.56
54.147.12.232
54.80.144.2
68.67.161.208
72.247.65.183
74.121.140.14
031ae69b49b033571c622c2a4a447270636170abb5454c1dc7dc892471cf5a47
0a076ccbecfffcdd0c389dafdb5e1b4712faf8c953e8040721b7465330a66b2d
0c92d67c95143296cdb2f70d3c8399e3f5216be6d95d60309d9a978f127925f9
0e227650d404119f37b12014b92a4f681ca4f9249e61b686eb19eae43b824895
0f48c5678ce459a596423b0e55344e7ad8eb3d3b1b27c54cd76a9d4cee7dd6c3
1106c3a5a81e19be23ce21a29cc75a13eb4b44662c7824c8801701beb7810320
1271c635c43cb3864573fb589576861a385125cce25146e1d7b9617571c70836
148b9c1402554a9ea9226860dfe63aa3f8d0ad59d1cd6a4370fd3e44af6154a3
1707dd92cee6511bbf265dec2a1449691a93086b170a83e49fe37d674371a2be
178391f38859ccdf417361a9333f2dbc8b0555937bd8ed14b9755affed0aed5e
1996a5a1c1f5b77c4f79b2f4a1dbd032eeafc94954dc14ac975bb083fd1ac75c
22aed0e16c781cd7243db01056f515fc1c154d2a57e7be0637f2a527f19011d6
278f7c9d80a080385d0ac988d5dc97b7ec33d0ae378a4d8ae58afb6f03cb156d
3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4
36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3eee15d11eb29b6f2258cabfeeca39b3b900a7cae96fc7919b27789f3470b9f9
40de9653ef9baab8690a292219530676e022cf68f5e68d65fced61537e259182
4836b6031bc4af96767f0121fa458714583340054aea6338ef99a1bc4011f43b
4876df16c05a59bd5af8ecbfa095b6ad57ac3ed6e434b793721271c952e7e140
4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c
56a8c951ff996aaea9015fff286bf02ec6ccf89517f3a368e04ab415d2f551af
5b84a6efef52101adc547e4cea0fd0db030c7d4ed36e9161ebc58c49057f0f5d
61301b185cdc60dac7e560179a8f95541e850b8cc6ec975a8c6fed2d221b12a8
643f01ab2f82837a96bd3f28b57dc43124635f54f1f883f95d49bf681d2f24cd
66292fcb3995cbb5d7720043436c11b4c3c42a3fcba0f861144864008f88047a
66effb180c503ebd83897179839500ba0718e2350243f068c910f7c5ff4f6bdc
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b14bffa5a0f903538cbde31fe3455a23f8515152156fdf8a21aeb131b89dd54
7685c78aaa682d40bbe211fb19d2b57099e29873b4b857d7b95f7017e2043671
7775ea04f586b364771eaedb8d6c0eb4aec9ef8eb063afae02f10479acde6800
789cf6f93d6e14e0beaecf688e2996bfc6e96ba9fa8275ccf0051e1bd7c2d931
7ff7fcb452fcd96b53604bafd046840b2f16d9fd89b60b5607fffdaef27805dc
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8dd28e7681ada525cd32f48f07ae01c558153b1cdecf40c597478621b2988043
8e39c669fe173ad27c5bccbc4cb462a4280bfc648b848eaf431d35e9d5f91217
92ef0af03bcaadbec78568a8476b7db5b33195b94df73319c79f3370e8e060c5
932e95948cd89a021728e29ff82ab9a24fcdc247cf9a4871e2251b6ad9a728da
9438cca9781769927e394ec9c578bd1387f4fc37fc92ad8090a8a90823047e55
9714221c828961b20f45a782c3281c0596f6652cfe1299bee18097f98e8fb7b3
9cd7b0340ae7f0f4e88ef42b617e74bd9275632ab74c1ad2d4815810de414285
9e5c15580c6b9b0db29719a0db5a12864ffaeace46e7a7bd9ef3944e90ddc5aa
9efb3d5e1b082a66bd94908b42afb4cf6fe0e8eb8f50b8d2a18f6a5da03e6a18
a7e4e399ba1cd535c0c5af818d9282b7fed39cf44c0fe9842f2c56e3d2579df6
afd59f64bc9e93d71345d0d92af50053c45205475ecd0347c61bb80930775bfd
b0943ffff1fc17a422bfae370455f154310db3e87e17dae66ca21d1c5679443d
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb61e2816e5d5e791c393c2c7b4f1ceb77988410a9453bb9cf187af0734e825c
bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c462fbe989bc7e25420ac5f49e8733967731313c58fd0ea0bd7efc0967a91075
ce71406626378fc3a0b8c6ecca5acfd34abcebde15bdd4e4fc897f086f54652b
ce82776e9e088f0353ac14cb7afded5c8148776cecd9584bcdc4b19935d0dddb
cf2bf77432c68a007189bfc6945cc1a4a2f9faf0df326a1db13f7fca61c7e2df
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d1118592143115c85dad3633afcff52f7b804d22c1a89844f8fac23d943c011d
d38131b25cf8046eea120b271d661da4e1b47e95c52f82eb34a9ab7bb90ee883
d7fc375178c93a2fc15fd888e30170eedf4ef3d04497e7f951ab7bfe0c921693
dbe12aeb98f08ca84530a563776d55df27c010dddaafe7e872614dad01e3d8d2
e39944fc01cf990f5549bd859de637dde3e36c0f00904e269ed1cf54ab7f8387
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e54bda451bb81f99cf473297523f48b6c313510fee73931956737575456ab9fb
e89612ac8ad22756479b5a0d74e88b551986ef649b9ea237841fed6f6c27f4d4
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5
f4bf0526811a58a52c05b50c0c124e68cdca1ad88a70c8809635b5deedf841d0
f84d896a162d364e92e52e8d5abc58cac18e479fa315d637d9daace960d42648
fd75f8a07fe97547a72567714651409cb00381c822320f534a05a0ff93c2b1fd
fe0fdfaa945380dbfd0bc522d79704c34bd81dc0b933bb2e9651861bd001e8f8

blog.jonlu.ca Open in urlscan Pro 2606:4700:3108::ac42:2b57 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

109 Requests

76 %HTTPS

41 %IPv6

34 Domains

48 Subdomains

33 IPs

2 Countries

2057 kBTransfer

5416 kBSize

45 Cookies

6 Outgoing links

Redirected requests

109 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

blog.jonlu.ca Open in urlscan Pro
2606:4700:3108::ac42:2b57 Public Scan

Screenshot
Live screenshot

Full Image

109
Requests

76 %
HTTPS

41 %
IPv6

34
Domains

48
Subdomains

33
IPs

2
Countries

2057 kB
Transfer

5416 kB
Size

45
Cookies

109 HTTP transactions
2 data transactions