nowtoronto.com Open in urlscan Pro
15.222.204.79 Public Scan

Software

sffe /

Resource Hash

4b5605b858ed9bc2d4d9a129dd7c596dfcbab59ec6175616e70489de3d67e583

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1028 / 578 of 1000 / last-modified: 1635545117"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27324
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 30 Oct 2021 06:39:55 GMT

GET
H2 200 1_061d9131.js Show response
nowtoronto.com/wp-content/themes/media_central/dist/scripts/ 18 KB
4 KB 12ms
12ms Script
application/javascript 15.222.204.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nowtoronto.com/wp-content/themes/media_central/dist/scripts/1_061d9131.js
Requested by: Host: du9bj9c2s4nh.cloudfront.net
URL: https://du9bj9c2s4nh.cloudfront.net/wp-content/themes/media_central/dist/scripts/main_061d9131.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 15.222.204.79 Montreal, Canada, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-15-222-204-79.ca-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: b8f02aee2a5a9b6b7ec3ef1e63628845cb061b9f603af622da9e138260032e4a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:55 GMT
content-encoding: br
last-modified: Fri, 29 Oct 2021 17:53:25 GMT
server: nginx
x-powered-by: PleskLin
etag: W/"617c3515-47fd"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *

GET
H2 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 284 KB
68 KB 22ms
21ms Script
application/javascript 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151508
Requested by: Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b63fe792eca92d7cb67c652ddc4e76692c7f7f0899316ada620039b6438b8961

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:55 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 39
etag: W/"fff10df2ca37ad0e879283b24dd072d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 6a62a6323d947148-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Tue, 02 Nov 2021 06:39:55 GMT

GET
H2 200 script.js Show response
sb.freeskreen.com/publisher/ 72 KB
22 KB 234ms
161ms Script
text/html 3.229.194.186
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.freeskreen.com/publisher/script.js?pid=219&ut=&uts=&flc=unknown&slc=unknown&windowlocation=https%3A%2F%2Fnowtoronto.com%2F&gdpr=-1&cs=-1
Requested by: Host: static.freeskreen.com
URL: https://static.freeskreen.com/publisher/219/freeskreen.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.229.194.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-229-194-186.compute-1.amazonaws.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 501540758bf5be47d27f7a4262c23b5c6ae4c9f90cf47e3db715570ecd15531f

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:55 GMT
content-encoding: gzip
server: Apache/2.4.29 (Ubuntu)
vary: Accept-Encoding
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store, must-revalidate
content-type: text/html;charset=UTF-8
content-length: 21762
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
441 B 134ms
54ms XHR
text/plain 2607:f8b0:4023:1404::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-3462111-1&cid=283783354.1635575995&jid=1116955081&gjid=726311352&_gid=489409343.1635575995&_u=YGBAgEABAAAAAE~&z=1523719781

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4023:1404::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sat, 30 Oct 2021 06:39:55 GMT
content-type: text/plain
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
194 B 19ms
18ms Image
image/gif 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j93&a=901859952&t=pageview&_s=1&dl=https%3A%2F%2Fnowtoronto.com%2F&ul=en-us&de=UTF-8&dt=Everything%20Toronto%20%7C%20NOW%20Magazine%20-%20News%20-%20Life%20-%20Culture%20-%20Real%20Estate&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEAB~&jid=1116955081&gjid=726311352&cid=283783354.1635575995&tid=UA-3462111-1&_gid=489409343.1635575995&gtm=2wgar0MCDBPJR&cg1=frontpage&cg3=single-page&cg4=NOW%20Staff&cg5=NOW%20Staff&z=489786252

Requested by

Host: nowtoronto.com
URL: https://nowtoronto.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Oct 2021 15:36:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54182
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 231578281436169 Show response
connect.facebook.net/signals/config/ 305 KB
88 KB 22ms
21ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/231578281436169?v=2.9.48&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

441cf828cd901b743f9036896676d721258a4f86b61dbfb49078f4814d61d2e3

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 88974
x-xss-protection: 0
pragma: public
x-fb-debug: t1f2ogV9DXEKCJc6n/ctT2mJkTt7g7rKRzs2JGvnLsKdpIqaIxnD5muzgaVKHh/bhWU3rk/GsewkUv8/2tsH7Q==
x-fb-trip-id: 1512268381
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Sat, 30 Oct 2021 06:39:55 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 web Show response
onesignal.com/api/v1/sync/fe61f261-134c-4c90-9d73-146b6f97786b/ 4 KB
2 KB 27ms
16ms Script
text/javascript 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/sync/fe61f261-134c-4c90-9d73-146b6f97786b/web?callback=__jp0

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151508

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a1e9c0debb1642c36fbe0310d27331d77238d9e201622b6d122e2856f856db35

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:55 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1987
cf-polished: origSize=4469
status: 200 OK
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: cac0d6ee-cb65-4421-8fe2-684a09c4b5cf
x-runtime: 0.032268
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"868c7cd94e2cc8e1b4d54931d7618791"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600
cf-ray: 6a62a632ce1c7148-YUL
access-control-allow-headers: SDK-Version
expires: Sat, 30 Oct 2021 07:39:55 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
424 B 68ms
19ms Image
image/gif 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=231578281436169&ev=PageView&dl=https%3A%2F%2Fnowtoronto.com%2F&rl=&if=false&ts=1635575995355&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=30&fbp=fb.1.1635575995354.1810873422&it=1635575995293&coo=false&exp=p1&rqm=GET

Requested by

Host: nowtoronto.com
URL: https://nowtoronto.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:55 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Sat, 30 Oct 2021 06:39:55 GMT

GET
H2 200 OneSignalSDKStyles.css
onesignal.com/sdks/ 82 KB
9 KB 18ms
17ms Stylesheet
text/css 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2
Requested by: Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151508
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:55 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 35
etag: W/"4e9aaefffd5f8ae7dc83361aa2294190"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=259200
cf-ray: 6a62a6333e7f7148-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Tue, 02 Nov 2021 06:39:55 GMT

GET
H/1.1 200
OK embed.js Show response
downloads.mailchimp.com/js/signup-forms/popup/unique-methods/ 128 KB
46 KB 86ms
24ms Script
application/javascript 99.84.41.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/js/signup-forms/popup/unique-methods/embed.js
Requested by: Host: chimpstatic.com
URL: https://chimpstatic.com/mcjs-connected/js/users/66f9ff05440f87925e70b601c/66455e9c48157fa4ffad457a2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.41.61 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-41-61.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d8c3fbef87d09c09c57ca16e8f7bd8b62d531ccf2aebd4056b73b6395869bca0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 06:39:50 GMT
Content-Encoding: gzip
Last-Modified: Mon, 27 Jul 2020 14:05:46 GMT
Server: AmazonS3
Age: 6
ETag: W/"bc4277913601fee0523d85a320c0578a"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 bb784f1db0a47d55a8953c84e49cfa35.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: EWR52-C4
X-Amz-Cf-Id: Tf0Wldtf-nGm2R-HBJ2Lp1Mpl7K6w4hsseDrXml7ZO-3N1qOkKrgyg==

GET
H2 200 icon Show response
onesignal.com/api/v1/apps/fe61f261-134c-4c90-9d73-146b6f97786b/ 192 B
670 B 120ms
97ms Fetch
application/json 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/apps/fe61f261-134c-4c90-9d73-146b6f97786b/icon

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151508

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

173d01a231e5eb14927a49435f33d9e85bbc7c9670c5394d343f4dfb24e2e23e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:55 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
status: 200 OK
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: d40801a8-9940-4482-a951-8e939d0f141b
x-runtime: 0.007423
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"173d01a231e5eb14927a49435f33d9e8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate
cf-ray: 6a62a6337e0decfe-YUL
access-control-allow-headers: SDK-Version

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
296 B 38ms
35ms Image
image/gif 2607:f8b0:4006:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-3462111-1&cid=283783354.1635575995&jid=1116955081&_u=YGBAgEABAAAAAE~&z=728637110

Requested by

Host: nowtoronto.com
URL: https://nowtoronto.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
501 B 103ms
36ms Image
image/gif 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-3462111-1&cid=283783354.1635575995&jid=1116955081&_u=YGBAgEABAAAAAE~&z=728637110

Requested by

Host: nowtoronto.com
URL: https://nowtoronto.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK bm93dG9yb250by5jb20= Show response
tcheck.outbrainimg.com/tcheck/check/ 15 B
462 B 97ms
21ms XHR
application/json 23.52.164.28
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tcheck.outbrainimg.com/tcheck/check/bm93dG9yb250by5jb20=
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.164.28 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-164-28.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 39d160e97e2bea07b0cf1c647259ffa4f0bd07069dba4e6c19a22d38b408510f

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 06:39:55 GMT
ETag: W/"f-ayLlCL3PuzXSThdu78iReSEjl6Y"
Access-Control-Max-Age: 43200
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=22121
Access-Control-Allow-Credentials: false
Connection: keep-alive
X-TraceId: 6f5d3ecce37009e216ac219a4640b0de
Content-Length: 15
Expires: Sat, 30 Oct 2021 12:48:36 GMT

GET
H2 200 px.gif
widget-pixels.outbrain.com/widget/detect/ 43 B
341 B 97ms
18ms Image
image/gif 69.192.110.3
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widget-pixels.outbrain.com/widget/detect/px.gif?ch=1&rn=4.57794412620259
Requested by: Host: nowtoronto.com
URL: https://nowtoronto.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 69.192.110.3 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-110-3.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:55 GMT
last-modified: Wed, 30 Sep 2020 14:22:29 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1601475749.911431"
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 43
expires: Mon, 29 Nov 2021 06:39:55 GMT

GET
H2 200 pubads_impl_2021102701.js Show response
securepubads.g.doubleclick.net/gpt/ 353 KB
119 KB 44ms
42ms Script
text/javascript 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102701.js?31063350

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d07f01e075074db0154aae1cd5fc2f2f3ffe87d787783f686444f5583503437

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 121586
x-xss-protection: 0
last-modified: Wed, 27 Oct 2021 08:34:36 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 30 Oct 2021 06:39:55 GMT

GET
H/1.1 200
OK ac Show response
ww1772.smartadserver.com/ 212 B
1 KB 192ms
53ms Script
application/javascript 199.187.193.140
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://ww1772.smartadserver.com/ac?pgid=662773&insid=7974420&tmstp=335225992&out=js
Requested by: Host: sb.freeskreen.com
URL: https://sb.freeskreen.com/publisher/script.js?pid=219&ut=&uts=&flc=unknown&slc=unknown&windowlocation=https%3A%2F%2Fnowtoronto.com%2F&gdpr=-1&cs=-1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 199.187.193.140 , Canada, ASN47043 (SMARTADSERVER, CA),
Reverse DNS
Software: /
Resource Hash: 461b345c9be55a5a6d0a2b3c9b39b060cdd4d5c7bff2c410b3c6f8b77f17cb25

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:55 GMT
content-encoding: br
vary: Accept-Encoding
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
x-smrt-i: 7974420
cache-control: no-cache,no-store
transfer-encoding: chunked
content-type: application/javascript; charset=UTF-8

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 77A2
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=123456&endpoint=us-west
https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west

281 B
554 B

65ms
21ms

Document
text/html

104.105.42.146
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Requested by: Host: sb.freeskreen.com
URL: https://sb.freeskreen.com/publisher/script.js?pid=219&ut=&uts=&flc=unknown&slc=unknown&windowlocation=https%3A%2F%2Fnowtoronto.com%2F&gdpr=-1&cs=-1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.105.42.146 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-105-42-146.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 26 Oct 2021 17:01:05 GMT
ETag: "40334-119-5cf446c48f640"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sat, 30 Oct 2021 06:39:55 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Date: Sat, 30 Oct 2021 06:39:55 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

GET
H2

200

um
sb.freeskreen.com/
Redirect Chain

https://sync.smartadserver.com/getuid?url=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Fsa%3D%5Bsas_uid%5D
https://sync.smartadserver.com/getuid?url=https://sb.freeskreen.com/um?sa=[sas_uid]&cklb=1
https://sb.freeskreen.com/um?sa=1964693808678375274

43 B
466 B

26ms
26ms

Image
image/gif

3.229.194.186
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/um?sa=1964693808678375274
Requested by: Host: nowtoronto.com
URL: https://nowtoronto.com/
Protocol: H2
Server: 3.229.194.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-229-194-186.compute-1.amazonaws.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:55 GMT
server: Apache/2.4.29 (Ubuntu)
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
expires: -1

Redirect headers

location: https://sb.freeskreen.com/um?sa=1964693808678375274
pragma: no-cache
date: Sat, 30 Oct 2021 06:39:55 GMT
cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

GET
H2

200

um
sb.freeskreen.com/
Redirect Chain

https://scm.publishers.tremorhub.com/pubsync?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Ftlr%3D%5Btvid%5D
https://scm.publishers.tremorhub.com/pubsync/verify?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Ftlr%3D%5Btvid%5D
https://sb.freeskreen.com/um?tlr=330632e860404c8288954d0593ef1ada

43 B
507 B

26ms
25ms

Image
image/gif

3.229.194.186
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/um?tlr=330632e860404c8288954d0593ef1ada
Requested by: Host: nowtoronto.com
URL: https://nowtoronto.com/
Protocol: H2
Server: 3.229.194.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-229-194-186.compute-1.amazonaws.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:55 GMT
server: Apache/2.4.29 (Ubuntu)
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
expires: -1

Redirect headers

location: https://sb.freeskreen.com/um?tlr=330632e860404c8288954d0593ef1ada
date: Sat, 30 Oct 2021 06:39:55 GMT
server: Apache-Coyote/1.1
content-length: 0
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'

GET
H2

200

um
sb.freeskreen.com/
Redirect Chain

https://cs.admanmedia.com/sync/smaato?redir=https%3A%2F%2Fsb.freeskreen.com%2Fum%3Fac%3D{$UID}
https://sb.freeskreen.com/um?ac={$UID}

43 B
425 B

25ms
25ms

Image
image/gif

3.229.194.186
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/um?ac={$UID}
Requested by: Host: nowtoronto.com
URL: https://nowtoronto.com/
Protocol: H2
Server: 3.229.194.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-229-194-186.compute-1.amazonaws.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:55 GMT
server: Apache/2.4.29 (Ubuntu)
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
expires: -1

Redirect headers

Location: https://sb.freeskreen.com/um?ac={$UID}
Date: Sat, 30 Oct 2021 06:39:55 GMT
Transfer-Encoding: chunked
Server: nginx
Connection: keep-alive
X-Frame-Options: DENY
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload

GET
H2

200

um
sb.freeskreen.com/
Redirect Chain

https://loadeu.exelator.com/load/?p=204&g=1300&j=0
https://loadeu.exelator.com/load/?p=204&g=1300&j=0&xl8blockcheck=1
https://sb.freeskreen.com/um?ni=0bbc9f4616a7619843943c8f5a5c1077

43 B
480 B

24ms
24ms

Image
image/gif

3.229.194.186
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/um?ni=0bbc9f4616a7619843943c8f5a5c1077
Requested by: Host: nowtoronto.com
URL: https://nowtoronto.com/
Protocol: H2
Server: 3.229.194.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-229-194-186.compute-1.amazonaws.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:55 GMT
server: Apache/2.4.29 (Ubuntu)
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
expires: -1

Redirect headers

date: Sat, 30 Oct 2021 06:39:55 GMT
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location: https://sb.freeskreen.com/um?ni=0bbc9f4616a7619843943c8f5a5c1077
cache-control: no-cache
access-control-allow-credentials: true
content-type: image/gif
content-length: 0

GET
H2 200 form-settings Show response
mc.us3.list-manage.com/subscribe/ 1 KB
2 KB 146ms
86ms Script
application/json 23.5.229.157
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://mc.us3.list-manage.com/subscribe/form-settings?u=66f9ff05440f87925e70b601c&id=bfaa0e1d4c&u=66f9ff05440f87925e70b601c&id=bfaa0e1d4c&c=dojo_request_script_callbacks.dojo_request_script0
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/unique-methods/embed.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.5.229.157 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-5-229-157.deploy.static.akamaitechnologies.com
Software: openresty /
Resource Hash: bfd98ba2fd5ec8493b876b66a068eb7ebcf29e018aea81e6754beeccdb1db4de

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:55 GMT
content-encoding: gzip
referrer-policy: same-origin
server: openresty
vary: Accept-Encoding
content-type: application/json; charset=utf-8
expires: Sat, 30 Oct 2021 06:44:55 GMT
cache-control: max-age=300
content-length: 619
x-ua-compatible: IE=edge,chrome=1

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.9.1/ Frame 2F17 90 KB
33 KB 67ms
19ms Script
text/javascript 2607:f8b0:4006:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js

Requested by

Host: nowtoronto.com
URL: https://nowtoronto.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 15:28:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54666
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33018
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="hosted-libraries-pushers"
expires: Sat, 29 Oct 2022 15:28:49 GMT

GET
H/1.1 200
OK fsk.css
static.freeskreen.com/css/20210107205009/default/ Frame 2F17 50 KB
29 KB 23ms
22ms Stylesheet
text/css 13.226.37.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.freeskreen.com/css/20210107205009/default/fsk.css
Requested by: Host: nowtoronto.com
URL: https://nowtoronto.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.37.49 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-37-49.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31ace63fa339896dc045f21da77b1ffdc57160e2db5690b132766b0086d6f58e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: 5DtU9pV9aPv90d5PMlXs6Og9O1cWT0Fu
Content-Encoding: gzip
ETag: "ba07184144408ada0c1691c69221a457"
Age: 16533
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 28958
Last-Modified: Thu, 07 Jan 2021 20:54:53 GMT
Server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1610052891/ctime:1610052892/gid:497/gname:jenkins/md5:ba07184144408ada0c1691c69221a457/mode:33188/mtime:1610052892/uid:498/uname:jenkins
Date: Sat, 30 Oct 2021 02:04:23 GMT
Content-Type: text/css
Via: 1.1 8f53b5d73ff2f5f8cae7b49606b79bd4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: EWR53-C2
Accept-Ranges: bytes
X-Amz-Cf-Id: s8-fpnltm-HHhStWYQ_5iFAn4Ke56AHY8JiKmrm3Kt30y9zldblAng==

GET
H2 200 HAUXIXnVSkOFzxyeyPFo
www.filepicker.io/api/file/ 15 KB
15 KB 65ms
10ms Image
image/png 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.filepicker.io/api/file/HAUXIXnVSkOFzxyeyPFo
Requested by: Host: nowtoronto.com
URL: https://nowtoronto.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: a9e8bc0d0f31a993bf781c79bc34ca8b71a6c3775e7ca6df36f1db96871ce121

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:55 GMT
via: 1.1 varnish, 1.1 varnish
age: 1368445
x-cache: HIT, HIT
content-disposition: inline; filename="now_desktop_logo.png"
content-length: 15345
x-served-by: cache-bwi5137-BWI, cache-yul12822-YUL
last-modified: Sat, 15 Feb 2020 06:15:28 GMT
x-file-name: now_desktop_logo.png
x-timer: S1635575996.626828,VS0,VE1
etag: "dc50b1573179a409bfc55b4aa5bc697b"
access-control-max-age: 21600
access-control-allow-methods: DELETE, GET, HEAD, POST, PUT
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: X-File-Name
cache-control: public, max-age=2678400
filestack-trace-id: 1634207549-vRi4wScRGW
accept-ranges: bytes
access-control-allow-headers: Content-Type, X-No-Stream
x-cache-hits: 1, 1

GET
H2 200 placement_invocation Show response
ob.cheqzone.com/ 50 KB
19 KB 89ms
27ms Script
text/javascript 18.67.76.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ob.cheqzone.com/placement_invocation?id=65349&idx=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.76.128 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: c76853b9b64b3fb4b4cfbd22885e4cc2e3f14918020efb69a1df8eaeeb2a3b8e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 21:11:19 GMT
content-encoding: gzip
cheq_headers_order: Content-Type Cache-Control Expires Etag Content-Length Content-Encoding Date Connection
age: 34116
etag: "c6e6-H+PLdQz0EEd97ZlT78HNXlxTPcM"
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
via: 1.1 13f20f497c3eb55c7da0e314b603aabb.cloudfront.net (CloudFront)
cache-control: max-age=43200
x-amz-cf-pop: IAD89-P2
content-length: 19276
x-amz-cf-id: j9ybK-XU-B803jqrAWlDihXUXzhN2EtArKPSDcnuFkYKRsw0MLikBw==
expires: Sat, 30 Oct 2021 09:11:19 GMT

GET
H2

200

afihbs.js Show response
b2cdn.automatad.com/geo/IHGgJY/CA-W/
Redirect Chain

https://go.automatad.com/geo/IHGgJY/afihbs.js
https://b2cdn.automatad.com/geo/IHGgJY/CA-W/afihbs.js

199 KB
24 KB

110ms
43ms

Script
application/javascript

195.181.168.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://b2cdn.automatad.com/geo/IHGgJY/CA-W/afihbs.js
Requested by: Host: nowtoronto.com
URL: https://nowtoronto.com/
Protocol: H2
Server: 195.181.168.47 New York, United States, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: edge-742.bunnyinfra.net
Software: BunnyCDN-NY1-742 /
Resource Hash: 88385be69b8303e2c9ae02801995efd27691c84bd8f9d2e4e0ee43b95e53c2aa

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:56 GMT
content-encoding: br
x-openstack-request-id: txd27bc712c3d14ecbb2df7-00616dba7a
cdn-edgestorageid: 742
access-control-allow-origin: *
x-iplb-instance: 28796
cdn-cachedat: 10/18/2021 19:06:07
cdn-pullzone: 87832
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
x-trans-id: txd27bc712c3d14ecbb2df7-00616dba7a
server: BunnyCDN-NY1-742
x-timestamp: 1634580977.55800
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
last-modified: Mon, 18 Oct 2021 18:16:18 GMT
cdn-proxyver: 1.0
cdn-requestpullcode: 200
x-iplb-request-id: B95D01F1:4049_8E2CE366:01BB_616DBA7A_19F075D5:078E
vary: Accept-Encoding
x-object-meta-mtime: 1634580976.399132441
cdn-cache: REVALIDATED
cdn-uid: 02ba462e-865f-4abf-a9cd-22f9021b3a43
cache-control: public, max-age=120
cdn-requestid: 0809cec9ad3e01df47d94b79f682d282
content-type: application/javascript
cdn-requestcountrycode: RO
cdn-status: 200
cdn-requestpullsuccess: True

Redirect headers

date: Sat, 30 Oct 2021 06:39:56 GMT
server: nginx/1.17.8
content-type: text/html; charset=utf-8
location: https://b2cdn.automatad.com/geo/IHGgJY/CA-W/afihbs.js
cache-control: no-cache
x-automatad-country: CA
content-length: 88
expires: Sat, 30 Oct 2021 06:39:55 GMT

GET
H/1.1 200
OK player-hb.js Show response
static.freeskreen.com/scm/player/20211014b/ Frame 2F17 265 KB
68 KB 21ms
21ms Script
text/javascript 13.226.37.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.freeskreen.com/scm/player/20211014b/player-hb.js
Requested by: Host: nowtoronto.com
URL: https://nowtoronto.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.37.49 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-37-49.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4af5765b7587881ef567c23d0aa9fcdbeff09e3354473ed56eca490f4df5ca30

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: 1a20JKKbfSum1GD_kgL27p_j3szFYaZQ
Content-Encoding: gzip
ETag: "409ad7e8925e1ea5584c81bef309f239"
Age: 86293
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 69058
Last-Modified: Thu, 14 Oct 2021 20:54:36 GMT
Server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1634244865/ctime:1634244872/gid:20/gname:staff/md5:409ad7e8925e1ea5584c81bef309f239/mode:33188/mtime:1634244865/uid:501/uname:mickael
Date: Fri, 29 Oct 2021 06:41:43 GMT
Content-Type: text/javascript
Via: 1.1 8f53b5d73ff2f5f8cae7b49606b79bd4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: EWR53-C2
Accept-Ranges: bytes
X-Amz-Cf-Id: BBndwgFNwYI6G_SRQaQQM3ebA86lZOLO6YGqFJMovs4BffCzGd6pbg==

GET
H2 200 show_pla Show response
obs.cheqzone.com/ 2 KB
2 KB 110ms
31ms Script
text/javascript 2600:1f18:e8a:cd02:882c:d916:bae1:7722
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.cheqzone.com/show_pla?id=65349&url=https%3A%2F%2Fnowtoronto.com%2F&sf=0&k=&idx=0&ch=&ext=&np=linux%20x86_64&nv=google%20inc.&rand=53879256251887021259021169270282240752306128160388671200811663982109&nc=0&tsf=0&tsfmi=&pv=0&cb=1635575995786&ref=&pit=1&hl=2&op=0&fs=1600x1200&ss=1600x1200&pre=0&jsonp=OBR.extern.onCheqResponse&mr=&ag=3758186729&at=&bid=e30%3D&di=W1siZWYiLDMyMDBdLFsxMiwie1wiY3R4XCI6XCJ3ZWJnbDJcIixcInZcIjpcImludGVsIGluYy5c%0D%0AIixcInJcIjpcImludGVsIGlyaXMgb3BlbmdsIGVuZ2luZVwiLFwic2x2XCI6XCJ3ZWJnbCBnbHNs%0D%0AIGVzIDMuMDAgKG9wZW5nbCBlcyBnbHNsIGVzIDMuMCBjaHJvbWl1bSlcIixcImd2ZXJcIjpcIndl%0D%0AYmdsIDIuMCAob3BlbmdsIGVzIDMuMCBjaHJvbWl1bSlcIixcImd2ZW5cIjpcIndlYmtpdFwiLFwi%0D%0AYmVuXCI6OCxcIndnbFwiOjEsXCJncmVuXCI6XCJ3ZWJraXQgd2ViZ2xcIixcInNlZlwiOjExMTM2%0D%0AMTUxMixcInNlY1wiOlwiXCJ9Il0sWzM3LCJbMzMxNjIyNDA0OSxmdW5jdGlvbihuZXdWYWx1ZSkg%0D%0Ae1xuICAgICAgICAgICAgICBhZGRDb250ZW50V2luZG93UHJveHkodGhpcylcbiAgICAgICAgICAg%0D%0AICAgLy8gUmVzZXQgcHJvcGVydHksIHRoZSBob29rIGlzIG9ubHkgbmVlZGVkIG9uY2VcbiAgICAg%0D%0AICAgICAgICAgT2JqZWN0LmRlZmluZVByb3BlcnR5KGlmcmFtZSwgJ3NyY2RvYycsIHtcbiAgICAg%0D%0AICAgICAgICAgICBjb25maWd1cmFibGU6IGZhbHNlLFxuICAgICAgICAgICAgICAgIHdyaXRhYmxl%0D%0AOiBmYWxzZSxcbiAgICAgICAgICAgICAgICB2YWx1ZTogX3NyY2RvY1xuICAgICAgICAgICAgICB9%0D%0AKVxuICAgICAgICAgICAgICBfaWZyYW1lLnNyY2RvYyA9IG5ld1ZhbHVlXG4gICAgICAgICAgICB9%0D%0AXSJdLFstMSwiLSJdLFstMiwiMTIsZVlHOVgxL1gxdFpsUzIyZDUxeDhZTlk5TXhKUUVNQ2RVQkhK%0D%0ATDg2TDIzQUNHVWhCSXdJU1NFRUFjSUpmUmVBZ1FJRUZvSW5kQ3h3UVhqaG8yNzE5Nm1Nak92L3I4%0D%0ANzB1eHFGeCJdLFstMywiW1wiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwibWhqZmJtZGdjZmpiYnBh%0D%0AZW9qb2ZvaG9lZmdpZWhqYWlcIixcImludGVybmFsLW5hY2wtcGx1Z2luXCJdIl0sWy00LCItIl0s%0D%0AWy01LCItIl0sWy02LCItIl0sWy03LCItIl0sWy04LCItIl0sWy05LCIrIl0sWy0xMCwiLSJdLFst%0D%0AMTEsIntcInRcIjpcIlwiLFwibVwiOltcImRlc2NyaXB0aW9uXCIsXCJvZzp0aXRsZVwiLFwib2c6%0D%0AZGVzY3JpcHRpb25cIl19Il0sWy0xMiwibnVsbCJdLFstMTMsIi0iXSxbLTE0LCJ7XCJvXCI6MH0i%0D%0AXSxbLTE1LCItIl0sWy0xNiwiMCJdLFstMTcsIjQiXSxbLTE4LCJbMCwwLDAsMV0iXSxbLTE5LCJb%0D%0AMCwwLDAsMCwwLDAsMSwyNCwyNCxcIi1cIiwxNjAwLDEyMDAsMTYwMCwxMjAwLDE2MDAsMTIwMCwx%0D%0ANjAwLDEyMDAsMCwwLDAsMCxcIi1cIixcIi1cIl0iXSxbLTIwLCIyODM3ODMzNTQuMTYzNTU3NTk5%0D%0ANSJdLFstMjEsIlVEd0tYUW41Il0sWy0yMiwiW1wiblwiLFwiblwiXSJdLFstMjMsIisiXSxbLTI0%0D%0ALCJbXSJdLFstMjUsIi0iXSxbLTI2LCJ7XCJ0amhzXCI6MjE3MDAwMDAsXCJ1amhzXCI6MTkzMDAw%0D%0AMDAsXCJqaHNsXCI6Mzc2MDAwMDAwMH0iXSxbLTI3LCJbMCw5LjIsMCxcIjRnXCIsbnVsbF0iXSxb%0D%0ALTI4LCJlbi1VUyxlbiJdLFstMjksIntcInZcIjpbMiwyLDIsMiwwLDAsMCwyLDAsMiwwLDIsMCww%0D%0ALDIsMiwyLDIsMF19Il0sWy0zMCwiW1widlwiLDBdIl0sWy0zMSwiZmFsc2UiXSxbLTMyLCItIl0s%0D%0AWy0zMywiLSJdLFstMzQsIi0iXSxbLTM1LCJbMTYzNTU3NTk5NTcyMywwXSJdLFstMzYsIltcIjQv%0D%0AM1wiLFwiNC8zXCJdIl0sWy0zNywiLTE0NC02Ni0xODAtIl0sWy0zOCwiaSwtMSwtMSwzMiwwLDAs%0D%0AMCwwLDI2LDY3LDQ4MCwwLDQ4Ny4zLDQ4Ny4zLDEyNzIsMTI3MiJdLFstMzksIltcIjIwMDMwMTA3%0D%0AXCIsNCxcIkdlY2tvXCIsXCJOZXRzY2FwZVwiLFwiTW96aWxsYVwiLG51bGwsbnVsbCx0cnVlLDgs%0D%0AZmFsc2UsbnVsbCwzXSJdLFstNDAsIjMzIl0sWy00MSwiLSJdLFstNDIsIjE3MjQyOTc2NTMiXSxb%0D%0ALTQzLCIwMDAwMDAwMTAxMDAwMDAxMDAxMTEwMTEwMCJdLFstNDQsIjAsMCwwLDUiXSxbLTQ1LCI2%0D%0AMjAsNjc4LDAsMCwwLDU2MSwwLDAsNjQ4LDAsMCwwLDAsMCwwLDAsMCwwLDAsNjg0LDAsMCwwLDAs%0D%0AMCwwLDAsMCwwLDAsMCwwIl0sWy00NiwiMCJdLFstNDcsIkV0Yy9Vbmtub3duLGVuLVVTLGxhdG4s%0D%0AZ3JlZ29yeSJdLFstNDgsIjAsMCJdLFstNDksIi0iXSxbImJuY2giLDEwNV1d&tsfu=&fst=1600x1200&dep=0&cpos=%5B%7B%22x%22%3A0%2C%22y%22%3A0%2C%22w%22%3A1600%2C%22h%22%3A6276%7D%2C%7B%22w%22%3A1600%2C%22h%22%3A1200%7D%5D&ver=41&cri=Ef1HoZYlKx&sdd=%7B%7D&pto=1339
Requested by: Host: ob.cheqzone.com
URL: https://ob.cheqzone.com/placement_invocation?id=65349&idx=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2600:1f18:e8a:cd02:882c:d916:bae1:7722 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: ab5f3ba50e1803a59c1546bd589a69eef69c5d4b743eb5ae62ddd3198c3d7f58

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:55 GMT
content-encoding: gzip
content-type: text/javascript
cache-control: no-cache, no-store, must-revalidate
cheq_headers_order: Set-Cookie Content-Type Cache-Control Pragma Expires Content-Length Content-Encoding Date Connection
content-length: 1410
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK F44630BFF8F3C6CE4CE115B339AF014D.cache.js Show response
static.freeskreen.com/gwt/20210107205009/advertisement/freeskreen_splitbox_client/ Frame 2F17 98 KB
34 KB 21ms
21ms Script
application/javascript 13.226.37.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.freeskreen.com/gwt/20210107205009/advertisement/freeskreen_splitbox_client/F44630BFF8F3C6CE4CE115B339AF014D.cache.js
Requested by: Host: nowtoronto.com
URL: https://nowtoronto.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.37.49 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-37-49.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 19ac7f7f03270e923c602d544845da674a088cbb610a4c76a6445f0d075b7d0f

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 21:42:07 GMT
Content-Encoding: gzip
Age: 32269
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 34110
Last-Modified: Thu, 07 Jan 2021 20:54:06 GMT
Server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1610052721/ctime:1610052845/gid:497/gname:jenkins/md5:ffc2c23e98e50d5acfafe8ccfc4dc585/mode:33188/mtime:1610052721/uid:498/uname:jenkins
ETag: "ffc2c23e98e50d5acfafe8ccfc4dc585"
x-amz-version-id: jP3BhKySKcISIxarwq4cPXWHxkq.8vAk
Via: 1.1 8f53b5d73ff2f5f8cae7b49606b79bd4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: EWR53-C2
Accept-Ranges: bytes
Content-Type: application/javascript
X-Amz-Cf-Id: 0Aa4dme6oNwn7fRlYFYbd2967eEyMe6VeDRVudaAMO8ZOertbgl25Q==

GET
H2 200 t.gif
sb.freeskreen.com/ Frame 2F17 43 B
257 B 23ms
23ms Image
image/gif 3.229.194.186
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1635575995&p=219&c=4141&s=undefined&d=&v=&t=c80375eb-f03e-44ec-a3de-68f5b3712991&co=CA&pr=QC&ci=Montreal&dm=GM&flc=unknown&slc=unknown&ttm=1635575995458&gdpr=0&gdpr_consent=&e=AdOpened&m=2&x=null
Requested by: Host: nowtoronto.com
URL: https://nowtoronto.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.229.194.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-229-194-186.compute-1.amazonaws.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:55 GMT
server: Apache/2.4.29 (Ubuntu)
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
expires: -1

GET
H/1.1 200
OK popup.js Show response
downloads.mailchimp.com/js/signup-forms/popup/unique-methods/56e7ecd72519300e38d4c8e42744c00035f2bf09/ 101 KB
31 KB 22ms
22ms Script
application/javascript 99.84.41.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/js/signup-forms/popup/unique-methods/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/unique-methods/embed.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.41.61 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-41-61.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6ed1a215eecd0157174987e302a5f4e1f6a5d1cd7f384608c4e6e8f5cd535ff1

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 06:39:28 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 May 2020 15:07:51 GMT
Server: AmazonS3
Age: 27
ETag: W/"459011526cbe745c65ba1b165285fbe9"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 bb784f1db0a47d55a8953c84e49cfa35.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: EWR52-C4
X-Amz-Cf-Id: KjiYoJs8Z43HNzMC_KLMwov2MP2rgPJ1hf3Z2N5bxX4xzlZFpy8ErA==

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 77A2 31 KB
10 KB 23ms
23ms Script
text/html 104.105.42.146
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.105.42.146 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-105-42-146.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: d8c259eba0c949dd085f3ae0941f8da6def8ec9627981a0763e234347aaddb04

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 06:39:55 GMT
Content-Encoding: gzip
Last-Modified: Fri, 29 Oct 2021 15:57:03 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=35481
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9396
Expires: Sat, 30 Oct 2021 16:31:16 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 77A2 284 B
921 B 125ms
27ms Image
image/jpg 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: f69a50991384d09413b97a37bb74928b
Content-Type: image/jpg

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 3FA5 0
83 B 20ms
19ms Document
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: nowtoronto.com
URL: https://nowtoronto.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://nowtoronto.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/

Response headers

content-type: text/plain
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
date: Sat, 30 Oct 2021 06:39:55 GMT

GET
H/1.1 200
OK common.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame 4F3D 9 KB
3 KB 20ms
19ms Stylesheet
text/css 99.84.41.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/common.css
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/unique-methods/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.41.61 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-41-61.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4c69c701fd3700fca10f8e6180c9f60f9af13c943ee7f1513f4b7709d8b75d72

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 06:39:16 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 May 2020 15:07:51 GMT
Server: AmazonS3
Age: 40
ETag: W/"82e72d627b04e1654282023cca1d1e69"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/css
Via: 1.1 bb784f1db0a47d55a8953c84e49cfa35.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: EWR52-C4
X-Amz-Cf-Id: amLHH-0cWiRgIO4CdkFdQtTZnWBZhL5z6h1XTxm2bP03fYTLcIDMhw==

GET
H/1.1 200
OK banner.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame 4F3D 1005 B
938 B 40ms
20ms Stylesheet
text/css 99.84.41.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/banner.css
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/unique-methods/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.41.61 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-41-61.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bece213397fe5f546674ee29dd3f69ec2f2cc0e480e67f09dcc4c25c0d12a3d7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 06:39:15 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 May 2020 15:07:52 GMT
Server: AmazonS3
Age: 41
ETag: W/"78d1bdd981816cfbeb6954a85f9efa58"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/css
Via: 1.1 bb784f1db0a47d55a8953c84e49cfa35.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: EWR52-C4
X-Amz-Cf-Id: 6g7qv4XyPOptV4JoPzGP9h0wKZc8Sd_4Miy-8wIUCirckVxkisxZjg==

GET
H/1.1 200
OK common.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame E230 9 KB
3 KB 52ms
20ms Stylesheet
text/css 99.84.41.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/common.css
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/unique-methods/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.41.61 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-41-61.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4c69c701fd3700fca10f8e6180c9f60f9af13c943ee7f1513f4b7709d8b75d72

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 06:39:16 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 May 2020 15:07:51 GMT
Server: AmazonS3
Age: 41
ETag: W/"82e72d627b04e1654282023cca1d1e69"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/css
Via: 1.1 3656f262c2589326b2ab2a4824da0517.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: EWR52-C4
X-Amz-Cf-Id: NZtk1j9TllmWaCMhS1gFbAIdg0VoqdXDzIXa_8TQU-k_o6spDjKhUg==

GET
H/1.1 200
OK layout-fixed.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame E230 2 KB
1 KB 53ms
19ms Stylesheet
text/css 99.84.41.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/layout-fixed.css
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/unique-methods/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.41.61 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-41-61.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 257fd3e899f5136b41595cfcd30e5ca2656c9d048e4ea960266fa6a984c8b125

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 06:39:11 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 May 2020 15:07:52 GMT
Server: AmazonS3
Age: 46
ETag: W/"00665291ff50c3e820898eb60923d34f"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/css
Via: 1.1 bb784f1db0a47d55a8953c84e49cfa35.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: EWR52-C4
X-Amz-Cf-Id: 8DLpvYHE_NlTdrFQ2-FuIXcObwjoB6t8hRmgzqbWIujBFtUEfoUYDQ==

GET
H/1.1 200
OK modal-fixed.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ 3 KB
2 KB 60ms
20ms Stylesheet
text/css 99.84.41.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/modal-fixed.css
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/unique-methods/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.41.61 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-41-61.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 761f6d95297085440d252929bf85c921089dc17cd27cfea920c8270ac3c16f61

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 06:39:11 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 May 2020 15:07:52 GMT
Server: AmazonS3
Age: 46
ETag: W/"606159a85498ef1c5a31d1b5f75239a1"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/css
Via: 1.1 6afc1c7b9e6d4dbe30a0b3eae05d0f9e.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: EWR52-C4
X-Amz-Cf-Id: tYzxpl1REZGbEslMvAoZswoXugegH4OlZCoWKQtsLjNFel9B5nW6JQ==

GET
H2 200 ima3vpaid Show response
tpc.googlesyndication.com/ Frame 2F17 961 B
1 KB 156ms
99ms XHR
text/xml 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/ima3vpaid?vad_format=linear&correlator=1635575995&adtagurl=https%3A%2F%2Fpubads.g.doubleclick.net%2Fgampad%2Fads%3Fiu%3D%2F68572626%2Ftelaria%26description_url%3Dhttps%253A%252F%252Fnowtoronto.com%252F%26tfcd%3D0%26npa%3D0%26sz%3D640x480%26ciu_szs%3D728x90%252C300x250%26gdfp_req%3D1%26output%3Dvast%26unviewed_position_start%3D1%26env%3Dvp%26correlator%3D1635575995%26nofb%3D1%26vpmute%3D1%26vpa%3D1%26vad_format%3Dlinear%26vpos%3Dpreroll%26cust_params%3D__p_cust_params_encoded__&type=js

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4c771bcca464a869247ceca61738e7ee3fb672460c265c47fc71ea4888360a44

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/xml, text/xml, */*; q=0.01
Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 30 Oct 2021 06:39:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: https://nowtoronto.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/xml; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 585
x-xss-protection: 0

GET
H2 200 xpub Show response
bid.g.doubleclick.net/xbbe/bid/ Frame 2F17 4 KB
4 KB 191ms
96ms XHR
text/xml 142.250.123.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/bid/xpub?deal_id=12768126_708032&max_duration=30&ord=1635575996&dc_sdk_apis=[APIFRAMEWORKS]&dc_omid_p=[OMIDPARTNER]&dc_vast=3&dc_rdid=

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.123.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

gh-in-f156.1e100.net

Software

cafe /

Resource Hash

389534c40ea0b61ae5d2bf4b5a192ffa4a4764620ab367462e1ce2ca94b6460a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/xml, text/xml, */*; q=0.01
Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/xml; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3713
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 bid Show response
ads.freeskreen.com/ Frame 2F17 0
196 B 453ms
392ms XHR
text/plain 44.194.222.26
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.freeskreen.com/bid?pid=219&tid=c80375eb-f03e-44ec-a3de-68f5b3712991&w=411&h=230&u=https%3A%2F%2Fnowtoronto.com%2F&ip=37.120.205.148&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F95.0.4638.54%20Safari%2F537.36&g_co=CA&g_p=QC&g_ci=Montreal&g_d=GM&s_1=unknown&s_2=unknown&cid=4141&sid=undefined&vid=298&did=142391&pf=500&ttm=1635575995458&eu_c=&eu_g=0&eu_ggl=0
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.222.26 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-222-26.compute-1.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/xml, text/xml, */*; q=0.01
Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
server: Apache-Coyote/1.1
access-control-allow-methods: GET
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache, no-store
access-control-allow-credentials: true
expires: -1

GET
H2 200 imp.gif
obs.cheqzone.com/tracker/ 43 B
158 B 25ms
25ms Image
image/gif 2600:1f18:e8a:cd02:882c:d916:bae1:7722
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://obs.cheqzone.com/tracker/imp.gif?e=37dfbd8ee84e001369ebc232ef4e83989225c24f567d51c5c30f41b0254384cfa532ff1a285aa40e98d022e0b44dc87ea4a36fde4c1b8c682309094d0ba0bfea9475489e91da563e351aff717718956a8b70cd0130003f8101424d3f065cc3bf775d36fa26e877cb55e2cc7ce2586fb01f6f3903d053f054abd1c5d52fe87547ed62d2f1157f84163312711093d30464f578afe6d6ea474bef498fbd39e872d861c45085052aae2d05f91e46042cca5b32b49affa125be2ab8589801f95c0c2cf38e6b256a655c9b6599857ea95a61a7d4f232331e32d786302080903b477442750c1bef8828796d76e4ba152cebfea755c9a444771e2bb5a5a384800cc6b9a326f746c0016537dd9fcfe6ad6b89cc9133d56c5384e6c0290616e96569ab980a61eac89825d957bd1fad811bc551c8c96dd82a77c3d835d27792dbeda58cbee51b2da72fe3e8f8290066b98265c2e64abb421757d00f5880d7c38681eb923bce6a88deef8f23e97d2f65d12f7fc792c5157686bc74f157b7c51a9526ae7d431c019c6cff439cd0be71f8df78cb11f299d1cb6a824f4921fc531b1e3e073ec1ab23ec169a8c9723a68f68f1d0748bcca9ee73cfe8de0e282fd8bd10158aec470b55aea2b367a72687e959eafc33b47ca12d8855d410cbb53fc11a3bf9a892645223725038014e64dbf3907e8010bd4452516ca9a645db840a4fabfa99effe1f9da8bab8dfa6f8e3410b7ebe129aa41a2e91496556&cb=1635575996024&cri=Ef1HoZYlKx
Requested by: Host: nowtoronto.com
URL: https://nowtoronto.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2600:1f18:e8a:cd02:882c:d916:bae1:7722 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
cache-control: no-cache, no-store, must-revalidate
cheq_headers_order: Cache-Control Pragma Expires Content-Type Date Connection Content-Length
content-type: image/gif
content-length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dwce_cheq_events Show response
log.outbrainimg.com/loggerServices/ 4 B
325 B 103ms
18ms XHR
application/json 64.202.112.63
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://log.outbrainimg.com/loggerServices/dwce_cheq_events?timestamp=1635575996025&sessionId=8284797f-1aa7-6548-7656-b191331c827f&url=nowtoronto.com&cheqSource=1&cheqEvent=0&exitReason=4
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.63 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:39:56 GMT
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
X-TraceId: 11744eab6732e41a3560fcb1c4da746a
Content-Length: 4
Expires: 0

GET
H2

200

um
sb.freeskreen.com/ Frame 77A2
Redirect Chain

https://pixel-us-west.rubiconproject.com/exchange/sync.php?p=123456
https://sb.freeskreen.com/um?mg=KVDFPVGC-I-75ZC

43 B
529 B

24ms
24ms

Image
image/gif

3.229.194.186
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/um?mg=KVDFPVGC-I-75ZC
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Protocol: H2
Server: 3.229.194.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-229-194-186.compute-1.amazonaws.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
server: Apache/2.4.29 (Ubuntu)
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
expires: -1

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://sb.freeskreen.com/um?mg=KVDFPVGC-I-75ZC
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: b2a5c63b17f16a8024ffc6259157eaa8
Expires: 0

GET
H2 200 vpaid_adapter.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame 1813 44 KB
16 KB 109ms
36ms Script
text/javascript 2607:f8b0:4006:80a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/vpaid_adapter.js?adtagurl=https://pubads.g.doubleclick.net/gampad/ads%3Fiu%3D/68572626/telaria%26description_url%3Dhttps%253A%252F%252Fnowtoronto.com%252F%26tfcd%3D0%26npa%3D0%26sz%3D640x480%26ciu_szs%3D728x90%252C300x250%26gdfp_req%3D1%26output%3Dvast%26unviewed_position_start%3D1%26env%3Dvp%26correlator%3D1635575995%26nofb%3D1%26vpmute%3D1%26vpa%3D1%26vad_format%3Dlinear%26vpos%3Dpreroll%26cust_params%3D__p_cust_params_encoded__%26channel%3Dvastadp&correlator=1635575995

Requested by

Host: static.freeskreen.com
URL: https://static.freeskreen.com/scm/player/20211014b/player-hb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80a::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5634fbf34fb1782b816f6a5441bc2570cb0fc41454e37b3000f036b8f94f67c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16307
x-xss-protection: 0
last-modified: Mon, 25 Oct 2021 15:33:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=900
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
expires: Sat, 30 Oct 2021 06:54:56 GMT

GET
H2 200 t.gif
sb.freeskreen.com/ Frame 2F17 43 B
257 B 24ms
24ms Image
image/gif 3.229.194.186
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1635575996&p=219&c=4141&s=undefined&d=1283547&v=20280&t=c80375eb-f03e-44ec-a3de-68f5b3712991&co=CA&pr=QC&ci=Montreal&dm=GM&flc=unknown&slc=unknown&ttm=1635575995458&gdpr=0&gdpr_consent=&e=VastRequest&m=1&x=https%3A%2F%2Ftpc.googlesyndication.com%2Fima3vpaid%3Fvad_format%3Dlinear%26correlator%3D1635575996%26adtagurl%3Dhttps%253A%252F%252Fpubads.g.doubleclick.net%252Fgampad%252Fads%253Fiu%253D%252F68572626%252Ftelaria%2526description_url%253Dhttps%25253A%25252F%25252Fnowtoronto.com%25252F%2526tfcd%253D0%2526npa%253D0%2526sz%253D640x480%2526ciu_szs%253D728x90%25252C300x250%2526gdfp_req%253D1%2526output%253Dvast%2526unviewed_position_start%253D1%2526env%253Dvp%2526correlator%253D1635575996%2526nofb%253D1%2526vpmute%253D1%2526vpa%253D1%2526vad_format%253Dlinear%2526vpos%253Dpreroll%2526cust_params%253D__p_cust_params_encoded__%26type%3Djs
Requested by: Host: nowtoronto.com
URL: https://nowtoronto.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.229.194.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-229-194-186.compute-1.amazonaws.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
server: Apache/2.4.29 (Ubuntu)
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
expires: -1

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 77A2
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D&_test=YXzovAAAtXyO_gAz
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YXzovAAAtXyO_gAz&_test=YXzovAAAtXyO_gAz

42 B
678 B

105ms
27ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YXzovAAAtXyO_gAz&_test=YXzovAAAtXyO_gAz
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 84e0f527cd81a00b0210e20b4ee7ed94
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1635575996.259934,VS0,VE0
x-served-by: cache-yul12826-YUL
x-cache: HIT
location: https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YXzovAAAtXyO_gAz&_test=YXzovAAAtXyO_gAz
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 77A2
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=f679617c-e8bc-4500-8869-484d925f2ac3

42 B
678 B

102ms
25ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=f679617c-e8bc-4500-8869-484d925f2ac3
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: b5ba23d75d0dcd35432b720d73e3149b
Content-Type: image/gif

Redirect headers

Date: Sat, 30 Oct 2021 06:39:56 GMT
Server: MT3 4067 88cc6bf master iad-pixel-x30 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=f679617c-e8bc-4500-8869-484d925f2ac3
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sat, 30 Oct 2021 06:39:55 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 77A2
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ZERlBWR0MtSS03NVpD
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ZERlBWR0MtSS03NVpD&google_tc=

170 B
188 B

67ms
38ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ZERlBWR0MtSS03NVpD&google_tc=

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ZERlBWR0MtSS03NVpD&google_tc=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 77A2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm=&google_sc=&google_tc=
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEEGWysO-BiTaFwT8PFBPZFs&google_cver=1

42 B
678 B

35ms
26ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEEGWysO-BiTaFwT8PFBPZFs&google_cver=1
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: af308bb17a856a105b8c87aaae7d7f8c
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEEGWysO-BiTaFwT8PFBPZFs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 709414.gif
id.rlcdn.com/ Frame 77A2 42 B
417 B 78ms
40ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/709414.gif
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 30 Oct 2021 06:39:56 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

GET
H2

204

v1
ads.yahoo.com/cms/ Frame 77A2
Redirect Chain

https://token.rubiconproject.com/token?pid=26594
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KVDFPVGC-I-75ZC&sigv=1&esig=2~a2bf78158b0ace073740a511db18edfcaab7ac51

0
444 B

251ms
31ms

Image
text/plain

2001:4998:14:800::1001
YAHOO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KVDFPVGC-I-75ZC&sigv=1&esig=2~a2bf78158b0ace073740a511db18edfcaab7ac51

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west

Protocol

Server

2001:4998:14:800::1001 , United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:56 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KVDFPVGC-I-75ZC&sigv=1&esig=2~a2bf78158b0ace073740a511db18edfcaab7ac51
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 84e0f527cd81a00b0210e20b4ee7ed94
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 77A2
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://match.adsrvr.org/track/cmb/rubicon?
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=dfc84948-51af-4a0f-b6e1-c55e98473d85&gdpr=0&gdpr_consent=&expires=30

42 B
678 B

98ms
27ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=dfc84948-51af-4a0f-b6e1-c55e98473d85&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: b5ba23d75d0dcd35432b720d73e3149b
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=dfc84948-51af-4a0f-b6e1-c55e98473d85&gdpr=0&gdpr_consent=&expires=30
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 289

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 77A2
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NmYwNjc4Yzc4ZDBlZjQ2NzkxZTBhZmE2NWVlZmRmOWQ0NGM2MGFlMw
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NmYwNjc4Yzc4ZDBlZjQ2NzkxZTBhZmE2NWVlZmRmOWQ0NGM2MGFlMw&google_tc=

170 B
188 B

38ms
37ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NmYwNjc4Yzc4ZDBlZjQ2NzkxZTBhZmE2NWVlZmRmOWQ0NGM2MGFlMw&google_tc=

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=123456&endpoint=us-west

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NmYwNjc4Yzc4ZDBlZjQ2NzkxZTBhZmE2NWVlZmRmOWQ0NGM2MGFlMw&google_tc=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 334
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 2F17 16 KB
5 KB 110ms
73ms XHR
text/xml 142.250.123.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-CoNKRzUksovqJo2jAnqJRCLeyQpup6_KHYICblvKWD17SrpYUcAfL37dNRm5an9HrDf6UC3FOZKKCaBV2IgHgkRWGbMQ&dbm_d=AKAmf-DtoCvIMOXbEQIlpeTN0nm-C80AmBV7n9jSIAbiekwGHFkoIsrqrY8umpolhjbSDFBnujWEO7__JTKppwWzsChpklxzg8Bd0aA6BHtUzhM20ya7er9QQ1I7RDrSnwyH4rRhWYHSjm_pSh7cZcdAEfBhj88jxh51FyHXm-I7zCOl9_SD-V3GvE7fvMGw6vMTbVv0jXdCnpMo60RK2EfsLqY_TGdTiWWhXg7saWyVu1UaN8TnxNj0X5srlfIt4WYyoMJr2X_eZ1A-SGV4UsE2o8Kuy9_hymh1aPzRDxRq3d5HmNLyv1tZZPTIHQ3uXKDh3-UHbRZ6qZB5EJpqUjSUbJSFJ8PD7A2Zc_0LVj1JKFv24Cbl_s1-y5QqeXakVya-VdDWbg_RccMoyjoJjiXXClXccNHXbFSPzUSXyWeHIwvi4Ty_p2b0RH-XHcLW4yKDV3tbn9kyzQRnayf4bikh22lND3kR1L2jUCf17uC7QwoSfgJEClNPTJ6h9zzJWTVJJMq9KFpKLgP-RJGJfs9_Mqczxi2jzv7-KAQTLUHEBdzuto1guckB7XSedL74EzEEAihlmEaRHcqagpDf3_8YNBWkrLH5LXFGay-IW5IEDeDljh8oUBJQ-YJXMKAo-9fhLO8LjOZEI-a6iFQay4ey5ivjb7aLki7L-4oLfRov2RTajiI5ORA2vj5XvEkASzcGq4jAOenp0ltetvvi_ZjJy6Usbe1mhwjOgA9sHXJfDqQvDeHA761VTNSb5jRTXnZ2ri1qZQjtUW9SHE7zsdK8dxHLHpMNKB7luDqdJDhr1niVg4aODKnBZZiYpD5j3WsxjeNWupudS5aDLyMWEjDGq94LtWswLbUlzDm_GWn-BAmJu9vEKHMrtZfd3Mwees34If3cPrzg8HND7wc9aj7av1slv78fDiHZHlNW_4Dd_TtHQZD6sLYfzVA1U_nPTxFhC5usChBJAgORC1pUXyHx9UO7VEJ_QiW9FgyLgTwfxEZcRia2bYib0LUjaXPTsyZO9qAUZKIa_CCwhHHRkzYAW8mRAkQSX5G9W8vMainId0LzB-xzxeukBAgZk_8Mhtznz891jINaFpbu4HWzMAl3vtudeiOfNdHLi_zo8wjiI7cbM2qpxvQh_75G1zg7JjCSKg8XzrSns62JODEYy4FdNRr1p8cXRKIrcxU0vi5Tze1PJOBpnLzmqITvvSkmYSfDx-jvELuegW5_b8G0EWSLOwvmbPGYhXttasOB4JKNCsqn_lT5Ss_6K4wlajO5HyM2S4egIYIhfh63CQInZI0ELPXizHkXj6izxRySQ8jtgnqsuQ3mOSedLYvNVlFzuDNv0foma2Hmq_iK68ArZeYjbojpaJamH_SdON_7AVw8wrQvhdIcrouGqfzL1HL3fsPXsZAwm2961x0dms6SrrXTdBR-09ho5pZCoRyA1Wk87MM4T7myEA-_uxhdFMMJKmzHFQ0mReo1eP8TvcWrVN1xFilDzYrYb0yg7AViS1kyHZinRNdiQ2XHWVIv2IQEjCh1TCRd3Pvcm1nehUgpc5WHoHxS6tF0JDcIKzeCvOL7qZS9JtPSbBhHY2nuN4sNFk2HvATcbSBgs7QoNOfWJ0oOCtUpct9yhkvxhxnj2YrEF0K1BHXHpkgpYYEjH7lxiZ5fi3VCEnfIy4-oxNyfWclk9joPJodNlifCg8bLXuDO8qMZEqfjEMS7zMe_b96RgDbHnOFiedi8wNa6H7VJcE3-MiZ92ON91brEqpuHklIGBP6Wbo2lGH-FG7typMjIhaKqxMjbbfV9kmqT1ZTQww1UtVyHEzDUa8c-b79MxZgHSMg7FBYo0ktwb871v-lHV_d5VJC3JKlaDyxClGLm-KItAmH7MbvDa0EDiGfwCmhMVIYj2PcJhoY2VY4mx1VpoyeoSKMMYEZI2mD0lSbykSwXnwrCh1l91CJ7WNAYdblzGYK_jr_Y9EH5S5yls9Gcg0F7dhdskwuvXQBoZKs812pe_y8YCsrrm6HB2CntX-ZLTstNkbgjFVA0xIHTqsjYKeBDPojAMufIkmDAoQ_MPBXu4FTo4PyqiilqrusHjmhnqMjoXBpzi3n8y41KryMoQuVjHDgwIGAK7-LQq2RTRSe_plgJlPKyVQYe-pP-CqK9X6ckuVlDvGNcXl5NGbUBP0qlqC8KbYYxHKZ1kNh3jYSKaf3gzcn1uAJm0ermGg9-MpeTIJND_QFDX-TjY_zBFrRqNKmtLPYKrlLGc-JeBt4XwvbJ568iJhpI0SYlFKdZRSJq3wpOJV68RJhk7NT12KxgPX8rqRGcrBSGRITDFaJlwaKHRXslhqnRjiY7PoFVmbMHhk4_Kyy7lg7hkEI17a4IuejCoPaIm7IKU_nVMBLva1PEcdnjicxpIyhUCdoLaDG1GOh8vDnk9MW8YMwVZUtWfjcdNo2yzF-EHmJy9zDYhSf5kMKxEVSoo-Dv1NH5Kak5rIderlcw6pmRRKtyuIu9UcUx-CnmOuStBrpz6TMXgZnw1bNcPFIgo8cqGxb5oZu-e6ORXZb2apjoBTO2LwAKoEp15mgp8n7Uw72JSyHXNY0Kpwz9inroHZ9onXSfv-woVylc8bQGyjeXvHGXDpJeTZdEnM4yNdJO8W2URzkACayld_nQj7Oy_4FDYs5wgyX6xIlr2jh_6SQd2VNdGNDglJKqw5z-dkDQxcdRH4zGwBVlZy44HXu3qpOU_baHkDlT6efq4pcctb4b3BPejToKa7HPdlvh6pwR-Xn7Gf1a_PjJkxJ1q-JckpV8pAC8hzY-1tm6u4UvMxKgERqUg42MSGzcZTS_JZ1lLwhsJ50ouYeDaQxjoOVQC0F65L295Ly9_vnF516gXf4Kqyw1hjw8Z1Db6bpXHrN0j6P_-4Fxi60ODmb3pPLmj_VqGsQsJaVP2GrpO0NzXRdrKvLpfHSFPyjVjyfhBr-tafVb2dxx9G3_fpI1g282LTN3aVzctoUKUMqjAg4yA8_kOZJ_JFogzHb8pkNk48_d3RSQTyIWIbQJSptF4fULIbe0xuu3LFN2kUzqV6H2TYJbrqeWhzXhfH5222wj7U0E8_F63dcv51LnjybvzcnaB4N1F985llCKCMLaPUM&cid=CAASBORoAuo&pr=39:AAAAAAAAAAAAAAAAAAAAAOsnHIIpaxpxW7oyiQ

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.123.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

gh-in-f156.1e100.net

Software

cafe /

Resource Hash

5cef803185f7df33b8cdaa911b72d2c348fdc7c64b41f01ac8e97ae234073a19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/xml, text/xml, */*; q=0.01
Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:56 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5210
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 t.gif
sb.freeskreen.com/ Frame 2F17 43 B
257 B 27ms
27ms Image
image/gif 3.229.194.186
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1635575996&p=219&c=4141&s=undefined&d=1556087&v=29217&t=c80375eb-f03e-44ec-a3de-68f5b3712991&co=CA&pr=QC&ci=Montreal&dm=GM&flc=unknown&slc=unknown&ttm=1635575995458&gdpr=0&gdpr_consent=&e=VastRequest&m=1&x=https%3A%2F%2Fbid.g.doubleclick.net%2Fxbbe%2Fbid%2Fxpub%3Fdeal_id%3D12768126_708032%26max_duration%3D30%26ord%3D1635575996%26dc_sdk_apis%3D%5BAPIFRAMEWORKS%5D%26dc_omid_p%3D%5BOMIDPARTNER%5D%26dc_vast%3D3%26dc_rdid%3D
Requested by: Host: nowtoronto.com
URL: https://nowtoronto.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.229.194.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-229-194-186.compute-1.amazonaws.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
server: Apache/2.4.29 (Ubuntu)
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
expires: -1

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame 1813 370 KB
123 KB 336ms
34ms Script
text/javascript 2607:f8b0:4006:80a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/vpaid_adapter.js?adtagurl=https://pubads.g.doubleclick.net/gampad/ads%3Fiu%3D/68572626/telaria%26description_url%3Dhttps%253A%252F%252Fnowtoronto.com%252F%26tfcd%3D0%26npa%3D0%26sz%3D640x480%26ciu_szs%3D728x90%252C300x250%26gdfp_req%3D1%26output%3Dvast%26unviewed_position_start%3D1%26env%3Dvp%26correlator%3D1635575995%26nofb%3D1%26vpmute%3D1%26vpa%3D1%26vad_format%3Dlinear%26vpos%3Dpreroll%26cust_params%3D__p_cust_params_encoded__%26channel%3Dvastadp&correlator=1635575995

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80a::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3160d4eb1326fe436d7a1edde158f5d5756ee4de884c40ae20c308b4cdf1fd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 125402
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
expires: Sat, 30 Oct 2021 06:39:56 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1813 0
217 B 39ms
36ms Ping
image/gif 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=vpaid_adapter_js&event=init-dv3&vps=0.1555251816527985&wt=1635575996311&sdkv=h.3.486.2&xai=undefined&url=2,https%3A%2F%2Fnowtoronto.com%2F$0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 t.gif
sb.freeskreen.com/ Frame 2F17 43 B
257 B 27ms
25ms Image
image/gif 3.229.194.186
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1635575996&p=219&c=4141&s=undefined&d=1283547&v=20280&t=c80375eb-f03e-44ec-a3de-68f5b3712991&co=CA&pr=QC&ci=Montreal&dm=GM&flc=unknown&slc=unknown&ttm=1635575995458&gdpr=0&gdpr_consent=&e=LoaderStartHB&m=1&x=%3B%3Bvpaidloader%3B1635575996322
Requested by: Host: nowtoronto.com
URL: https://nowtoronto.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.229.194.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-229-194-186.compute-1.amazonaws.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
server: Apache/2.4.29 (Ubuntu)
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
expires: -1

GET
H2 200 t.gif
sb.freeskreen.com/ Frame 2F17 43 B
257 B 24ms
24ms Image
image/gif 3.229.194.186
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1635575996&p=219&c=4141&s=undefined&d=142391&v=298&t=c80375eb-f03e-44ec-a3de-68f5b3712991&co=CA&pr=QC&ci=Montreal&dm=GM&flc=unknown&slc=unknown&ttm=1635575995458&gdpr=0&gdpr_consent=&e=VastRequest&m=1&x=https%3A%2F%2Fads.freeskreen.com%2Fbid%3Fpid%3D219%26tid%3Dc80375eb-f03e-44ec-a3de-68f5b3712991%26w%3D411%26h%3D230%26u%3Dhttps%253A%252F%252Fnowtoronto.com%252F%26ip%3D37.120.205.148%26ua%3DMozilla%252F5.0%2520(Windows%2520NT%252010.0%253B%2520Win64%253B%2520x64)%2520AppleWebKit%252F537.36%2520(KHTML%252C%2520like%2520Gecko)%2520Chrome%252F95.0.4638.54%2520Safari%252F537.36%26g_co%3DCA%26g_p%3DQC%26g_ci%3DMontreal%26g_d%3DGM%26s_1%3Dunknown%26s_2%3Dunknown%26cid%3D4141%26sid%3Dundefined%26vid%3D298%26did%3D142391%26pf%3D500%26ttm%3D1635575995458%26eu_c%3D%26eu_g%3D0%26eu_ggl%3D0
Requested by: Host: nowtoronto.com
URL: https://nowtoronto.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.229.194.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-229-194-186.compute-1.amazonaws.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
server: Apache/2.4.29 (Ubuntu)
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
expires: -1

GET
H2 200 t.gif
sb.freeskreen.com/ Frame 2F17 43 B
257 B 26ms
26ms Image
image/gif 3.229.194.186
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1635575996&p=219&c=4141&s=undefined&d=142391&v=298&t=c80375eb-f03e-44ec-a3de-68f5b3712991&co=CA&pr=QC&ci=Montreal&dm=GM&flc=unknown&slc=unknown&ttm=1635575995458&gdpr=0&gdpr_consent=&e=VastEmpty&m=1&x=
Requested by: Host: nowtoronto.com
URL: https://nowtoronto.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.229.194.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-229-194-186.compute-1.amazonaws.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
server: Apache/2.4.29 (Ubuntu)
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
expires: -1

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 81 KB
27 KB 96ms
36ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: go.automatad.com
URL: https://go.automatad.com/geo/IHGgJY/afihbs.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

881128807355cb7a82e363d931a88fadaf3675a78ec304dc9155f07e7d078b0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1028 / 619 of 1000 / last-modified: 1635545117"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27349
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 30 Oct 2021 06:39:56 GMT

GET
H2 200 prebid_IHGgJY.js Show response
b2cdn.automatad.com/js/ 263 KB
84 KB 47ms
47ms Script
application/javascript 195.181.168.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Requested by: Host: go.automatad.com
URL: https://go.automatad.com/geo/IHGgJY/afihbs.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 195.181.168.47 New York, United States, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: edge-742.bunnyinfra.net
Software: BunnyCDN-NY1-742 /
Resource Hash: 5ff39bf042435c509ebb55b602fc36a58bcf940d0a3ad48d0b2056e854274ce3

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:56 GMT
content-encoding: br
x-openstack-request-id: tx93e593c4338149c385d25-006170cd96
cdn-edgestorageid: 742
access-control-allow-origin: *
x-iplb-instance: 28795
cdn-cachedat: 10/26/2021 07:38:55
cdn-pullzone: 87832
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
x-trans-id: tx93e593c4338149c385d25-006170cd96
server: BunnyCDN-NY1-742
x-timestamp: 1634782576.72403
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
last-modified: Thu, 21 Oct 2021 02:16:17 GMT
cdn-proxyver: 1.0
cdn-requestpullcode: 200
x-iplb-request-id: B95D01F1:7D27_8E2CE366:01BB_6170CD93_1AC51767:1F484
vary: Accept-Encoding
x-object-meta-mtime: 1633007673.132674076
cdn-cache: REVALIDATED
cdn-uid: 02ba462e-865f-4abf-a9cd-22f9021b3a43
cache-control: public, max-age=120
cdn-requestid: 4f598e112fc97704581dcb8762bdd344
content-type: application/javascript
cdn-requestcountrycode: RO
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 op.js Show response
tagan.adlightning.com/automatad-nowtoronto/ 44 KB
19 KB 91ms
28ms Script
application/javascript 18.67.65.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js
Requested by: Host: go.automatad.com
URL: https://go.automatad.com/geo/IHGgJY/afihbs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c46b903eddf85f09b9c03a631d596deb9fbce28637a25f12b038523f288eb73c

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: 5T7362LVrgPJ5WQ4agZFTIlidteRDGN.
content-encoding: gzip
etag: "1f8b2d22db9856ef6e304aa8fdfbf462"
age: 2159
x-cache: Hit from cloudfront
content-length: 18522
x-amz-meta-git_commit: 7b120a5
last-modified: Thu, 28 Oct 2021 21:05:58 GMT
server: AmazonS3
date: Sat, 30 Oct 2021 06:03:58 GMT
content-type: application/javascript
via: 1.1 4ee1745ee3cece0fab563f5a32ba165b.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: IAD89-P1
accept-ranges: bytes
x-amz-cf-id: OMLDG34IOOKBOrYRXCS9uXh3t1kzW9twGqhhBOZK8tPT8t4Ek1UEgw==

GET
H2 200 currency.json Show response
b2cdn.automatad.com/json/ 2 KB
2 KB 64ms
20ms XHR
application/json 195.181.168.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://b2cdn.automatad.com/json/currency.json
Requested by: Host: go.automatad.com
URL: https://go.automatad.com/geo/IHGgJY/afihbs.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 195.181.168.47 New York, United States, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: edge-742.bunnyinfra.net
Software: BunnyCDN-NY1-742 /
Resource Hash: 685df4d5cf060fe847afa24bfd796d5302e559451f32322eb1c83d19e6fa132c

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:56 GMT
content-encoding: br
x-openstack-request-id: tx82b796f66f3543d4baba6-00617c1c50
cdn-edgestorageid: 742
access-control-allow-origin: *
x-iplb-instance: 28796
cdn-cachedat: 10/29/2021 19:33:24
cdn-pullzone: 87832
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
x-trans-id: tx82b796f66f3543d4baba6-00617c1c50
server: BunnyCDN-NY1-742
x-timestamp: 1635523531.47444
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
last-modified: Fri, 29 Oct 2021 16:05:32 GMT
cdn-proxyver: 1.0
cdn-requestpullcode: 200
x-iplb-request-id: B95D01F3:A951_8E2CE366:01BB_617C1C4F_BE9742:112BA
vary: Accept-Encoding
x-object-meta-mtime: 1635523502.288941763
cdn-cache: HIT
cdn-uid: 02ba462e-865f-4abf-a9cd-22f9021b3a43
cache-control: public, max-age=10800
cdn-requestid: edbcda266c09bd8170cc6ded74a27a0b
content-type: application/json
cdn-requestcountrycode: RO
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 sizzle.min.js Show response
cdnjs.cloudflare.com/ajax/libs/sizzle/2.3.3/ 19 KB
7 KB 341ms
16ms XHR
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/sizzle/2.3.3/sizzle.min.js

Requested by

Host: go.automatad.com
URL: https://go.automatad.com/geo/IHGgJY/afihbs.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf56b9ab02e71124134fe967a552b3df1363722d7b0bee524abda31e403dd397

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:56 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 134035
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 6679
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:16:20 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fd4-4dc5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xhdw%2BHi%2Flw%2BdgALQGHJlUEJpDxoOhSb7hJW5E0h2mv14oV5jCLJiTqVcyZEKAV5i9H7ZwdHyvzuOpjW%2F%2Bki4YYL1SyNeKYQFqcUJixO%2FPHcnYZNW42%2BXcpS7MRTBrMNYDUA3lRlXK3glhu82DfnBRlGH"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6a62a63d1b534bd1-YUL
expires: Thu, 20 Oct 2022 06:39:56 GMT

GET
H2 200 b-7b120a5-460a50dd.js Show response
tagan.adlightning.com/automatad-nowtoronto/ 73 KB
28 KB 30ms
28ms Script
application/javascript 18.67.65.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e7dea8736c7499605b93a1ccdfcf69a0e55cc35b3724bcee9e5be23970ea7ec5

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 21 Oct 2021 22:48:59 GMT
content-encoding: gzip
age: 719458
x-cache: Hit from cloudfront
content-length: 28315
x-amz-meta-git_commit: 7b120a5
last-modified: Tue, 03 Aug 2021 16:33:55 GMT
server: AmazonS3
etag: "5b1798a51491fa61878b946ed2ec5652"
x-amz-version-id: Zh8qAkywSf0c6iJXpDo_BleECzjNQ_LW
via: 1.1 4ee1745ee3cece0fab563f5a32ba165b.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: IAD89-P1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: NtRR6XneGq-72FjBXng2ZQra89dihBwOiE7MI8O_PKOwJE--HwZvOQ==

GET
H2 200 bl-f821a95-f4985751.js Show response
tagan.adlightning.com/automatad-nowtoronto/ 47 KB
20 KB 29ms
28ms Script
application/javascript 18.67.65.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-nowtoronto/bl-f821a95-f4985751.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ad2f2e043d230df8d4d9ef81ff9f0d77a6941cdbfb1b48c57704d804e04cd0f4

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 21:30:51 GMT
content-encoding: gzip
age: 119346
x-cache: Hit from cloudfront
content-length: 20336
x-amz-meta-git_commit: f821a95
last-modified: Thu, 28 Oct 2021 21:05:07 GMT
server: AmazonS3
etag: "d7bac72701468820bb358ceab63315f9"
x-amz-version-id: f_b22BKkA9ft0FDpksgjSzQEDhTyIJyD
via: 1.1 4ee1745ee3cece0fab563f5a32ba165b.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: IAD89-P1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: e8ytWLIBTv37YVn6hpaGHbfYJGb3xujkNqlTXBFmmauwCRvDH0-FXg==

GET
H2 200 bridge3.486.2_en.html Show response
imasdk.googleapis.com/js/core/ Frame 015E 578 KB
190 KB 21ms
20ms Document
text/html 2607:f8b0:4006:80a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.486.2_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80a::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e8c2a07175788df50b2ce8963f1f28fb6d0f88d26438f10b9575e99f9f4c020

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 194260
date: Thu, 28 Oct 2021 14:13:03 GMT
expires: Fri, 28 Oct 2022 14:13:03 GMT
last-modified: Mon, 25 Oct 2021 15:31:24 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 145613
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ Frame 1813 44 KB
17 KB 99ms
35ms Script
text/javascript 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16746
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 30 Oct 2021 06:39:56 GMT

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 1813 107 B
549 B 101ms
34ms Script
application/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=nowtoronto.com

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 30 Oct 2021 06:39:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 133 KB
36 KB 90ms
24ms Script
application/javascript 143.204.142.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: go.automatad.com
URL: https://go.automatad.com/geo/IHGgJY/afihbs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.142.197 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-142-197.ewr52.r.cloudfront.net
Software: Server /
Resource Hash: da263eff6489f28a35d328a1a5895db9adb14c22c40cd35d0afce85414cac701

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: j.HdMbJEPmUBB94Tm9YFDQOQn6pnybTd
content-encoding: gzip
etag: e2b905aea413c4d7479fb2bb9cbc6c65
age: 399
x-cache: Hit from cloudfront
server: Server
x-amz-rid: 0050361VBWVAVQZYQ68V
date: Sat, 30 Oct 2021 06:33:32 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 31b4da0406d8b733add8a3131335a500.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: EWR52-C2
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: G8hUeOA83u6nm9N0SI9rzgKjVbXvtFpMMhBPaMwAJi9WinPyaiofXA==

POST
H/1.1 200
OK v1 Show response
prg8.smartadserver.com/prebid/ 780 B
1 KB 354ms
171ms XHR
application/json 23.83.76.34
LEASEWEB-USA-LAX-11

General

Check archive.org

Show headers Download Go to

Full URL: https://prg8.smartadserver.com/prebid/v1
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.83.76.34 Phoenix, United States, ASN395954 (LEASEWEB-USA-LAX-11, US),
Reverse DNS
Software: /
Resource Hash: 7534c88d38879ad89988845c7f51d465950020a98af76304675cd76c11fca3a4

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 10%3b18%3b2
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H/1.1 200
OK v1 Show response
prg8.smartadserver.com/prebid/ 954 B
1 KB 354ms
171ms XHR
application/json 23.83.76.34
LEASEWEB-USA-LAX-11

General

Check archive.org

Show headers Download Go to

Full URL: https://prg8.smartadserver.com/prebid/v1
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.83.76.34 Phoenix, United States, ASN395954 (LEASEWEB-USA-LAX-11, US),
Reverse DNS
Software: /
Resource Hash: 2aa5678677630fa82ecf091f375fea932761ce5a4970877dc9625ccaeb84bc93

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 10%3b18%3b2
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H/1.1 200
OK v1 Show response
prg8.smartadserver.com/prebid/ 674 B
1 KB 511ms
328ms XHR
application/json 23.83.76.34
LEASEWEB-USA-LAX-11

General

Check archive.org

Show headers Download Go to

Full URL: https://prg8.smartadserver.com/prebid/v1
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.83.76.34 Phoenix, United States, ASN395954 (LEASEWEB-USA-LAX-11, US),
Reverse DNS
Software: /
Resource Hash: 5a19f3492d90e1750f646a8ae84fac8dbc3ac5ddbf4681009a0ab0f8ad71594f

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 10%3b18%3b2
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H/1.1 200
OK v1 Show response
prg8.smartadserver.com/prebid/ 781 B
1 KB 353ms
170ms XHR
application/json 23.83.76.34
LEASEWEB-USA-LAX-11

General

Check archive.org

Show headers Download Go to

Full URL: https://prg8.smartadserver.com/prebid/v1
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.83.76.34 Phoenix, United States, ASN395954 (LEASEWEB-USA-LAX-11, US),
Reverse DNS
Software: /
Resource Hash: 82449e6d9ddd2dc367b4f95b14fdd96b8d3a2aca6f5b3d88da0f85f53e9f4c07

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 10%3b18%3b2
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H/1.1 200
OK v1 Show response
prg8.smartadserver.com/prebid/ 690 B
1 KB 371ms
181ms XHR
application/json 23.83.76.34
LEASEWEB-USA-LAX-11

General

Check archive.org

Show headers Download Go to

Full URL: https://prg8.smartadserver.com/prebid/v1
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.83.76.34 Phoenix, United States, ASN395954 (LEASEWEB-USA-LAX-11, US),
Reverse DNS
Software: /
Resource Hash: 8dec9fe0a7c81f1da283dee9cc5740027bc03043eca45c1a8d02e357f448551d

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 10%3b18%3b2
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H/1.1 200
OK v1 Show response
prg8.smartadserver.com/prebid/ 815 B
1 KB 393ms
204ms XHR
application/json 23.83.76.34
LEASEWEB-USA-LAX-11

General

Check archive.org

Show headers Download Go to

Full URL: https://prg8.smartadserver.com/prebid/v1
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.83.76.34 Phoenix, United States, ASN395954 (LEASEWEB-USA-LAX-11, US),
Reverse DNS
Software: /
Resource Hash: 4269da1ebc56591eb20bd4f9f9385749e3e6d178a2778847b859de81b4badb6c

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 10%3b18%3b2
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H/1.1 200
OK v1 Show response
prg8.smartadserver.com/prebid/ 998 B
1 KB 552ms
198ms XHR
application/json 23.83.76.34
LEASEWEB-USA-LAX-11

General

Check archive.org

Show headers Download Go to

Full URL: https://prg8.smartadserver.com/prebid/v1
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.83.76.34 Phoenix, United States, ASN395954 (LEASEWEB-USA-LAX-11, US),
Reverse DNS
Software: /
Resource Hash: b50e9e7924b890af723727794f080ba0aa5ba46fe38b5fa8d2ff358ea426d67d

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 10%3b18%3b2
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H/1.1 200
OK v1 Show response
prg8.smartadserver.com/prebid/ 1 KB
1 KB 533ms
180ms XHR
application/json 23.83.76.34
LEASEWEB-USA-LAX-11

General

Check archive.org

Show headers Download Go to

Full URL: https://prg8.smartadserver.com/prebid/v1
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.83.76.34 Phoenix, United States, ASN395954 (LEASEWEB-USA-LAX-11, US),
Reverse DNS
Software: /
Resource Hash: 25d19481f243f16d83002a602a7f38a5112c75cd0aea92a9b15857b550b34095

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 10%3b18%3b2
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H/1.1 200
OK v1 Show response
prg8.smartadserver.com/prebid/ 827 B
1 KB 543ms
190ms XHR
application/json 23.83.76.34
LEASEWEB-USA-LAX-11

General

Check archive.org

Show headers Download Go to

Full URL: https://prg8.smartadserver.com/prebid/v1
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.83.76.34 Phoenix, United States, ASN395954 (LEASEWEB-USA-LAX-11, US),
Reverse DNS
Software: /
Resource Hash: 749b0478b5cde727552f8c917f0b2466e2316dff13f2e3f707cfa777c73c47ed

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 10%3b18%3b2
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H/1.1 200
OK v1 Show response
prg8.smartadserver.com/prebid/ 929 B
1 KB 555ms
181ms XHR
application/json 23.83.76.34
LEASEWEB-USA-LAX-11

General

Check archive.org

Show headers Download Go to

Full URL: https://prg8.smartadserver.com/prebid/v1
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.83.76.34 Phoenix, United States, ASN395954 (LEASEWEB-USA-LAX-11, US),
Reverse DNS
Software: /
Resource Hash: f998ca24450767d01caee41b345520c254bd5ff2f8dd02d480c8d4b40479b28c

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 10%3b18%3b72
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H/1.1 200
OK v1 Show response
prg8.smartadserver.com/prebid/ 1 KB
1 KB 625ms
233ms XHR
application/json 23.83.76.34
LEASEWEB-USA-LAX-11

General

Check archive.org

Show headers Download Go to

Full URL: https://prg8.smartadserver.com/prebid/v1
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.83.76.34 Phoenix, United States, ASN395954 (LEASEWEB-USA-LAX-11, US),
Reverse DNS
Software: /
Resource Hash: 1212b70a39d0997d8ef6d0c3c0968f66b3923e4309efa301403bf151f2e6a354

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:56 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 10%3b18%3b2
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 1 KB
1 KB 164ms
114ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 , United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

8fbd748a127b057ec535fb838596836321d057d66722ea3c8e9eb3f4c9aa6876

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

Date: Sat, 30 Oct 2021 06:39:57 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 37.120.205.148; 37.120.205.148; 673.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 4f14439d-ddff-4caf-b147-78f95c54ecd1
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://nowtoronto.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
344 B 108ms
38ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bkadmUFZKr6QucaKlId8sQ
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 2da5b0421bd3e32a47a9458a9c16b712bc181d7cd58060785c6757d5cd32ed2b

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
205 B 118ms
49ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bkadmUFZKr6QucaKlId8sQ
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: e4ea358ab0ef0e162e88a0154312ef58ec2ae4d526cd45c4e4fd6d8d25e2e352

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
204 B 134ms
65ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bkadmUFZKr6QucaKlId8sQ
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 065b784c029d7fba6ddd71e9e639828a12d606757ddc952e69b97e947cd06c4b

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
196 B 125ms
56ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bkadmUFZKr6QucaKlId8sQ
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 3b6bafb5fa254472dddcd1a08154583be9e752c9de8eb7a96b8a7b72489b5a68

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
204 B 125ms
56ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bkadmUFZKr6QucaKlId8sQ
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: cb0630b98c2ec6910ca827060550385e3e22ad9a551d6a1b5529b9fbd6f59bba

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
205 B 250ms
182ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bkadmUFZKr6QucaKlId8sQ
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 07e2fa463174bbf2da588018edca43b7bdbbd78bf1912953e6d8e5bb4d6fa69f

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
196 B 122ms
54ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bkadmUFZKr6QucaKlId8sQ
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 4bcab44080eabe12e89917ea4c94562e28f45dfd752a557b53db6c06b3dd96d1

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
196 B 172ms
105ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bkadmUFZKr6QucaKlId8sQ
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 67992ee3876857714b7e3536ca264c767d4ba22af6fa18f6d6a2218e4c8a7700

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
205 B 130ms
63ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bkadmUFZKr6QucaKlId8sQ
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 6ec72a400bde9499214adb271034a8ff24af6ec8c3dd44c4a74fc90306cad781

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
203 B 135ms
68ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bkadmUFZKr6QucaKlId8sQ
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 973e06ae9fe6186cd339ab47bb77fe5aabd988bcf1b3943ad8ce9d5318a45a9f

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
196 B 129ms
62ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bkadmUFZKr6QucaKlId8sQ
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 2d81442d1237ab50995a1812f4d70c9453f5a71a369687eacea23eed9b476124

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 117 B
204 B 128ms
61ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bkadmUFZKr6QucaKlId8sQ
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: ea54237c07cda5f602a647d96aa6964bda692622be75efac867874c8732e6722

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 94 B
740 B 168ms
120ms XHR
application/json 63.251.114.136
INTERNAP-2BLK

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.38.0
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.114.136 , United States, ASN12181 (INTERNAP-2BLK, US),
Reverse DNS
Software: /
Resource Hash: 732807d56440673bc261c5074acb08fbc3b1acf32d839776d52edb66395683fb

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

Date: Sat, 30 Oct 2021 06:39:57 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://nowtoronto.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap5ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 97

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
333 B 138ms
65ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Oct 2021 06:39:57 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6a62a63edf6d62f4-ORD
access-control-allow-headers: origin, content-type

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
38 B 138ms
65ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Oct 2021 06:39:57 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6a62a63edf7162f4-ORD
access-control-allow-headers: origin, content-type

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
38 B 138ms
66ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Oct 2021 06:39:57 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6a62a63edf7362f4-ORD
access-control-allow-headers: origin, content-type

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 93 KB
14 KB 194ms
154ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 , United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

server-143-204-142-197.ewr52.r.cloudfront.net

Software

nginx/1.17.9 /

Resource Hash

50f4f1973a9175eb4dd0147240489165a6d9cda4d0f3e5a5a4d6630fa99ec66b

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

Date: Sat, 30 Oct 2021 06:39:57 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 37.120.205.148; 37.120.205.148; 673.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 85f33588-f5c9-4c8c-a918-01fd3ca683a5
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://nowtoronto.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 404 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
283 B 32ms
31ms XHR
text/plain 143.204.142.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=undefined&u=https%3A%2F%2Fnowtoronto.com%2F
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.142.197 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-142-197.ewr52.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:57 GMT
via: 1.1 31b4da0406d8b733add8a3131335a500.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: EWR52-C2
x-cache: Error from cloudfront
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
content-length: 0
x-amz-cf-id: V5VJEjdfPkMMRNBL0GRHbEx5K7xQ-LqFdX261hAtpBwlfpcEwioyXA==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
492 B 36ms
35ms XHR
text/javascript 143.204.142.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.amazon-adsystem.com/e/dtb/bid?u=https%3A%2F%2Fnowtoronto.com%2F&pid=YhqGUhGqLPx84&cb=0&ws=1600x1200&v=7.69.01&t=2000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22320x50%22%5D%2C%22sn%22%3A%2268572626%2FATD_Nowtoronto.com%2FATD_320x50_LHS_FooterWA%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22320x50%22%5D%2C%22sn%22%3A%2268572626%2FATD_Nowtoronto.com%2FATD_320x50_RHS_FooterWA%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x600%22%5D%2C%22sn%22%3A%2268572626%2FATD_Nowtoronto.com%2FATD_300x600_GENERAL%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%2268572626%2FATD_Nowtoronto.com%2FATD_336x280_GENERAL%22%7D%2C%7B%22sd%22%3A%224%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%2268572626%2FATD_Nowtoronto.com%2FATD_728x90_GENERAL%22%7D%2C%7B%22sd%22%3A%225%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%2268572626%2FATD_Nowtoronto.com%2FATD_970x250_GENERAL%22%7D%2C%7B%22sd%22%3A%226%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%2268572626%2FATD_Nowtoronto.com%2FATD_728x90_GENERAL%22%7D%2C%7B%22sd%22%3A%227%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%2268572626%2FATD_Nowtoronto.com%2FATD_728x90_GENERAL%22%7D%2C%7B%22sd%22%3A%228%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%2268572626%2FATD_Nowtoronto.com%2FATD_728x90_GENERAL%22%7D%5D&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.142.197 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:57 GMT
via: 1.1 31b4da0406d8b733add8a3131335a500.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: EWR52-C2
x-amz-rid: KXZSH34J592BH9Q575D0
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
strict-transport-security: max-age=47474747; includeSubDomains; preload
timing-allow-origin: *
content-length: 23
x-amz-cf-id: Bjx8VX7_1SK3_HzugegKYw27UXBX9Yx79oO5qGaMW8FANX1nuW3xbA==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 67ms
21ms XHR
application/javascript 143.204.142.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.142.197 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-142-197.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: c91ZTIbLZrDqT0mloV_AD7.LNsTlhW69
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 18967
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Thu, 07 Oct 2021 01:02:33 GMT
server: AmazonS3
date: Sat, 30 Oct 2021 01:23:51 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 57a894c75d329d29ecabaa7a88eb80a5.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: EWR52-C2
x-amz-cf-id: cSOB8vWwXAon75Nx14YTedLs1rH43UWE7Q8U8dGDhMrGh5Pf9_Auqg==

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 015E 14 KB
3 KB 74ms
73ms XHR
text/xml 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F68572626%2Ftelaria&description_url=https%3A%2F%2Fnowtoronto.com%2F&tfcd=0&npa=0&sz=640x480&ciu_szs=728x90%2C300x250&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=1635575995&nofb=1&vpmute=1&vpa=1&vad_format=linear&vpos=preroll&cust_params=__p_cust_params_encoded__&channel=vastadp%2Bvpaidadp_html5&sdkv=h.3.486.2%2Fvpaid_adapter&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=115197365&sdk_apis=2%2C8&sid=92DCCB85-6E50-41FB-BF6E-2BE55A295605&eid=44737475%2C44750821&top=https%3A%2F%2Fnowtoronto.com%2F&url=https%3A%2F%2Fnowtoronto.com%2F&dt=1635575997307&cookie_enabled=1&scor=771610488760781&ged=ve4_td1_tt0_pd1_la1000_er1388.731.1388.731_vi0.0.1200.1600_vp0_eb16619

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.486.2_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6fdc224ee75b9d84bc98faf398a38cf9982cdaa701f979308521bb73f0790e21

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2714
x-xss-protection: 0
google-lineitem-id: 5441385092
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138318866024
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
96 B 18ms
18ms Image
image/gif 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j93&a=901859952&t=event&ni=1&_s=1&dl=https%3A%2F%2Fnowtoronto.com%2F&ul=en-us&de=UTF-8&dt=Everything%20Toronto%20%7C%20NOW%20Magazine%20-%20News%20-%20Life%20-%20Culture%20-%20Real%20Estate&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2F&el=10&_u=aHDAgEABAAAAAE~&jid=&gjid=&cid=283783354.1635575995&tid=UA-3462111-1&_gid=489409343.1635575995&gtm=2wgar0MCDBPJR&z=173638985

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Oct 2021 15:36:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54184
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 015E 156 B
612 B 484ms
434ms XHR
text/xml 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-video-pub-2224625513254808&slotname=now_central&ad_type=video&description_url=https%3A%2F%2Fnowtoronto.com%2F&max_ad_duration=33000&videoad_start_delay=0&vpmute=0&vpa=click&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&sdkv=h.3.486.2%2Fvpaid_adapter&video_product_type=0&min_ad_duration=0&sz=411x230&adsafe=high&hl=en&ca_type=image&unviewed_position_start=1&output=xml_vast4&osd=2&frm=0&vis=1&sdr=1&num_ads=1&t_pyv=exclude&video_format=43&is_amp=0&u_so=l&sdki=44d&adk=115197365&sdk_apis=2%2C8&eid=44737475%2C44750821&top=https%3A%2F%2Fnowtoronto.com%2F&url=https%3A%2F%2Fnowtoronto.com%2F&dt=1635575997407&cookie_enabled=1&correlator=1635575995&ad_block=1&ged=ve4_td1_tt0_pd1_la1000_er1388.731.1388.731_vi0.0.1200.1600_vp0_ts0_eb16619

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.486.2_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: https://imasdk.googleapis.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/xml; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
792 B 162ms
35ms Script
application/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=nowtoronto.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 30 Oct 2021 06:39:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 336ms
34ms Script
application/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=nowtoronto.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 30 Oct 2021 06:39:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 217 KB
49 KB 543ms
542ms XHR
text/plain 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4157242845177764&correlator=2283990463036382&output=ldjh&impl=fifs&eid=31063282%2C31063350%2C31063166&vrg=2021102701&ptt=17&sc=1&sfv=1-0-38&ecs=20211030&iu_parts=68572626%2Cnow%2Cpage-btm%2Cbigbox%2Chalfpage%2Csection1%2Csection2%2Csection3%2CATD_Nowtoronto.com%2CATD_320x50_LHS_FooterWA%2CATD_320x50_RHS_FooterWA%2CATD_728x90_GENERAL&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3%2C%2F0%2F1%2F4%2C%2F0%2F1%2F5%2C%2F0%2F1%2F6%2C%2F0%2F1%2F7%2C0%2F8%2F9%2C0%2F8%2F10%2C0%2F8%2F11&prev_iu_szs=728x90%7C970x90%7C970x250%2C300x250%2C300x600%2C728x90%2C728x90%2C728x90%2C320x50%2C320x50%2C728x90&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Cmod%3Dfi_ap_ftr%26amznbid%3D2%26amznp%3D2%7Cmod%3Dfi_ap_ftr%26amznbid%3D2%26amznp%3D2%7Cmod%3Dfi_hp_tp%26amznbid%3D2%26amznp%3D2&eri=1&cust_params=type%3Dfrontpage%252Csingle-page%26section%3Dhome%26id%3D10240&cookie_enabled=1&bc=31&abxe=1&lmt=1635567193&dt=1635575997821&dlt=1635575994539&idt=1046&frm=20&biw=1600&bih=1200&oid=2&adxs=436%2C848%2C654%2C440%2C440%2C440%2C0%2C1280%2C440&adys=5820%2C1791%2C3374%2C1656%2C4275%2C5190%2C1150%2C1150%2C336&adks=2849181273%2C3533494882%2C2409829590%2C674376211%2C643305964%2C1052245706%2C4240535680%2C1332535204%2C2411758630&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fnowtoronto.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x5920%7C348x260%7C736x5459%7C736x5459%7C736x5459%7C736x5459%7C320x-1%7C320x-1%7C728x90&msz=1400x100%7C300x260%7C300x610%7C728x100%7C728x100%7C728x100%7C320x-1%7C320x-1%7C728x-1&ga_vid=283783354.1635575995&ga_sid=1635575998&ga_hid=901859952&ga_fc=true&fws=4%2C4%2C4%2C4%2C4%2C4%2C516%2C516%2C4&ohw=1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C320%2C320%2C728&btvi=1%7C2%7C3%7C4%7C5%7C6%7C0%7C0%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102701.js?31063350

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9f556ac4e121c3d6eb7828c858524487e363eabe2ea60dd892e7c08c8959ad33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:58 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 50043
x-xss-protection: 0
google-lineitem-id: 5818852050,5818852050,5818852050,-1,-1,-1,-1,-1,-1
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138368744961,138368744064,138368703374,-1,-1,-1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9674 6 KB
4 KB 163ms
36ms Document
text/html 2607:f8b0:4006:81e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102701.js?31063350

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sat, 30 Oct 2021 06:39:57 GMT
expires: Sun, 30 Oct 2022 06:39:57 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 015E 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/gif

GET /
pubads.g.doubleclick.net/pagead/interaction/ Frame 015E 0
0

GET
H2 200 t.gif
sb.freeskreen.com/ Frame 2F17 43 B
257 B 24ms
24ms Image
image/gif 3.229.194.186
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1635575997&p=219&c=4141&s=undefined&d=1283547&v=20280&t=c80375eb-f03e-44ec-a3de-68f5b3712991&co=CA&pr=QC&ci=Montreal&dm=GM&flc=unknown&slc=unknown&ttm=1635575995458&gdpr=0&gdpr_consent=&e=optout&m=1&x=%3B%3Bvpaidloader%3B%22AdError%20303%20(No%20Ads%20VAST%20response%20after%20one%20or%20more%20Wrappers)%3A%20AdError%20303%3A%20No%20Ads%20VAST%20response%20after%20one%20or%20more%20Wrappers%5CnError%5Cnat%20new%20PC%20(https%3A%2F%2Fimasdk.googleapis.com%2Fjs%2Fsdkloader%2Fima3.js%3A568%3A329)%5Cnat%20CH.M%20(ima3.js%3A661%3A276)%5Cnat%20Hj%20(ima3.js%3A126%3A200)%5Cnat%20WA.l.dispatchEvent%20(ima3.js%3A124%3A365)%5Cnat%20WA.D%20(ima3.js%3A512%3A170)%5Cnat%20Dj%20(ima3.js%3A123%3A150)%5Cnat%20b%20(ima3.js%3A121%3A292)%22
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.229.194.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-229-194-186.compute-1.amazonaws.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:57 GMT
server: Apache/2.4.29 (Ubuntu)
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
expires: -1

GET
H2 200 t.gif
sb.freeskreen.com/ Frame 2F17 43 B
257 B 27ms
26ms Image
image/gif 3.229.194.186
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.freeskreen.com/t.gif?tm=1635575998&p=219&c=4141&s=undefined&d=1556087&v=29217&t=c80375eb-f03e-44ec-a3de-68f5b3712991&co=CA&pr=QC&ci=Montreal&dm=GM&flc=unknown&slc=unknown&ttm=1635575995458&gdpr=0&gdpr_consent=&e=LoaderStartHB&m=1&x=%3B%3Bvideoloader%3B
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.229.194.186 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-229-194-186.compute-1.amazonaws.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:58 GMT
server: Apache/2.4.29 (Ubuntu)
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
cache-control: no-cache, no-store
content-type: image/gif
content-length: 43
expires: -1

GET
H/1.1

206
Partial Content

file.mp4
r5---sn-ab5sznlk.c.2mdn.net/videoplayback/id/ada79b5c856e056b/itag/18/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3776939335/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mi... Frame 2F17
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/ada79b5c856e056b/itag/18/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3776939335/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/sign...
https://r5---sn-ab5sznlk.c.2mdn.net/videoplayback/id/ada79b5c856e056b/itag/18/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3776939335/sparams/acao,ctier,expire,id,ip,ipbits,it...

442 KB
443 KB

172ms
80ms

Media
video/mp4

2607:f8b0:4006:3d::a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r5---sn-ab5sznlk.c.2mdn.net/videoplayback/id/ada79b5c856e056b/itag/18/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3776939335/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/1A5C992549DDCB69A707EB9827FAD5A7CCEA79CC.1E68B85A973873E061115DC37B109B95168849B7/key/cms1/cms_redirect/yes/mh/Yk/mip/2a0d:5600:9:4b00:c2::1/mm/42/mn/sn-ab5sznlk/ms/onc/mt/1635575422/mv/u/mvi/5/pl/49/file/file.mp4

Protocol

HTTP/1.1

Server

2607:f8b0:4006:3d::a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

25ee756753a096c1446eb1be86b077a2bff945ccaedb0c99aa57ae4996edf63a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 06:39:58 GMT
X-Content-Type-Options: nosniff
Content-Range: bytes 0-452403/452404
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 452404
Last-Modified: Fri, 24 Sep 2021 13:48:54 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Sat, 30 Oct 2021 06:39:58 GMT

Redirect headers

date: Sat, 30 Oct 2021 06:39:58 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 653
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
location: https://r5---sn-ab5sznlk.c.2mdn.net/videoplayback/id/ada79b5c856e056b/itag/18/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3776939335/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/1A5C992549DDCB69A707EB9827FAD5A7CCEA79CC.1E68B85A973873E061115DC37B109B95168849B7/key/cms1/cms_redirect/yes/mh/Yk/mip/2a0d:5600:9:4b00:c2::1/mm/42/mn/sn-ab5sznlk/ms/onc/mt/1635575422/mv/u/mvi/5/pl/49/file/file.mp4
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://nowtoronto.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://nowtoronto.com
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 12 KB
10 KB 87ms
40ms XHR
application/json 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021102701&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102701.js?31063350

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86329785d7b9ffd14b7e2db4b377017edc7b9da561911a673d7bca671fc2f5b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 30 Oct 2021 06:39:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9332
x-xss-protection: 0

GET
H2 200 bl-f821a95-f4985751.js Show response
tagan.adlightning.com/automatad-nowtoronto/ 47 KB
20 KB 27ms
27ms Script
application/javascript 18.67.65.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-nowtoronto/bl-f821a95-f4985751.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ad2f2e043d230df8d4d9ef81ff9f0d77a6941cdbfb1b48c57704d804e04cd0f4

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 28 Oct 2021 21:30:51 GMT
content-encoding: gzip
age: 119348
x-cache: Hit from cloudfront
content-length: 20336
x-amz-meta-git_commit: f821a95
last-modified: Thu, 28 Oct 2021 21:05:07 GMT
server: AmazonS3
etag: "d7bac72701468820bb358ceab63315f9"
x-amz-version-id: f_b22BKkA9ft0FDpksgjSzQEDhTyIJyD
via: 1.1 4ee1745ee3cece0fab563f5a32ba165b.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: IAD89-P1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: WzCL2vzUBhM_9b3TG-kbyBDEGiJptaccYva3bWlR45UmyJgawtI2Ww==

GET
H2 200 b-7b120a5-460a50dd.js Show response
tagan.adlightning.com/automatad-nowtoronto/ 73 KB
28 KB 36ms
35ms Script
application/javascript 18.67.65.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e7dea8736c7499605b93a1ccdfcf69a0e55cc35b3724bcee9e5be23970ea7ec5

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 21 Oct 2021 22:48:59 GMT
content-encoding: gzip
age: 719460
x-cache: Hit from cloudfront
content-length: 28315
x-amz-meta-git_commit: 7b120a5
last-modified: Tue, 03 Aug 2021 16:33:55 GMT
server: AmazonS3
etag: "5b1798a51491fa61878b946ed2ec5652"
x-amz-version-id: Zh8qAkywSf0c6iJXpDo_BleECzjNQ_LW
via: 1.1 4ee1745ee3cece0fab563f5a32ba165b.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: IAD89-P1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 9_nnIiA1t8wtwLHgDAhUwXranH7uSuKAImHaQw24kOQlkcINaJJcWw==

GET
H2 200 6228020355438796672
tpc.googlesyndication.com/simgad/ 107 KB
107 KB 326ms
23ms Image
image/jpeg 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6228020355438796672

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bca61c98c19002a5922f3ee80a9034f6473bc6ca006c76c25e1c3ca5b713c77d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 04:21:01 GMT
x-content-type-options: nosniff
age: 94737
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 109513
x-xss-protection: 0
last-modified: Mon, 25 Oct 2021 17:52:36 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 29 Oct 2022 04:21:01 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211027/r20110914/ 19 KB
8 KB 323ms
21ms Script
text/javascript 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211027/r20110914/abg_lite_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9098bce32fa311e967ba3bae1f3c4763801acf08ba95c67fb477f468e42a69a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Sat, 30 Oct 2021 06:34:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 318
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7760
x-xss-protection: 0
server: cafe
etag: 2659786357195577193
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 Nov 2021 06:34:40 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/ 3 KB
2 KB 322ms
20ms Script
text/javascript 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/window_focus_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4af635698cb6488a8df86b99febedbc979c76e04f675f3a9cdc66f7b4d86aff6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:29:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 635
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1470
x-xss-protection: 0
server: cafe
etag: 9165589572046851897
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 Nov 2021 06:29:23 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ 120 KB
37 KB 345ms
43ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eaaa6059ef4c9ca12e78fcc03ae77ad4cbf05dc73c1fedf64b28a632868bd829

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Sat, 30 Oct 2021 06:39:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1635161763799786"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 30 Oct 2021 06:39:58 GMT

GET
H2 200 2954470754302142984
tpc.googlesyndication.com/simgad/ 242 KB
242 KB 249ms
47ms Image
image/jpeg 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2954470754302142984

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d6adb6691159e3f42c9b5586393402cb804d2b5d81a1d3c89d75c216a6f6ec6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 04:21:06 GMT
x-content-type-options: nosniff
age: 94732
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 247755
x-xss-protection: 0
last-modified: Mon, 25 Oct 2021 17:50:15 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 29 Oct 2022 04:21:06 GMT

GET
H2 204 l
www.google.com/ads/measurement/ 0
0 39ms
39ms Image
text/html 2607:f8b0:4006:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQNt0DZomCYEMR0BQKfAPklLy7808P_rhyG2_quQ9iBbxGVnqXPYH_kD4qFbjl1KxXGwVhqLp_cmh33PsxOXrDkA01x7A
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81d::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ 0
0 43ms
42ms Fetch
image/gif 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst-3G25VY1ACU6VLE9m7apY9p2foQ4vQPF4I0Gas9oGUKXIvmriTdDQPtbcYpernC0ZMrgu9jC1j_saQghvZNIDYX97WEO8egSDuf7PHX8y2wODIwsak0ueGJ8nC-44ic33i7itQvhEFrBfgqCdW1MWkC6XZex_zLtMJHSqkpza4ZA4otZLxUNfh3VfUn16wYTWRyyrDXyToOXpXBA9nHXKEtbXfBCMZXKguXhIMiBbbiu1FcUi0ye1nEvHflFn3bZIDB2zBI62GvqpnAWGHN9kmcramTb9BDyKxoNcRCrMXFAPB144&sig=Cg0ArKJSzJ4DDp08oSrsEAE&adurl=

Requested by

Host: nowtoronto.com
URL: https://nowtoronto.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 30 Oct 2021 06:39:59 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ 0
0 64ms
39ms Fetch
image/gif 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss-ZGcaEjNy2O6UvcwuW2RMByrPdvPFIlcUCIrzztKpjdomk6h6XV1oFvEIKOVyIqKf1Tt5niYcRtLFfTtE-n2VnRoEam9EsO83nM0MW1CobfhvYog8zYeLpJpXBvkeG3W4EpHhOb_7dzSRHD9LLGN4-rNwWCptHjJ4SNNblRlhULl6ww4wIL6PFXReV2b7fvxDkBi1CxJF2ZiKI8M6U8f9M7DHirQvbHK-GiDDbvY7tAqc7hej4ivSEt6r01_I6iBJp5DBdexuQU9W-RlY6kvwwrlUk8k8nb6E3ccUCmniQgttst1sIpE&sig=Cg0ArKJSzCuXuEc9BRXIEAE&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-143-204-142-197.ewr52.r.cloudfront.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 30 Oct 2021 06:39:59 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Sat, 30 Oct 2021 06:39:59 GMT

GET
DATA 200
OK truncated
/ 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7bb2314f9c13b4e0945b92e9b6b1c422dad7fa3c32e6520e36eeea2a6944c2f5

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 63ms
63ms Script
text/javascript 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sat, 30 Oct 2021 06:39:59 GMT

GET
H2

200

connatix.playspace.js Show response
cds.connatix.com/p/135385/ Frame 49FB
Redirect Chain

https://cd.connatix.com/connatix.playspace.js
https://cds.connatix.com/p/135385/connatix.playspace.js

1 MB
235 KB

37ms
10ms

Script
application/javascript

151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/135385/connatix.playspace.js
Protocol: H2
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: d766ef969807a98996ba07659231cce584bd9b3f016cf0dcc892aa1393b82491

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:59 GMT
content-encoding: br
last-modified: Fri, 29 Oct 2021 15:25:05 GMT
age: 54804
etag: "6899cc87c4e95c4d7d04b42e9af99cb8"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges: bytes
content-length: 240070

Redirect headers

location: https://cds.connatix.com/p/135385/connatix.playspace.js
date: Sat, 30 Oct 2021 06:39:59 GMT
cache-control: no-cache, no-store, must-revalidate, max-age=0
accept-ranges: bytes
content-length: 0

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
492 B 33ms
33ms XHR
text/javascript 143.204.142.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.amazon-adsystem.com/e/dtb/bid?u=https%3A%2F%2Fnowtoronto.com%2F&pid=YhqGUhGqLPx84&cb=1&ws=1600x1200&v=7.69.01&t=2000&slots=%5B%7B%22sd%22%3A%229%22%2C%22s%22%3A%5B%22320x50%22%5D%2C%22sn%22%3A%2268572626%2FATD_Nowtoronto.com%2FATD_320x50_LHS_FooterWA%22%7D%2C%7B%22sd%22%3A%2210%22%2C%22s%22%3A%5B%22320x50%22%5D%2C%22sn%22%3A%2268572626%2FATD_Nowtoronto.com%2FATD_320x50_RHS_FooterWA%22%7D%5D&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.142.197 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:59 GMT
via: 1.1 31b4da0406d8b733add8a3131335a500.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: EWR52-C2
x-amz-rid: 4626V3FFYWN3B54YXKE3
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
strict-transport-security: max-age=47474747; includeSubDomains; preload
timing-allow-origin: *
content-length: 23
x-amz-cf-id: vJWXbIrph5z7j_ImEANQ6HJY-53zE2d9euMlNEnDugQ58JtxOJXzQQ==

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 27 KB
9 KB 159ms
158ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 , United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

16ebd0d49da9f412642fab6f9962f8ae29f4b53a52d4196a91a57e55c053ac98

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

Date: Sat, 30 Oct 2021 06:39:59 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 37.120.205.148; 37.120.205.148; 673.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 37f4a57d-411a-4697-a16b-b38d1ad553bc
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://nowtoronto.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK v1 Show response
prg8.smartadserver.com/prebid/ 903 B
1 KB 182ms
182ms XHR
application/json 23.83.76.34
LEASEWEB-USA-LAX-11

General

Check archive.org

Show headers Download Go to

Full URL: https://prg8.smartadserver.com/prebid/v1
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.83.76.34 Phoenix, United States, ASN395954 (LEASEWEB-USA-LAX-11, US),
Reverse DNS
Software: /
Resource Hash: 9798140b1af33607f99a077d617109b9d9134b8f3ee2f8b102c162cb96b589e4

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:58 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 10%3b18%3b2
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H/1.1 200
OK v1 Show response
prg8.smartadserver.com/prebid/ 1 KB
1 KB 175ms
175ms XHR
application/json 23.83.76.34
LEASEWEB-USA-LAX-11

General

Check archive.org

Show headers Download Go to

Full URL: https://prg8.smartadserver.com/prebid/v1
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.83.76.34 Phoenix, United States, ASN395954 (LEASEWEB-USA-LAX-11, US),
Reverse DNS
Software: /
Resource Hash: bb9b98ad001873cd101ccb329f39c4f4929cfb60f80ef5f4896219796bdf8b7c

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:59 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 10%3b18%3b2
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
194 B 31ms
30ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bkadmUFZKr6QucaKlId8sQ
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: f93fccad9ed488d4b19d34a203e63bdbe95b267a283233d6a1d606ed4d114cb2

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Oct 2021 06:39:59 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
205 B 30ms
30ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bkadmUFZKr6QucaKlId8sQ
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 424fb94f8a5d21f840a66f88e8c470786b75f9ae47eccde4890bd600a81dddbe

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Oct 2021 06:39:59 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
61 B 64ms
63ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Oct 2021 06:39:59 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://nowtoronto.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6a62a64b3ad862f4-ORD
access-control-allow-headers: origin, content-type

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 263 B
1 KB 124ms
123ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_IHGgJY.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 , United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

75da68e189f319170665f545b82e6e7cdd172b1b1b939e372966628f2d9c7cd2

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://nowtoronto.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:39:59 GMT
X-Proxy-Origin: 37.120.205.148; 37.120.205.148; 673.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 4740c75a-954b-4a65-aa18-fbe04e3f16ec
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://nowtoronto.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 263
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 9084 12 KB
5 KB 20ms
19ms Document
text/html 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Fri, 29 Oct 2021 23:41:50 GMT
expires: Sat, 29 Oct 2022 23:41:50 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 25089
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 7245 783 B
919 B 40ms
40ms Document
text/html 2607:f8b0:4006:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a4569d7aead809c69a87b7b3b3ae94a6a2e521b09095ba922a4129e983d08c65

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-iDllS8JyOSNK58VVR3U6Fg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Sat, 30 Oct 2021 06:39:59 GMT
date: Sat, 30 Oct 2021 06:39:59 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-iDllS8JyOSNK58VVR3U6Fg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 sKl_vPiz0OchHmL4Vfbrj3Wozc3CsK_Jq53kDzx3_oA.js Show response
pagead2.googlesyndication.com/bg/ Frame 9084 35 KB
14 KB 18ms
18ms Script
text/javascript 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/sKl_vPiz0OchHmL4Vfbrj3Wozc3CsK_Jq53kDzx3_oA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b0a97fbcf8b3d0e7211e62f855f6eb8f75a8cdcdc2b0afc9ab9de40f3c77fe80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 21:13:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 206760
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13525
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 18:58:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Thu, 27 Oct 2022 21:13:59 GMT

GET
H2 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 7245 0
0 39ms
39ms Image
text/html 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021102701&jk=4157242845177764&rc=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s40-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H2 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
165 B 34ms
33ms Script
application/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=nowtoronto.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 30 Oct 2021 06:39:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 33ms
33ms Script
application/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=nowtoronto.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 30 Oct 2021 06:39:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 29 KB
13 KB 323ms
323ms XHR
text/plain 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4157242845177764&correlator=605882451758716&output=ldjh&impl=fifs&eid=31063282%2C31063350%2C31063166&vrg=2021102701&ptt=17&sc=1&sfv=1-0-38&ecs=20211030&iu_parts=68572626%2CATD_Nowtoronto.com%2CATD_320x50_LHS_FooterWA%2CATD_320x50_RHS_FooterWA&enc_prev_ius=0%2F1%2F2%2C0%2F1%2F3&prev_iu_szs=320x50%2C320x50&prev_scp=mod%3Dfi_ap_ftr%26amznbid%3D2%26amznp%3D2%26hb_format_appnexus%3Dbanner%26hb_source_appnexus%3Dclient%26hb_size_appnexus%3D320x50%26hb_pb_appnexus%3D0.29%26hb_adid_appnexus%3D101fd5a822ad840f%26hb_bidder_appnexus%3Dappnexus%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D320x50%26hb_pb%3D0.29%26hb_adid%3D101fd5a822ad840f%26hb_bidder%3Dappnexus%7Cmod%3Dfi_ap_ftr%26amznbid%3D2%26amznp%3D2%26hb_format_appnexus%3Dbanner%26hb_source_appnexus%3Dclient%26hb_size_appnexus%3D320x50%26hb_pb_appnexus%3D0.17%26hb_adid_appnexus%3D102ddaa2181305d3%26hb_bidder_appnexus%3Dappnexus%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D320x50%26hb_pb%3D0.17%26hb_adid%3D102ddaa2181305d3%26hb_bidder%3Dappnexus&eri=1&cust_params=type%3Dfrontpage%252Csingle-page%26section%3Dhome%26id%3D10240&cookie=ID%3D09105fb5aaf41732%3AT%3D1635575997%3AS%3DALNI_MZJRBr-Lj894aEXH0y78M2WSY17sw&bc=31&abxe=1&lmt=1635567193&dt=1635575999489&dlt=1635575994539&idt=1046&frm=20&biw=1600&bih=1200&oid=2&adxs=0%2C1280&adys=1171%2C1171&adks=2375593400%2C1161814761&ucis=a%7Cb&ifi=10&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fnowtoronto.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=320x-1%7C320x-1&msz=320x-1%7C320x-1&psts=AGkb-H_blvIgYoR-mMOeqiyHSDYKkRLSWSLAklVAlf7TxRFSZjyH5hjbLixRCyteBmwhNNf2fsaWbo0o65nEP6gYq1I%2CAGkb-H8bwJM2aNmJ_Keg0oE4pP6akYuffJeLwzeYbCFOUNMDMs1FFGs6s9u6t-maX8mGGoIXd1MV9Udcs9KMyaPflRs%2CAGkb-H_kgLdCC3j0zKkfnw-o7CN5S1dbptmRGyuknEcNLEKCne6Yp_PTBMnC8m2TcRDHkAiePqnHMi-AMuGgjWf_OT8&ga_vid=283783354.1635575995&ga_sid=1635575998&ga_hid=901859952&ga_fc=true&fws=516%2C516&ohw=320%2C320&btvi=0%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102701.js?31063350

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a7158fd06b521cbb90bfb0ea8f3f76e1ce4cfb9ce72f5579811112359ce546d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:39:59 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13562
x-xss-protection: 0
google-lineitem-id: -1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://nowtoronto.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
56 B 39ms
39ms Image
image/gif 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021102701&jk=4157242845177764&bg=!vL-lv_vNAAZzbWp4c207ACkAdvg8WmLfmAg5VrMGg6iErQkI0I6pFTFRx1BvXMB9eFcAp153htAFcwIAAADfUgAAAAloAQcKAHD6TGhyTmL1QovlVmvBUT5ZutcHL3vmEqNdbwsXvZcFIReC87mc2d9jNQvFD57LbqJFGt08xS0RBxB6_DUXlQJ5rkT44xkpNMEihJ6T9fvqfJI6iTIfNEeIVMTP4Y9SiBP2szhDuyqAKxG-USZ_BDtDmQK4nHJ6A178vV9jgKDaUPOcO4g-087bNG2HOCSSTyjcPzGejNIV08h8JUl09D5I1gE-6AkDz1nYs7qhxTIq9Vo2RtaFcE8RsyKinzQYdMVJwJ2c9if2F2Bn2bEiXIaUfaxZmyTyNRgVK-uRBJcdmB7RHS7zaU0rDwA11xaWLA70F5MLoCYbFSIKYw_8Xxh5qyl7RNksszBRjxZrnYt1lAQUkqkcb7HbgbizYOSy_XgKFS7OQ97GGju0H3aBVfU3oVze3a4CuXgx0tZcz0lPdT_vxADg9Cjm7OHRqWJUEKW39S_iEaRlv_8m1zFsWa8Zyd1YTBE4R9FnYoKmROhk4V6B0MCjq0mG_Wa4dZc7p6nMbxpgI1HBYsMVZFL3PnIGYdmAbwU7tnO1GiecCjEuQrBwMJ2urSjL2x3IqXJlohn3dmXvWvyjo5A5-MORLCHdY-EyrT0z80qAwAXTRlq3gdjYNEnJ8ZXmywwmeGTWsVyay_5yxZj0ujreYSg0XGDyzxku1RNxaiaM1IwyZsoe7ABgfiX3lrA5mryJuiuMi1rXTLo2V0uAxsbdaoeBPvXjSwCyJKDUulGQTR-Uwci0o0JUOpMI2ooQcVIQiDeHI9LtTmd7Pf-6BhDu1RnimU3-vFiudaWmBDqnlYid9y0f1fvq76_-_E9tadNZ5OWDgEyg3rhxlAmq37IUVF6QLs-AAV3x4yMF2Q77pSJfBm2UOSdFXMsNDsHBFVidHLgDKhaH_RQRIpQLBz1N59QYVvvrABoSTLknxTksjlCJmSkDz_nYrChKO1bcOwKCwoTagJ08xsX9haz3wUZgrx6CBsfmVeVRQ0RzgMdkN-wsFr_d356WATX86aylD46dLNmuZKl8bDUZQyHYixKBqtET8EuQ_VyKbUtFsfL4G1lIL3-ZODyYXvrqr31QNZXc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:39:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 69EF 6 KB
3 KB 321ms
19ms Document
text/html 2607:f8b0:4006:81e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sat, 30 Oct 2021 06:39:57 GMT
expires: Sun, 30 Oct 2022 06:39:57 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F5C1 6 KB
3 KB 166ms
20ms Document
text/html 2607:f8b0:4006:81e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sat, 30 Oct 2021 06:39:57 GMT
expires: Sun, 30 Oct 2022 06:39:57 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 common.js Show response
maps.googleapis.com/maps-api-v3/api/js/46/11/intl/en_gb/ 77 KB
29 KB 21ms
19ms Script
text/javascript 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/46/11/intl/en_gb/common.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7fad71ed734631b3b0b44bf86baf36b8013c28fb029edf88fa68adec08182b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 00:15:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 195870
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28815
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 18:48:33 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="maps-api-js"
expires: Fri, 28 Oct 2022 00:15:30 GMT

GET
H2 200 util.js Show response
maps.googleapis.com/maps-api-v3/api/js/46/11/intl/en_gb/ 295 KB
90 KB 24ms
24ms Script
text/javascript 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/46/11/intl/en_gb/util.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

140c2cf39724ec7d7e88341aff0d660a019472a1a698cc9ff8828aea90efcc53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 00:15:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 195870
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 92434
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 18:48:33 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="maps-api-js"
expires: Fri, 28 Oct 2022 00:15:30 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ 42 B
174 B 41ms
41ms Fetch
image/gif 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuDrjaQ9cUOja1VZi5FUZIsROMZuPvEpIjRfPgvwqn9soePNOmO1RO755bPzFf_Vuz4D3MNPoacyGgmTP2j9Q8Rl4VHHBHa_H1LXNUYU6aqkwlvCAC0&sig=Cg0ArKJSzJ_a8fwTqjAsEAE&id=lidar2&mcvt=1038&p=0,0,606,300&mtos=1038,1038,1038,1038,1038&tos=1038,0,0,0,0&v=20211025&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=3&adk=2409829590&rs=4&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1635575994452&rpt=4643&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bl-f821a95-f4985751.js Show response
tagan.adlightning.com/automatad-nowtoronto/ Frame 69EF 47 KB
20 KB 25ms
25ms Script
application/javascript 18.67.65.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-nowtoronto/bl-f821a95-f4985751.js
Requested by: Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ad2f2e043d230df8d4d9ef81ff9f0d77a6941cdbfb1b48c57704d804e04cd0f4

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 21:30:51 GMT
content-encoding: gzip
age: 119350
x-cache: Hit from cloudfront
content-length: 20336
x-amz-meta-git_commit: f821a95
last-modified: Thu, 28 Oct 2021 21:05:07 GMT
server: AmazonS3
etag: "d7bac72701468820bb358ceab63315f9"
x-amz-version-id: f_b22BKkA9ft0FDpksgjSzQEDhTyIJyD
via: 1.1 4ee1745ee3cece0fab563f5a32ba165b.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: IAD89-P1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: z4yVk_maUe-fF0OWhwPXwitrj2dh4f0yW7U5ObL5fb2QH2-aTJrKCg==

GET
H2 200 b-7b120a5-460a50dd.js Show response
tagan.adlightning.com/automatad-nowtoronto/ Frame 69EF 73 KB
28 KB 27ms
27ms Script
application/javascript 18.67.65.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js
Requested by: Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e7dea8736c7499605b93a1ccdfcf69a0e55cc35b3724bcee9e5be23970ea7ec5

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 21 Oct 2021 22:48:59 GMT
content-encoding: gzip
age: 719462
x-cache: Hit from cloudfront
content-length: 28315
x-amz-meta-git_commit: 7b120a5
last-modified: Tue, 03 Aug 2021 16:33:55 GMT
server: AmazonS3
etag: "5b1798a51491fa61878b946ed2ec5652"
x-amz-version-id: Zh8qAkywSf0c6iJXpDo_BleECzjNQ_LW
via: 1.1 4ee1745ee3cece0fab563f5a32ba165b.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: IAD89-P1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: l7AfZBHvNjVEOs5kCIFrZbC_NKB0J5U2czeg6mJrqrbOmVsGolYLMw==

GET
H2 200 bl-null.js Show response
tagan.adlightning.com/automatad-nowtoronto/ Frame 69EF 0
355 B 54ms
53ms Script
text/plain 18.67.65.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-nowtoronto/bl-null.js
Requested by: Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: sioiBZ23vWdRQHGqdFj0Itnffu8xR4D.
via: 1.1 4ee1745ee3cece0fab563f5a32ba165b.cloudfront.net (CloudFront)
last-modified: Mon, 15 Jun 2020 18:38:17 GMT
server: AmazonS3
age: 36883
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-cache: Error from cloudfront
content-type: text/plain
date: Fri, 29 Oct 2021 20:51:58 GMT
x-amz-cf-pop: IAD89-P1
accept-ranges: bytes
content-length: 0
x-amz-cf-id: xM6iua54rnmxheXyFCrnh0AILLf7DNepCaffJc9eNVJgG3bx-r6M4Q==

GET
H2 200 b-null.js Show response
tagan.adlightning.com/automatad-nowtoronto/ Frame 69EF 0
356 B 50ms
50ms Script
text/plain 18.67.65.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-nowtoronto/b-null.js
Requested by: Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: sioiBZ23vWdRQHGqdFj0Itnffu8xR4D.
via: 1.1 4ee1745ee3cece0fab563f5a32ba165b.cloudfront.net (CloudFront)
last-modified: Mon, 15 Jun 2020 18:38:17 GMT
server: AmazonS3
age: 36883
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-cache: Error from cloudfront
content-type: text/plain
date: Fri, 29 Oct 2021 20:25:18 GMT
x-amz-cf-pop: IAD89-P1
accept-ranges: bytes
content-length: 0
x-amz-cf-id: ImQRAv5jh998XL4uWqiUBR-80ihBk5nOR4kL1krySounDa7-60L2Ng==

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 69EF 42 B
110 B 36ms
36ms Image
image/gif 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CBaJOJR8k_lJl1fWiRHCvunUsdDs8P8yMC4HdIAuasK4VzorAxN-mtsQ8uy7KaSuYCTmV4jQeN2N6T0XZ4sVG6eaSxy9UEqJ8c8Foe2DRy7hdfl58

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/ Frame 69EF 3 KB
1 KB 19ms
19ms Script
text/javascript 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/window_focus_fy2019.js

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4af635698cb6488a8df86b99febedbc979c76e04f675f3a9cdc66f7b4d86aff6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:29:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 637
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1470
x-xss-protection: 0
server: cafe
etag: 9165589572046851897
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 Nov 2021 06:29:23 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 69EF 120 KB
37 KB 51ms
51ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eaaa6059ef4c9ca12e78fcc03ae77ad4cbf05dc73c1fedf64b28a632868bd829

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1635161763799786"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 30 Oct 2021 06:40:00 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/ Frame 69EF 14 KB
6 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7155d8dd40ece849d72213770b3a5b84467de8c6cab5c3bda3266808502cb69b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:13:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1605
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6337
x-xss-protection: 0
server: cafe
etag: 7721474052657771746
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 Nov 2021 06:13:15 GMT

GET
H2 200 bl-f821a95-f4985751.js Show response
tagan.adlightning.com/automatad-nowtoronto/ Frame F5C1 47 KB
20 KB 29ms
28ms Script
application/javascript 18.67.65.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-nowtoronto/bl-f821a95-f4985751.js
Requested by: Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ad2f2e043d230df8d4d9ef81ff9f0d77a6941cdbfb1b48c57704d804e04cd0f4

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 21:30:51 GMT
content-encoding: gzip
age: 119350
x-cache: Hit from cloudfront
content-length: 20336
x-amz-meta-git_commit: f821a95
last-modified: Thu, 28 Oct 2021 21:05:07 GMT
server: AmazonS3
etag: "d7bac72701468820bb358ceab63315f9"
x-amz-version-id: f_b22BKkA9ft0FDpksgjSzQEDhTyIJyD
via: 1.1 4ee1745ee3cece0fab563f5a32ba165b.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: IAD89-P1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: MZD2XqDWxosl4TWuWprHq0cqINQvbEA_5udlOFx9TeiVO1UzHgk1Pw==

GET
H2 200 b-7b120a5-460a50dd.js Show response
tagan.adlightning.com/automatad-nowtoronto/ Frame F5C1 73 KB
28 KB 31ms
30ms Script
application/javascript 18.67.65.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js
Requested by: Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e7dea8736c7499605b93a1ccdfcf69a0e55cc35b3724bcee9e5be23970ea7ec5

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 21 Oct 2021 22:48:59 GMT
content-encoding: gzip
age: 719462
x-cache: Hit from cloudfront
content-length: 28315
x-amz-meta-git_commit: 7b120a5
last-modified: Tue, 03 Aug 2021 16:33:55 GMT
server: AmazonS3
etag: "5b1798a51491fa61878b946ed2ec5652"
x-amz-version-id: Zh8qAkywSf0c6iJXpDo_BleECzjNQ_LW
via: 1.1 4ee1745ee3cece0fab563f5a32ba165b.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: IAD89-P1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: iLDRt2mASwcJYJFGPEwc962pnpp2Wyho6gRkbe5f6ApoXEd-uQtVfg==

GET
H2 200 bl-null.js Show response
tagan.adlightning.com/automatad-nowtoronto/ Frame F5C1 0
354 B 57ms
57ms Script
text/plain 18.67.65.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-nowtoronto/bl-null.js
Requested by: Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: sioiBZ23vWdRQHGqdFj0Itnffu8xR4D.
via: 1.1 4ee1745ee3cece0fab563f5a32ba165b.cloudfront.net (CloudFront)
last-modified: Mon, 15 Jun 2020 18:38:17 GMT
server: AmazonS3
age: 36883
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-cache: Miss from cloudfront
content-type: text/plain
date: Fri, 29 Oct 2021 20:51:58 GMT
x-amz-cf-pop: IAD89-P1
accept-ranges: bytes
content-length: 0
x-amz-cf-id: PIN9lfJJw2hCutoXKkaj1dCvI6kIV79xbftb9-77-LohNEHb574hgA==

GET
H2 200 b-null.js Show response
tagan.adlightning.com/automatad-nowtoronto/ Frame F5C1 0
355 B 53ms
52ms Script
text/plain 18.67.65.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-nowtoronto/b-null.js
Requested by: Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: sioiBZ23vWdRQHGqdFj0Itnffu8xR4D.
via: 1.1 4ee1745ee3cece0fab563f5a32ba165b.cloudfront.net (CloudFront)
last-modified: Mon, 15 Jun 2020 18:38:17 GMT
server: AmazonS3
age: 36883
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-cache: Miss from cloudfront
content-type: text/plain
date: Fri, 29 Oct 2021 20:51:58 GMT
x-amz-cf-pop: IAD89-P1
accept-ranges: bytes
content-length: 0
x-amz-cf-id: ef3fMIiC4NhQBhrDwKQhpST6Peq0loJTf5W4f7x44ImlCffPVar0Xg==

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F5C1 42 B
107 B 38ms
36ms Image
image/gif 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BNo5rADPkUQXBn-DM0KHam-kCVw49OXe-8PqbYH3IE3xGIN5rPl0EJf4mDYdWwh7_smesc_JE6UpA0YctQpYjEcBHIwgrJ6rTXjSNpsB1q2UTZl7c

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/ Frame F5C1 3 KB
1 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/window_focus_fy2019.js

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4af635698cb6488a8df86b99febedbc979c76e04f675f3a9cdc66f7b4d86aff6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:29:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 638
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1470
x-xss-protection: 0
server: cafe
etag: 9165589572046851897
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 Nov 2021 06:29:23 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F5C1 120 KB
37 KB 68ms
68ms Script
text/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eaaa6059ef4c9ca12e78fcc03ae77ad4cbf05dc73c1fedf64b28a632868bd829

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1635161763799786"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 30 Oct 2021 06:40:00 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/ Frame F5C1 14 KB
6 KB 22ms
22ms Script
text/javascript 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7155d8dd40ece849d72213770b3a5b84467de8c6cab5c3bda3266808502cb69b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:13:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1606
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6337
x-xss-protection: 0
server: cafe
etag: 7721474052657771746
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 Nov 2021 06:13:15 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame F5C1 0
0 40ms
40ms Image
text/html 2607:f8b0:4006:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRKguabqD2PlV5IXNKBRbHx7TvoWQi5W7bVMJfx0HTPTav4adKfMQbSrjkGYHmPt3ExECEe3EhyPdb10XlveLeB7s1U4w
Requested by: Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81d::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 7596 624 B
373 B 37ms
36ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeqSBC14Z0BGN3etrYBMAE&v=APEucNUvpclP2kZyiFSDHafbszZ3G-OCK17vFli3uO7c7R7PNssTDjjlcXhLbUMbSx53P7gBdecqEwiHQawrh26PzJPvDsfiFg

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sat, 30 Oct 2021 06:40:00 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 69EF 55 KB
26 KB 61ms
61ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CcGHXbfBZTC9pGuAxSp2jLxkS6kgccFaUrj9oBMIgwgV8cp8Evrd5BeDN4g2rMdqf6SUFWq-gwe89TqoZIYgeuQsFskih9cNW8f6WfgFOz_dRD2CwchO1Tc2vBSm6pGAVIBGCyXB0tS4HcSmQ3IUiKPgnuDA&dbm_d=AKAmf-B42fuQDHAIZ_mLiW4phcaNSqtSM2pMXSbR_hgKeF50Zum0fwQHuGd63nlVpkQPUQxl6Bopet8Wu2LLSpRZrHmQ4ykbnVguq5IDNYee_bQ1tBF3Dly2mNMAqnHo9VyNQ_F7RlvlSyz7Mz0Wa-0KCBlQi6EBY4SXwGowzfo8mQpgfTwQue2c1D5OFTEHEDhWsBhvt8Zv15f6y0V7mlEuXRt8aHXCRSlVL0Wk_UNj9x2IxDTuDbhPz4Zfwesf_A2lgTaAKLLuOXco-UGUl1iWci97hAWBPTqEoBBnJpleI04g-x_-u5oUi45M57QNA7oy365_uzKsTpfSG1_P2XXiTOVsL-mD1EXdlimU8_rU7QZTI1Ka9zxFCRC0lmuAPVl_D9gYlCoO7_wmQeLGq7amoiJVmNAhOPR_0aL45iF9AbwDUqPplAoUuDclR23MQ7RC8BJ6-uERXwny4wJI377jlTGuguoi9aKhXjwITnP94VQFZvYfT5Wl69LF8mK5nVQ9Sk9Z-ns9GzmMXLJGoghKTXbIu6ArK4WqraQNUj29R3NK05OMMKJAuGB98UJpHXmtNYwJ_JCKFWhlVoVZh-kJBC1RLtffxAsNwIC15vEO8z8OJR9_0ffxHdQ4BD5vhgrnUgirUqo0lAjjUo6X1Kesh0SdcvXd-Wsy62GA36DeUa2_tmCcWC_rUofO60I1EVLsE6BOu01r9UMxjB4Ip-Wu1WEPOyyPj_Hs12mxjnOrCGjmeHQl3-qcflPejncYEkbVrEuMBqunZDokNFLN-M3KjCEUQVH6vfxBypx46OcstVWICzy6r49Wn1etjVdWG6Ju8b7AESX94EucahYVeWX7ZrWRronce9Y8NrfNHV4Bk-voL7eiIQHLrGK9ILpcAyoiTHH-0L-BY4DY_3piWxIUd06Sap_Ris06MKivdWjxDyYeZOa7k5U6DUBmt1Y6Q4uIuzVHMIHlGrCun2PmGsPMIm5_wask3Yz8JYFIus89uvwSyJlsfAXfv4KT6uh4pe9SXYGhDvKskyfuPNH9WeuNJiH6QJ6yWL-w3iut4qV5T9vCOGyg7u1KQ5-C-fpVJu4K-WsfjESDyV56pIbrp44abGNIFhDNQFNxtdwlZwdDArKOAfDSDJ65_x68STWF6mdhQQtybhP78aSytEUw8Rf4S9nwk7axlED31BWv40AJmqlA-5yg5SHzUYokKxAdZna9Hi9_W5AUEn7JKuflHTK1cJjr847woT883rqau-UEAc3t8MY5RRGB1hz9OEApe8bAMg_2_wPW0zj5srFimzIWXBQmlk7wNJ-ODpTc_UGTuTT7s24vZhN67LCMvq5MHyQvmJUSLXBhAdQBNia2H7FKqyRIyXFAR5rXgCkEd-jHIPpmP9o1Y0gW5PYyJui2qVZKiEIRP5X_81lqUkViJnSOe45fALpsALZzaLwezFzRNg3yCQFk8quflDiFBvFs1cfrJth7EUINM3RkDjhS23gIwaT1gVDbl02K3Xg1BL60egF5RUwYEA0dnxeNc01lAEngW1DayV79r_FewGa5BjMpVx05C1v4LeyI5gyL80p6l4dVwbP7vZ9F4BNzzWYE46N1FFh_leDwHmlc7irNQbWVsAfNPxV1rzuXttWHOf5gsOFMRXnzkF7VlfAkj8-t_fFCwbYuAOs9jc9i1KzcLB33ZxfCCwRAqHqkR8Wdm37j66yJuomOaBhIhugufZh3srlAZ4x0n29NTA0W-puIVVXgI4FXhZDkzAmQ9h-bZqNhSLnwVf5Cy9zamw1o3jmpkfUg8L_Q2_UrFdJ8eQ7Wjt9GeHSzoHYSsgJcX4sG17covMJBZli8SV4qoIU5pdsmWLiN5lPlUOec9fnH8XTdPTagTyV96petgYKQWgYjUc7qSJvDXw9Yoz006EJQtSs2-p9Y-gTe-QJ7CdF8e3uitc698RJz3NoS-Evz83ouONjiNx6LYKRr5gRrVWAGsR9lV4z6XaUPkWj4XpIjlI7jKiwINH7spuQOsO_YMIw0dRUccTF9eje5NrOEY1yfKWS62wl5yqT1CmMYSTW29Qf10Aom3c0DpD0dCkiIbvuDIlS5YEifIgKWE6vOOfuI7FTN5fcbV4RAzTVcgzic9yNZHc7xoEcFH5oeObO8pPTd_51RkZZfSn5lh5mq9HgaPizXS364eHez1fPndkD1CEEFm763VPe4BOi3wrTWAFTkZTR--5PdZ9ThiYHTAIbDNNrPJp97FqDM47d8G5WIlGiLVpKmHWEoJlEEcB_ozA85coUysvHUCZGSJLy3Jm_uF7InHE2zOryrJtkavV5eZXDLULxz1AgT8_pPPG7gLe7fpTPiu3JgKWO4pegWyjUehIAqcBNx94tKJMyAOwpmxjudJroXFA_Gdrm8hYFl3uU3AyubEh0jGb_UMPIBm3lgq3QtnaYZkqq_-C8W0lCiSIPlEa3W8u36G3vbvc33o-xd8QgfJYDSEPTcdbJqj6YTGnsb-5sdZLjfCS_aZSzltsXD8YzS9NW7eifngjHo6qqIS9mGE-HlKVZk8I4Xsq-5p6eh0x726tft5bfP3HqlBKcvZ4H2UGGq1z8Ap0PXTG7JudLkEANw-bWkhJGB8YK9asmkztyAfV_Aek6UJv85IAnMiWYGkSxC1Vh8l76Dwf-3jYG5fSMB0E4gJ-jL3LsXLNjTxzuspjfvrOBVmb62h-MMf-cwjlJcLauO-sU4b4h5_cwILwkv5L90Kb8axalQ1R8O0iM4J7ZqEYF_VcU6spCNk9O9bce30EY2_6fcbUq5563kYai5dmChjLlmINRbsXRpVmSQnF22tZqf1GVCihvrqTKaw3v8opHb1Gp1ARlUCQsSisaH4yfxy46eTVcTpfcRyg45S-IzFDxX-ebm_ppnKQbRPZiFzDcIZuaTb8cwXf2inmFG5lFQmBzFvTrIw6DMQKLOPa1RGeKjJwINqrXWPwHyVjedAGk9VfUMp1cTHE-tp4kHC7XuLGuOqnOXj6e6PxiLjvP6Le4X&cid=CAASEuRoPCKcWp9Z5sO14HUq1VW9LQ&rfl=1%2Chttps%253A%252F%252Fnowtoronto.com%252F%240

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

12cadacb49b37710e303996a3665b1a3cb4d442fbc320eeca434bd472eaa70b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26510
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 index.html Show response
cdn.districtm.io/ids/ Frame E125 116 B
358 B 62ms
49ms Document
text/html 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/index.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/

Response headers

date: Sat, 30 Oct 2021 06:40:01 GMT
content-type: text/html
cf-ray: 6a62a6569b0c62f4-ORD
age: 68041
last-modified: Thu, 20 May 2021 02:18:27 GMT
via: 1.1 80d333a7c8f93ae71eecc760dbcee2d6.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-amz-cf-id: 2ykPjJymevGLUOOSTKO0SVFGrGY3sW-Sj40KdG8KQykEeTHBUHdaOQ==
x-amz-cf-pop: ORD52-C2
x-cache: Hit from cloudfront
vary: Accept-Encoding
server: cloudflare
content-encoding: br

GET
H2

200

/ Show response
de.tynt.com/deb/ Frame 3871
Redirect Chain

https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1

1 KB
2 KB

31ms
30ms

Document
text/html

67.202.105.33
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.33 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip33.67-202-105.static.steadfastdns.net
Software: /
Resource Hash: 9d3928223f5b86a0e891e61fafb6173684bf7bf5726811d8d38b481b5651c248

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/

Response headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
expires: Sat, 26 Jul 1997 05:00:00 GMT
referrer-policy: unsafe-url
content-type: text/html
content-length: 1319
date: Sat, 30 Oct 2021 06:40:00 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

Redirect headers

location: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
expires: Sat, 26 Jul 1997 05:00:00 GMT
referrer-policy: unsafe-url
content-length: 0
date: Sat, 30 Oct 2021 06:40:01 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

GET
H/1.1 200
OK beacon Show response
ap.lijit.com/ Frame 6FCF 6 KB
2 KB 25ms
24ms Document
text/html 63.251.114.136
INTERNAP-2BLK

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=13404110
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.114.136 , United States, ASN12181 (INTERNAP-2BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: 9e0fe10ee35ca1e3d0c5e5d867729ac3ebbb8c0b37d3f01092d3ed2fe3c97e3e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/

Response headers

Server: nginx
Date: Sat, 30 Oct 2021 06:40:01 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Vary: Accept-Encoding
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
X-Powered-By: raptor
Content-Encoding: gzip
X-Sovrn-Pod: ad_ap5ewr1

GET
H2

200

/ Show response
de.tynt.com/deb/ Frame EF25
Redirect Chain

https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1

1 KB
2 KB

31ms
31ms

Document
text/html

67.202.105.33
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.33 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip33.67-202-105.static.steadfastdns.net
Software: /
Resource Hash: e176f08791a4ef05ea20add06800ee6004f59aa78f00323876f6402de373f778

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/

Response headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
expires: Sat, 26 Jul 1997 05:00:00 GMT
referrer-policy: unsafe-url
content-type: text/html
content-length: 1319
date: Sat, 30 Oct 2021 06:40:01 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

Redirect headers

location: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
expires: Sat, 26 Jul 1997 05:00:00 GMT
referrer-policy: unsafe-url
content-length: 0
date: Sat, 30 Oct 2021 06:40:00 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

GET
H2 200 index.html Show response
cdn.districtm.io/ids/ Frame 65F3 116 B
235 B 37ms
37ms Document
text/html 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/index.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/

Response headers

date: Sat, 30 Oct 2021 06:40:01 GMT
content-type: text/html
cf-ray: 6a62a656cb3862f4-ORD
age: 68041
last-modified: Thu, 20 May 2021 02:18:27 GMT
via: 1.1 0c5d8320bf18b9f0fab8af1258617c11.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-amz-cf-id: 5z0cJGB2UfOipcjU2vFwgL2rdNz6W4z9ntBeA3vbqtk6T72CCn5WRA==
x-amz-cf-pop: ORD52-C2
x-cache: Hit from cloudfront
vary: Accept-Encoding
server: cloudflare
content-encoding: br

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame E48C 52 KB
17 KB 49ms
11ms Document
text/html 151.101.1.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.18.0 (Ubuntu)
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Fri, 29 Oct 2021 05:06:52 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Sat, 30 Oct 2021 06:40:01 GMT
Age: 5587
X-Served-By: cache-lga21954-LGA, cache-yul12827-YUL
X-Cache: HIT, HIT
X-Cache-Hits: 1, 11147
X-Timer: S1635576001.134046,VS0,VE0
Vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 6979 52 KB
17 KB 38ms
10ms Document
text/html 151.101.1.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://nowtoronto.com/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.18.0 (Ubuntu)
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Fri, 29 Oct 2021 05:06:52 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Sat, 30 Oct 2021 06:40:01 GMT
Age: 5587
X-Served-By: cache-lga21954-LGA, cache-yul12828-YUL
X-Cache: HIT, HIT
X-Cache-Hits: 1, 11207
X-Timer: S1635576001.146771,VS0,VE0
Vary: Accept-Encoding

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 1174 640 B
363 B 36ms
36ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLLVmQIQ2riaAhj0uKK0ATAB&v=APEucNXlhzH_qAexp6Y0s0ECqw55FVziuFOz53v3cUi1DvRgzBF1jcm_pyaLd3UEA8bI6mYk5UMT4etE7k2lM5KImauPEV25UA

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sat, 30 Oct 2021 06:40:01 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F5C1 72 KB
29 KB 67ms
66ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BmAMWzZ_P-nxD5THlTwXhOUrYYJxoxNTr8qDClNgYWkezqWzGfsCqy5C0ii6JleseufC7wEsQANCO9s0uUv37GFN0cXqK69S2DInN2UQPTiRryvBFZPMXhjAb_vsmhCmAz69YMWU5m1mKC3yUkQvdr2xKJfw&dbm_d=AKAmf-Aler6RQQC8iH7LQsnI7qVvcng_59znWm3eWJhhrwGbtWsf187W_fCrrKpNN-isy_I8AZgZVw8nGotlx7rge4sMrll02tZ-El37jEL8fk5RFmpSDofHCpu9Hoaz4vP_sY2FXXiFwjxcZqVmSmOExC6jc_n9tKt1jLwRScV7cCVIoejUHa1_CN-HHLKO_t7wNm5HYkWEUEeq7UEDpodzVJL5Ht6NZpNpgMhhqEWWWV8eWuJ6qVAYoxfKlJgTvxb5Qm-K3VnKKhXW4N7OCQZASVYWWSxAUEs2vCHTbKIN9-DtY8_E3hfwcmeU8SqMmjdL1_BciylzpUv9Bfrfe9i_1Sl3Q6Ef-x3XxK73UXmt7-QzB5JccXO9GRf9QJSPOAP3tn6Mtzd-Uj3G5vz6Gj5xTypD2Y23Y6dbIDtkfO247mRFJfC7heAfkfPnLfyAIWRfV8ylSaw5bHU145lgPDST911qW-J9fV_gAyotlNHykFx6-gCDpMgFSQ1EKcVpefzU0LAfT9ooQ9MkA0YA65llFh12oHSv-W7v_haci_VmEQjmRfWKn2nBe2DncG_J4ehs9e_64OXnnxioPCtWgIQb8coSLtQWuI7VWAzSBXVGoC4hyN1YvMqSNgb-jYc37hQHCgdLdEZKsv7R6aACVeMGB5xuzcQv6tVIFX4rulfRf4oXGRhzu6byHy-QjMP-6OJnlelXFSMG3eZUro9RAY2D3EBe3Ut2rA_SwIp_CbAW1ThldOpeNZ3rftHPSqZRSgH891TEFzapQffkH5r6qz_7JfrBX43iFquTc2HlqpUNjQimk0b7VLMxLLjxeELJ2a4gQMg87cljZozS9xgFOWMhK-PPLkbHe6jd8DSYXPwE6JPboKHg4Igr_DUwXJwhYME4kEEzmFW56CCbnH0seTCh9__r76_CQd6-ZT7ROMG8Sp4PiTU2f7KVgF3EqAr04HkCBgnmaRazoURZQgtJB-1iGXnlwGO-0Tfo8Q24CYPxhSM-ZOoLJq4PrW5XXnDo2BdmPug7LS-4sFI5-SvycvhV5nLILX8fvN5HiIa3Ilszi-f946Ze5qPekwtZeb9rdn3wWLVoxNBKeb_OOWr6hcxr0_7Qe0UHgWjZIgUmKkALwuPsKzxjDFMUp4ByoHO0ikC4Y3iBzPU4t73uylnei3UUdgq6mTRkB1UO8sN_FwZpOmEVSgAWMSsf0szheALk-Mcfev7NDktXZ9SEtWSs8VNP6TFbcU_f4qzFBKHdg-_rPzPOxtaB3gPqVTIIt07SJlSFI8tjH9BLXJU1ekFySj0x8a9q2C8PwE-yTrblkjRJhM3rWobFtR0yjDjXR-vFGRiWV8SlgazFoQbozX9h-AEqVkL5cwz0hSIE3zYuCp5f44zQKvvj68kFZgunR5YZS8yE0Pzg_jWBe0FgNDBOXCaaSPoFoZq6GtWLbMh9Ty_k4mUoMVxY41ncqUwfwBze_zekjB7RjPPYmgBWpslQ9ZdlIPIn9Q1-Nxos7SGwNUCNrjmCZHrDOoK8h4iCQAGoBmhzi9VIOPEdJ4eR5Hf9SVh9Q93ZcjOxGdJkduFBHwZ3eOBL55KqE6d2aFs_hagxHzzGqn6ViKMaOpX2yKczWSr_EhSGXyL8eVnFGMPDKDYJpT5GbKyzXAXPTn_c-wwkAsP36OsNNEFyoFYEwFOHdwb18v-kZkgOULmE4LvUuPm3Inytzg9qK9ZqcuBduM2Tzk5WL3Y-lokloXgewy_6LhgJLoMSjBx4RhELWZB4UtOCCXKJtG757Y5xFz8hBMOheTqe2LRf1moZulmwxxIiANzPxX420oGLKpK78Xpk5n_MO7TUCEJshAKk6eXgdOWu84Mq6KJHNNAxG9R-p79bGbAKkvxgk-BQCa71vppoOFUY4x6Sf-bpYEGbpo_uLgoYPDZujF37xmLBEjB42omhP5t64GAoKj2Ilot-HFhnXcNRJFl96cHR9emFZ0n_YnrkZodPmgCJPAawj1iDkCOc6QVlE1yX-8xv1gJ_tvb5uriMqFFOog7ZBzFUgJq88h033M98swL9hslWIMmc99HJ6PMg5AYasBEprOPEfQkgAwo7Hww-3fietTWrXGTEvOxjIgQnlWa6A9Hiq1X1yKdgietOS4uj8fZvxoEsY-A_xo1ptvL_pokiFVYTASVZgpkNJiJ65FLxUpQ-78lH7ohzGY_nDwy2JkMJPOCQngZdqfVWhCYXC_z_FLuZEbmsWMPldpvYYP0ZKzvFLqNuc0FNfMXHlJlRSqvS-uTBrcvmcSSmcjX13xeVVWgDh4zw66rrol8a5vaRhibhjhcUB6-1qr07RcIOi_H7qMZEZ4Xn3X7VbsHwfXQQZlahjIxkwst0BRbp8Bxug85k44L_qdV9q7VoTEqdfqFr54Q9fIWBtOuVMJwnb-KtcDesjuMllOgNBBfjN2d8_Nt_QCN54O370h9BHDZ-xPW1r07ID9vUfpcKPYrrZhvdhV97lgsjV7347qbGxRULWjRFYtAyBI7gJn673DTbttvyXX8CxONWW4gj49wFpHs9giVhRka5H758q7U31Bt72MMqO4fw2PSN5LqOKM3IQ7zwDhSEV6_EO2ZRAQB3gJE-99jbGbaDAk2qsroWhGrNuiHF2eG3pDY7oiF4bbDikJoiO1MYZz6M5LEXstTnHxkS6FSrS5vsc7pDP1z5t06jG9fR8vfHlc_HrHoMqb5-5lrflzDK7HRRsveQpti4FeWVtdhzXAGJioeGoyilJ8ejfVhzW90uO0a-9s8Toj5Nfu9B2KLm1qQfqNVX2eknUIxgxtufGLmVVXnEsPgIRbFHLLPXzp1yhUzub5ODcz6HuteQ9-76NC9YpZ5GGWr7D4vJSoD13fE2hQXkEBGTII-m3c9bDAVVinW7n4elt_1SnD6sF93vPxI57mItl9vdiF6HYIJHJTFNBVWDSlNXuMkn2aJfKRu13Zt2fJQL8cr8sJjUqp6enwGw4yvsIfkdEZfZ8HoJhhi8ZR0RwhswMlRGh9Km88-Gvm5vb48E0LZwmSWQm1nTYg3sHQa3NS4BAYKe7GaSjwouNnR5KHcmhP7F-_T3&cid=CAASEuRoVwJf_g8ouTnaKvS2398J-w&rfl=1%2Chttps%253A%252F%252Fnowtoronto.com%252F%240

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

725de6aea2fa893b455f650d9deaa931023ec2ca4cb962647c387f3b8f0e8cba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29768
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 7596
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENKjWEIDnQjAoZDJHyrxmEE&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENKjWEIDnQjAoZDJHyrxmEE&google_cver=1&C=1

43 B
1012 B

32ms
31ms

Image
image/gif

69.192.109.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENKjWEIDnQjAoZDJHyrxmEE&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeqSBC14Z0BGN3etrYBMAE&v=APEucNUvpclP2kZyiFSDHafbszZ3G-OCK17vFli3uO7c7R7PNssTDjjlcXhLbUMbSx53P7gBdecqEwiHQawrh26PzJPvDsfiFg
Protocol: HTTP/1.1
Server: 69.192.109.125 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-109-125.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:01 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 30 Oct 2021 06:40:01 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:01 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENKjWEIDnQjAoZDJHyrxmEE&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Sat, 30 Oct 2021 06:40:01 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 7596
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YXzowaF-No2DUdyw-NpZWAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENKjWEIDnQjAoZDJHyrxmEE&google_cver=1

43 B
892 B

27ms
24ms

Image
image/gif

69.192.109.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENKjWEIDnQjAoZDJHyrxmEE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeqSBC14Z0BGN3etrYBMAE&v=APEucNUvpclP2kZyiFSDHafbszZ3G-OCK17vFli3uO7c7R7PNssTDjjlcXhLbUMbSx53P7gBdecqEwiHQawrh26PzJPvDsfiFg
Protocol: HTTP/1.1
Server: 69.192.109.125 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-109-125.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:01 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 30 Oct 2021 06:40:01 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENKjWEIDnQjAoZDJHyrxmEE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 7596
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFdjdNuMjA7j9vjum5RJjbk&google_cver=1

43 B
1006 B

21ms
20ms

Image
image/gif

68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFdjdNuMjA7j9vjum5RJjbk&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeqSBC14Z0BGN3etrYBMAE&v=APEucNUvpclP2kZyiFSDHafbszZ3G-OCK17vFli3uO7c7R7PNssTDjjlcXhLbUMbSx53P7gBdecqEwiHQawrh26PzJPvDsfiFg

Protocol

HTTP/1.1

Server

68.67.160.75 , United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:01 GMT
X-Proxy-Origin: 37.120.205.148; 37.120.205.148; 673.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 8e004b7b-1953-45b9-b374-cb13d97ec26a
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFdjdNuMjA7j9vjum5RJjbk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7596
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTAyNDI3NjUxNjg3NzQwNTUwNg%3D%3D

170 B
188 B

40ms
38ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTAyNDI3NjUxNjg3NzQwNTUwNg%3D%3D

Requested by

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:01 GMT
X-Proxy-Origin: 37.120.205.148; 37.120.205.148; 673.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: c898be0a-aaa0-4780-b11a-1725059224b7
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTAyNDI3NjUxNjg3NzQwNTUwNg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211027/r20110914/ Frame 69EF 24 KB
9 KB 19ms
18ms Script
text/javascript 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211027/r20110914/abg_lite.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df660fd3ad4168b7c32eadc3b588ee90334003a7ea1af3299536be4e6697fcd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:33:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 405
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9375
x-xss-protection: 0
server: cafe
etag: 6887285106501176819
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 Nov 2021 06:33:16 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211027/r20110914/elements/html/ Frame 69EF 8 KB
3 KB 19ms
18ms Script
text/javascript 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211027/r20110914/elements/html/omrhp.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:29:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 626
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3128
x-xss-protection: 0
server: cafe
etag: 3658073882064373855
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 Nov 2021 06:29:35 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 69EF 0
571 B 103ms
48ms Ping
image/gif 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssR4W0EoWXJS7CmWAvLMIZPklqmzJeyEZdwudseWTQ7GPFbN-Zctukj8eJNBbRBzM-jQp6PRHFd52h3HxJC27wqiZUZ2l05neoCKwQOZW8tPML_SB26BuBxvAvgskPInmPlOwjNke1AeRMOYDUKtRkbHiEhFzUJOp_sqljsk_MhvuY4XcX2iM69bRRK61GdY_czsgbG811ehyLME2IVsc6Q06az4VVCQXOtMj5l7NOciHmVMabEXqgM7Uwhw0B2DRo3GJrWJ_IrZKg7r90wbWiiTZceI2GHw7YWUd8RDAcaXxm3p-mOnjqZJrnBiha6zblE2FSOayIA3nZbtrsf9AnaWeuund-bKlwnlimW901Nf_hroW4msHYuB4aXZYQr2F_LqTKpS9im3J92ui-gjjqJHY05OrRBLc5aPlenqsg5SYXSRR6xspxm0nmYlfPbTxs3cMwp46Zm-bXzhia2wZ8iufvHWEekC7QDHht86Z-9_dNjq3IYnrmb-yr0szjk8C3beagErrP35OTSvlB-Qgwl2h8AF8fRprom7y49VLfS4C_OMJFwptxlbrYhEp1zAOrmhOu3Pkap_XQPSVs4hkNPzplud1CrWGR4VxYXb7fe6CKF4jT4dmtlPZS0K7uR-xIFrL92rUlQa4cMJBowF0N0QgtfmMtLdGcHELJMWjqm7Afn38wBCXRIXW-Z5bFS5iqmkzfOjRF2yoMQG5LNCUAYPk15-m_LJTiRArK8dHQaxV4x9_5qLLJubnNTmtcNZVGwV12ViJoxnwu2oVtg-apSyNouOZBdEQiVuOVoH9tGUfLxDcJuZ9b_6RsH7LBNka4AIY-4G3uIA2Ts4w2PS-JKj4VGulU0gmu2VsgD8jflrmC6Hjdrj10HKmgMQ1oTfE9OlXBpvTR55uJqtWXRzT4-UfOHujrXuGvBG47jnMbj96tzaHsGPhlYRiQtArwHgfPW7IsbRuIzjfo0IUNI_Ckz41UERf6QeMlyNa8fU2LfVeYFd_PRskyVueye8DK4T0A38p6RPzkarcpk9hUm4BYInNx3EFZ-Rc1joD-p-aZDiXkyt_dt8n1L-8cJXagh_bibaCX6D5gmelc-ezC11e2WW73I-lE7rHeWQoFssFEDKSiBy7GXzx4iSrSTfZfocPH2CiMd_bz8HQ_2p41hQr4iLvd11SjeYyBxhq_SptrmQ_lU-LvA6iMgNbNZBDwbfpFAZ0LMGgD8i7dnhQ&sai=AMfl-YTldx6ktrpMXFKpasFw1k1rNvjMuJuQCYhAwq3JIgsWQRWfLCaWojXFkIXSKNiOF6btaljBTI0gyHO2M4X0b1TQGbeTtoNafINJbBZas7zjiNZsdLEqz7rBvwiw9Xkuyf_yG1n_JvWOdzy46EdW0eX2HWvVFA&sig=Cg0ArKJSzAexp_dnbdShEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211027.62434&adurl=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CcGHXbfBZTC9pGuAxSp2jLxkS6kgccFaUrj9oBMIgwgV8cp8Evrd5BeDN4g2rMdqf6SUFWq-gwe89TqoZIYgeuQsFskih9cNW8f6WfgFOz_dRD2CwchO1Tc2vBSm6pGAVIBGCyXB0tS4HcSmQ3IUiKPgnuDA&dbm_d=AKAmf-B42fuQDHAIZ_mLiW4phcaNSqtSM2pMXSbR_hgKeF50Zum0fwQHuGd63nlVpkQPUQxl6Bopet8Wu2LLSpRZrHmQ4ykbnVguq5IDNYee_bQ1tBF3Dly2mNMAqnHo9VyNQ_F7RlvlSyz7Mz0Wa-0KCBlQi6EBY4SXwGowzfo8mQpgfTwQue2c1D5OFTEHEDhWsBhvt8Zv15f6y0V7mlEuXRt8aHXCRSlVL0Wk_UNj9x2IxDTuDbhPz4Zfwesf_A2lgTaAKLLuOXco-UGUl1iWci97hAWBPTqEoBBnJpleI04g-x_-u5oUi45M57QNA7oy365_uzKsTpfSG1_P2XXiTOVsL-mD1EXdlimU8_rU7QZTI1Ka9zxFCRC0lmuAPVl_D9gYlCoO7_wmQeLGq7amoiJVmNAhOPR_0aL45iF9AbwDUqPplAoUuDclR23MQ7RC8BJ6-uERXwny4wJI377jlTGuguoi9aKhXjwITnP94VQFZvYfT5Wl69LF8mK5nVQ9Sk9Z-ns9GzmMXLJGoghKTXbIu6ArK4WqraQNUj29R3NK05OMMKJAuGB98UJpHXmtNYwJ_JCKFWhlVoVZh-kJBC1RLtffxAsNwIC15vEO8z8OJR9_0ffxHdQ4BD5vhgrnUgirUqo0lAjjUo6X1Kesh0SdcvXd-Wsy62GA36DeUa2_tmCcWC_rUofO60I1EVLsE6BOu01r9UMxjB4Ip-Wu1WEPOyyPj_Hs12mxjnOrCGjmeHQl3-qcflPejncYEkbVrEuMBqunZDokNFLN-M3KjCEUQVH6vfxBypx46OcstVWICzy6r49Wn1etjVdWG6Ju8b7AESX94EucahYVeWX7ZrWRronce9Y8NrfNHV4Bk-voL7eiIQHLrGK9ILpcAyoiTHH-0L-BY4DY_3piWxIUd06Sap_Ris06MKivdWjxDyYeZOa7k5U6DUBmt1Y6Q4uIuzVHMIHlGrCun2PmGsPMIm5_wask3Yz8JYFIus89uvwSyJlsfAXfv4KT6uh4pe9SXYGhDvKskyfuPNH9WeuNJiH6QJ6yWL-w3iut4qV5T9vCOGyg7u1KQ5-C-fpVJu4K-WsfjESDyV56pIbrp44abGNIFhDNQFNxtdwlZwdDArKOAfDSDJ65_x68STWF6mdhQQtybhP78aSytEUw8Rf4S9nwk7axlED31BWv40AJmqlA-5yg5SHzUYokKxAdZna9Hi9_W5AUEn7JKuflHTK1cJjr847woT883rqau-UEAc3t8MY5RRGB1hz9OEApe8bAMg_2_wPW0zj5srFimzIWXBQmlk7wNJ-ODpTc_UGTuTT7s24vZhN67LCMvq5MHyQvmJUSLXBhAdQBNia2H7FKqyRIyXFAR5rXgCkEd-jHIPpmP9o1Y0gW5PYyJui2qVZKiEIRP5X_81lqUkViJnSOe45fALpsALZzaLwezFzRNg3yCQFk8quflDiFBvFs1cfrJth7EUINM3RkDjhS23gIwaT1gVDbl02K3Xg1BL60egF5RUwYEA0dnxeNc01lAEngW1DayV79r_FewGa5BjMpVx05C1v4LeyI5gyL80p6l4dVwbP7vZ9F4BNzzWYE46N1FFh_leDwHmlc7irNQbWVsAfNPxV1rzuXttWHOf5gsOFMRXnzkF7VlfAkj8-t_fFCwbYuAOs9jc9i1KzcLB33ZxfCCwRAqHqkR8Wdm37j66yJuomOaBhIhugufZh3srlAZ4x0n29NTA0W-puIVVXgI4FXhZDkzAmQ9h-bZqNhSLnwVf5Cy9zamw1o3jmpkfUg8L_Q2_UrFdJ8eQ7Wjt9GeHSzoHYSsgJcX4sG17covMJBZli8SV4qoIU5pdsmWLiN5lPlUOec9fnH8XTdPTagTyV96petgYKQWgYjUc7qSJvDXw9Yoz006EJQtSs2-p9Y-gTe-QJ7CdF8e3uitc698RJz3NoS-Evz83ouONjiNx6LYKRr5gRrVWAGsR9lV4z6XaUPkWj4XpIjlI7jKiwINH7spuQOsO_YMIw0dRUccTF9eje5NrOEY1yfKWS62wl5yqT1CmMYSTW29Qf10Aom3c0DpD0dCkiIbvuDIlS5YEifIgKWE6vOOfuI7FTN5fcbV4RAzTVcgzic9yNZHc7xoEcFH5oeObO8pPTd_51RkZZfSn5lh5mq9HgaPizXS364eHez1fPndkD1CEEFm763VPe4BOi3wrTWAFTkZTR--5PdZ9ThiYHTAIbDNNrPJp97FqDM47d8G5WIlGiLVpKmHWEoJlEEcB_ozA85coUysvHUCZGSJLy3Jm_uF7InHE2zOryrJtkavV5eZXDLULxz1AgT8_pPPG7gLe7fpTPiu3JgKWO4pegWyjUehIAqcBNx94tKJMyAOwpmxjudJroXFA_Gdrm8hYFl3uU3AyubEh0jGb_UMPIBm3lgq3QtnaYZkqq_-C8W0lCiSIPlEa3W8u36G3vbvc33o-xd8QgfJYDSEPTcdbJqj6YTGnsb-5sdZLjfCS_aZSzltsXD8YzS9NW7eifngjHo6qqIS9mGE-HlKVZk8I4Xsq-5p6eh0x726tft5bfP3HqlBKcvZ4H2UGGq1z8Ap0PXTG7JudLkEANw-bWkhJGB8YK9asmkztyAfV_Aek6UJv85IAnMiWYGkSxC1Vh8l76Dwf-3jYG5fSMB0E4gJ-jL3LsXLNjTxzuspjfvrOBVmb62h-MMf-cwjlJcLauO-sU4b4h5_cwILwkv5L90Kb8axalQ1R8O0iM4J7ZqEYF_VcU6spCNk9O9bce30EY2_6fcbUq5563kYai5dmChjLlmINRbsXRpVmSQnF22tZqf1GVCihvrqTKaw3v8opHb1Gp1ARlUCQsSisaH4yfxy46eTVcTpfcRyg45S-IzFDxX-ebm_ppnKQbRPZiFzDcIZuaTb8cwXf2inmFG5lFQmBzFvTrIw6DMQKLOPa1RGeKjJwINqrXWPwHyVjedAGk9VfUMp1cTHE-tp4kHC7XuLGuOqnOXj6e6PxiLjvP6Le4X&cid=CAASEuRoPCKcWp9Z5sO14HUq1VW9LQ&rfl=1%2Chttps%253A%252F%252Fnowtoronto.com%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sat, 30 Oct 2021 06:40:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 69EF 41 KB
15 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:28:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51119
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sat, 29 Oct 2022 16:28:02 GMT

GET
H2 200 3118_Niro_HEV_MF_Build_320x50_EN.jpg
s0.2mdn.net/5943625/ Frame 69EF 35 KB
35 KB 323ms
22ms Image
image/jpeg 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/5943625/3118_Niro_HEV_MF_Build_320x50_EN.jpg

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

21334fdb6c4aa16dd8e72a61e9b80a310d53bde5c79801559acec7a2f37fb7f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 00:14:29 GMT
x-content-type-options: nosniff
age: 23132
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35764
x-xss-protection: 0
last-modified: Fri, 15 Oct 2021 15:04:25 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 31 Oct 2021 00:14:29 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6FCF
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/dv?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=YzE3ODk5NzQ5MTNiNTI4OTNjZmRiNzcx&gdpr=0

170 B
188 B

41ms
39ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=YzE3ODk5NzQ5MTNiNTI4OTNjZmRiNzcx&gdpr=0

Requested by

Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-52-167-93.deploy.static.akamaitechnologies.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sat, 30 Oct 2021 06:40:01 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=YzE3ODk5NzQ5MTNiNTI4OTNjZmRiNzcx&gdpr=0
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap5ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H2 200 cksync.php
contextual.media.net/ Frame 6FCF 45 B
618 B 96ms
34ms Image
image/gif 23.52.167.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=sov&ovsid=c1789974913b52893cfdb771&redirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D1023%263pid%3D%24%7BUSER%7D&gdpr=0&gdpr_consent=

Requested by

Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.167.93 , United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
server: Apache
date: Sat, 30 Oct 2021 06:40:01 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 45
x-mnet-hl2: E
expires: Sat, 30 Oct 2021 06:40:01 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 6FCF
Redirect Chain

https://um.simpli.fi/lj_match?r=1635576001063&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=2&3pid=C6997686B96A4621B237B6F9CADCD8C9

43 B
1 KB

29ms
28ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=C6997686B96A4621B237B6F9CADCD8C9
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:01 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Sat, 30 Oct 2021 06:40:01 GMT
x-content-type-options: nosniff
server: openresty
location: https://ce.lijit.com/merge?pid=2&3pid=C6997686B96A4621B237B6F9CADCD8C9
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Fri, 29 Oct 2021 06:40:01 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 6FCF
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=17&mt_exuid=c1789974913b52893cfdb771&redirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D3%263pid%3D%5BUUID%5D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=3&3pid=f679617c-e8bc-4500-8869-484d925f2ac3&gdpr=0&gdpr_consent=

43 B
1 KB

81ms
26ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=3&3pid=f679617c-e8bc-4500-8869-484d925f2ac3&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:01 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Date: Sat, 30 Oct 2021 06:40:01 GMT
Server: MT3 4067 88cc6bf master iad-pixel-x5 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ce.lijit.com/merge?pid=3&3pid=f679617c-e8bc-4500-8869-484d925f2ac3&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sat, 30 Oct 2021 06:40:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 6FCF
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=23&gdpr=0&gdpr_consent=
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=23&gdpr=0&gdpr_consent=
https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_i...
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341&partner_url=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D16%263pid%3D7cab43...
https://ce.lijit.com/merge?pid=16&3pid=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341&gdpr=0&gdpr_consent=

43 B
3 KB

63ms
29ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=16&3pid=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ce.lijit.com/merge?pid=16&3pid=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341&gdpr=0&gdpr_consent=
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google
alt-svc: clear
content-length: 0
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 6FCF
Redirect Chain

https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=
https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=&tc=1
https://ce.lijit.com/merge?pid=86&3pid=Ud0YaNQbyZLtskXE9n21&pi=sovrn&gdpr_consent=&gdpr=0&tc=1

43 B
3 KB

28ms
27ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=86&3pid=Ud0YaNQbyZLtskXE9n21&pi=sovrn&gdpr_consent=&gdpr=0&tc=1
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ce.lijit.com/merge?pid=86&3pid=Ud0YaNQbyZLtskXE9n21&pi=sovrn&gdpr_consent=&gdpr=0&tc=1
pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT, Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 6FCF
Redirect Chain

https://aorta.clickagy.com/pixel.gif?ch=185&cm=c1789974913b52893cfdb771&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=84&3pid=c:78971647e6cca795f33714a1b8203b60

43 B
1 KB

38ms
26ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=84&3pid=c:78971647e6cca795f33714a1b8203b60
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:01 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Sat, 30 Oct 2021 06:40:01 GMT
server: Aorta/20210715-1901da7
access-control-allow-origin
access-control-max-age: 31536000
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/plain
Location: https://ce.lijit.com/merge?pid=84&3pid=c:78971647e6cca795f33714a1b8203b60
access-control-expose-headers: Set-Cookie
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
X-Aorta-Region: us-east-1
Connection: keep-alive
X-Aorta-Host: ip-10-42-17-85.ec2.internal
access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction
Content-Length: 0

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/ Frame 6FCF
Redirect Chain

https://s.amazon-adsystem.com/x/ae12848777b41970a5f2?gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=sovrn&gdpr=0&gdpr_consent=&dcc=t

0
0

54ms
54ms

Image
text/html

209.54.177.54
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=sovrn&gdpr=0&gdpr_consent=&dcc=t
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 209.54.177.54 Osaka, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:01 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 8GGG15T2RJC5G5C07HW3
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=sovrn&gdpr=0&gdpr_consent=&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 6FCF
Redirect Chain

https://bcp.crwdcntrl.net/5/c=5436/tp=SVRN/tpid=c1789974913b52893cfdb771/pv=y?https://ce.lijit.com%2Fmerge%3Fpid%3D5001%263pid%3D%24%7Bprofile_id%7D&gdpr=0&gdpr_consent=
https://bcp.crwdcntrl.net/5/ct=y/c=5436/tp=SVRN/tpid=c1789974913b52893cfdb771/pv=y?https://ce.lijit.com%2Fmerge%3Fpid%3D5001%263pid%3D%24%7Bprofile_id%7D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=5001&3pid=cddba9c7b72dfe33d07efbdaa9453a85&gdpr=0&gdpr_consent=

43 B
2 KB

27ms
26ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=5001&3pid=cddba9c7b72dfe33d07efbdaa9453a85&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://ce.lijit.com/merge?pid=5001&3pid=cddba9c7b72dfe33d07efbdaa9453a85&gdpr=0&gdpr_consent=
cache-control: no-cache
x-server: 10.40.33.93
content-length: 0
expires: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 6FCF
Redirect Chain

https://x.bidswitch.net/sync?ssp=fmx&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=fmx&gdpr=0&gdpr_consent=
https://pm.w55c.net/ping_match.gif?st=bidswitch&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D79%26user_id%3D_wfivefivec_%26expires%3D30%26ssp%3Dfmx%26bsw_param%3D4297e232-e191-49ae-a5c8-d105f494249b
https://pm.w55c.net/ping_match.gif?scc=1&st=bidswitch&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D79%26user_id%3D_wfivefivec_%26expires%3D30%26ssp%3Dfmx%26bsw_param%3D4297e232-e191-49ae-a5c8-d105f...
https://x.bidswitch.net/sync?dsp_id=79&user_id=AZwsuykA1MGI265&expires=30&ssp=fmx&bsw_param=4297e232-e191-49ae-a5c8-d105f494249b
https://ce.lijit.com/merge?pid=26&3pid=4297e232-e191-49ae-a5c8-d105f494249b

43 B
3 KB

66ms
28ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=26&3pid=4297e232-e191-49ae-a5c8-d105f494249b
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Location: //ce.lijit.com/merge?pid=26&3pid=4297e232-e191-49ae-a5c8-d105f494249b
Date: Sat, 30 Oct 2021 06:40:02 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 6FCF
Redirect Chain

https://data.adsrvr.org/track/cmf/generic?ttd_pid=federatedmedia&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=27&3pid=dfc84948-51af-4a0f-b6e1-c55e98473d85&gdpr=0&gdpr_consent=

43 B
1 KB

77ms
27ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=27&3pid=dfc84948-51af-4a0f-b6e1-c55e98473d85&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:01 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://ce.lijit.com/merge?pid=27&3pid=dfc84948-51af-4a0f-b6e1-c55e98473d85&gdpr=0&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 223

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 6FCF
Redirect Chain

https://pixel-eu.rubiconproject.com/exchange/sync.php?p=sovrn-onscroll&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=83&3pid=KVDFPVGC-I-75ZC&gdpr=0

43 B
3 KB

27ms
26ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=83&3pid=KVDFPVGC-I-75ZC&gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://ce.lijit.com/merge?pid=83&3pid=KVDFPVGC-I-75ZC&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 7c5d24517ee193cc868994bc18883d1d
Expires: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 6FCF
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent=
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=sovrn&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=87&3pid=147a8bf7-387c-43a3-8dec-8d85be539915

43 B
3 KB

31ms
30ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=87&3pid=147a8bf7-387c-43a3-8dec-8d85be539915
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: //ce.lijit.com/merge?pid=87&3pid=147a8bf7-387c-43a3-8dec-8d85be539915
date: Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-cache, no-store, must-revalidate
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H/1.1

200
OK

epx.gif
px.owneriq.net/fr/ Frame 6FCF
Redirect Chain

https://px.owneriq.net/eucm/p/sv?gdpr=0&gdpr_consent=
https://px.owneriq.net/ecc?redir=https%3a%2f%2fpx.owneriq.net%2ffr%2fepx.gif&uid=Q6888624011786407600&ref=%2Feucm%2Fp%2Fsv
https://px.owneriq.net/fr/epx.gif

43 B
402 B

65ms
19ms

Image
image/gif

23.64.107.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.owneriq.net/fr/epx.gif
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 23.64.107.8 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-64-107-8.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: max-age=358132
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 03 Nov 2021 10:08:54 GMT

Redirect headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://px.owneriq.net/fr/epx.gif
Cache-Control: max-age=25463
Connection: keep-alive
Content-Type: text/html
Content-Length: 154

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 6FCF
Redirect Chain

https://ums.acuityplatform.com/tum?umid=27&uid=c1789974913b52893cfdb771&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=66&3pid=618590585680

43 B
2 KB

31ms
27ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=66&3pid=618590585680
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Access-Control-Allow-Origin: *
Content-Length: 0
Location: https://ce.lijit.com/merge?pid=66&3pid=618590585680

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 6FCF
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558511&ev=1&rurl=https%3A%2F%2Fce.lijit.com/merge?pid=49&3pid=%%VGUID%%&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=49&3pid=PA1F75UsQ7cr&ev=1&pid=558511&gdpr_consent=&gdpr=0

43 B
2 KB

31ms
28ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=49&3pid=PA1F75UsQ7cr&ev=1&pid=558511&gdpr_consent=&gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-CA
location: https://ce.lijit.com/merge?pid=49&3pid=PA1F75UsQ7cr&ev=1&pid=558511&gdpr_consent=&gdpr=0
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-6c44d49bd7-pw96q
expires: -1

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 6FCF
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D12%263pid%3D%24UID&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=12&3pid=9024276516877405506&gdpr=0&gdpr_consent=

43 B
2 KB

33ms
29ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=12&3pid=9024276516877405506&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
X-Proxy-Origin: 37.120.205.148; 37.120.205.148; 568.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 2f7f274e-94d6-455e-bae2-156520e5fd15
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ce.lijit.com/merge?pid=12&3pid=9024276516877405506&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

reporting
ap.lijit.com/dsp/google/ Frame 6FCF
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/beacon?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=YzE3ODk5NzQ5MTNiNTI4OTNjZmRiNzcx&gdpr=0
https://ap.lijit.com/dsp/google/reporting?gdpr=0

43 B
552 B

57ms
19ms

Image
image/gif

63.251.114.136
INTERNAP-2BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/dsp/google/reporting?gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.114.136 , United States, ASN12181 (INTERNAP-2BLK, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
P3P: CP="CUR ADM OUR NOR STA NID"
Access-Control-Allow-Origin: *
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap5ewr1
Content-Type: image/gif
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ap.lijit.com/dsp/google/reporting?gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 245
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 6FCF
Redirect Chain

https://pixel.quantserve.com/pixel/p-CXt61zNBpKUt1.gif?idmatch=0&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=NZGxuGaY5ekuk7_iYZerumXG5OMuxrHsZpHuGYDz

43 B
3 KB

27ms
26ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=NZGxuGaY5ekuk7_iYZerumXG5OMuxrHsZpHuGYDz
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=NZGxuGaY5ekuk7_iYZerumXG5OMuxrHsZpHuGYDz
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 6FCF
Redirect Chain

https://jadserve.postrelease.com/suid/101957?ntv_r=https://ce.lijit.com/merge?pid=90&3pid=NTV_USER_ID&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=90&3pid=fd94d7c9-5130-4d22-b295-5c754f726a61&gdpr=0&gdpr_consent=

43 B
3 KB

36ms
27ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=90&3pid=fd94d7c9-5130-4d22-b295-5c754f726a61&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: nginx/1.12.1
location: https://ce.lijit.com/merge?pid=90&3pid=fd94d7c9-5130-4d22-b295-5c754f726a61&gdpr=0&gdpr_consent=
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 0
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 6FCF
Redirect Chain

https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent=&_bee_ppp=1
https://ce.lijit.com/merge?pid=85&3pid=AABvf07C-dIAABKJBcdV8w&gdpr=0

43 B
3 KB

32ms
27ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=85&3pid=AABvf07C-dIAABKJBcdV8w&gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ce.lijit.com/merge?pid=85&3pid=AABvf07C-dIAABKJBcdV8w&gdpr=0
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 6FCF
Redirect Chain

https://sync.1rx.io/usersync2/sovrn?gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3375274
https://sync.1rx.io/usersync/tradedesk/dfc84948-51af-4a0f-b6e1-c55e98473d85
https://sync.targeting.unrulymedia.com/csync/RX-4ea9ead0-d0d3-4bd9-8a07-13f5ca5a85b3-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-4ea9ead0-d0d3-4bd9-8a07-13f5ca5a85b3-005

42 B
228 B

19ms
19ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-4ea9ead0-d0d3-4bd9-8a07-13f5ca5a85b3-005
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug011:0:524
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: Tengine
ETag: RX4ea9ead0d0d34bd98a0713f5ca5a85b3005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-4ea9ead0-d0d3-4bd9-8a07-13f5ca5a85b3-005
Connection: keep-alive
Content-Type: text/html

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 6FCF
Redirect Chain

https://p.rfihub.com/cm?in=1&pub=1827&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=10&3pid=978758874792604269

43 B
3 KB

34ms
27ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=10&3pid=978758874792604269
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Location: https://ce.lijit.com/merge?pid=10&3pid=978758874792604269
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 6FCF
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=sovrn&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=80&3pid=KVDFPVGC-I-75ZC&gdpr=0

43 B
4 KB

41ms
27ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=80&3pid=KVDFPVGC-I-75ZC&gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://ce.lijit.com/merge?pid=80&3pid=KVDFPVGC-I-75ZC&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: b3266a43228eaeab48f59934ee9159da
Expires: 0

GET
H2 200 idsync.d5cb6b96.js Show response
cdn.districtm.io/ids/ Frame E125 3 KB
2 KB 43ms
42ms Script
application/javascript 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Requested by: Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aebd50af0cd8da2f314a52e2088788775d1a441bd674ef9379578e7bc1b5ad50

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/ids/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:01 GMT
via: 1.1 84fa053e0c6199c972b828d9a4b4a107.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 160746
cf-polished: origSize=3302
x-cache: Miss from cloudfront
cf-bgj: minify
content-encoding: br
last-modified: Thu, 20 May 2021 02:18:27 GMT
server: cloudflare
etag: W/"74ede07ef946dc2316f86b2661cf2dd3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=172800
x-amz-cf-pop: ATL52-C1
cf-ray: 6a62a65a4dfa62f4-ORD
x-amz-cf-id: 21pm7cOldUyF_BtlAmS7L2NxG71sZ2MLICF2ZCDmKfsFtkA9ItxXUA==
expires: Mon, 01 Nov 2021 06:40:01 GMT

GET
H2 200 idsync.d5cb6b96.js Show response
cdn.districtm.io/ids/ Frame 65F3 3 KB
2 KB 37ms
36ms Script
application/javascript 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Requested by: Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aebd50af0cd8da2f314a52e2088788775d1a441bd674ef9379578e7bc1b5ad50

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/ids/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:01 GMT
via: 1.1 84fa053e0c6199c972b828d9a4b4a107.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 160746
cf-polished: origSize=3302
x-cache: Miss from cloudfront
cf-bgj: minify
content-encoding: br
last-modified: Thu, 20 May 2021 02:18:27 GMT
server: cloudflare
etag: W/"74ede07ef946dc2316f86b2661cf2dd3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=172800
x-amz-cf-pop: ATL52-C1
cf-ray: 6a62a65a4dfb62f4-ORD
x-amz-cf-id: 21pm7cOldUyF_BtlAmS7L2NxG71sZ2MLICF2ZCDmKfsFtkA9ItxXUA==
expires: Mon, 01 Nov 2021 06:40:01 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 1174
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENrzWmRoI0KNQS0x9RVtF6U&google_cver=1

43 B
180 B

29ms
28ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENrzWmRoI0KNQS0x9RVtF6U&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLLVmQIQ2riaAhj0uKK0ATAB&v=APEucNXlhzH_qAexp6Y0s0ECqw55FVziuFOz53v3cUi1DvRgzBF1jcm_pyaLd3UEA8bI6mYk5UMT4etE7k2lM5KImauPEV25UA
Protocol: H2
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
via: 1.1 google
server: OXGW/16.217.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENrzWmRoI0KNQS0x9RVtF6U&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1174
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZjhmMThmMjAtODg5NC0yYTUzLWNjNTYtYWYyNzBlNjE1ZDMz

170 B
188 B

39ms
39ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZjhmMThmMjAtODg5NC0yYTUzLWNjNTYtYWYyNzBlNjE1ZDMz

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLLVmQIQ2riaAhj0uKK0ATAB&v=APEucNXlhzH_qAexp6Y0s0ECqw55FVziuFOz53v3cUi1DvRgzBF1jcm_pyaLd3UEA8bI6mYk5UMT4etE7k2lM5KImauPEV25UA

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 30 Oct 2021 06:40:01 GMT
content-encoding: gzip
server: OXGW/16.217.1
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZjhmMThmMjAtODg5NC0yYTUzLWNjNTYtYWYyNzBlNjE1ZDMz
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame 1174
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEN3Eee_HWZMMKKe-V_M1ItA&google_cver=1

23 B
287 B

29ms
29ms

Image
image/gif

104.126.113.138
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEN3Eee_HWZMMKKe-V_M1ItA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLLVmQIQ2riaAhj0uKK0ATAB&v=APEucNXlhzH_qAexp6Y0s0ECqw55FVziuFOz53v3cUi1DvRgzBF1jcm_pyaLd3UEA8bI6mYk5UMT4etE7k2lM5KImauPEV25UA
Protocol: H2
Server: 104.126.113.138 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-126-113-138.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.6 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
cache-control: max-age=0, no-cache, no-store
expires: Sat, 30 Oct 2021 06:40:01 GMT
server: akka-http/10.2.6
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEN3Eee_HWZMMKKe-V_M1ItA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1174
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=MWFhMTAxOTctOGIxZC00OTlhLTgwMjUtNGNmNjIxZjI1MjE5

170 B
188 B

42ms
40ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=MWFhMTAxOTctOGIxZC00OTlhLTgwMjUtNGNmNjIxZjI1MjE5

Requested by

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
server: akka-http/10.2.6
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=MWFhMTAxOTctOGIxZC00OTlhLTgwMjUtNGNmNjIxZjI1MjE5
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Sat, 30 Oct 2021 06:40:01 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame F5C1 106 KB
38 KB 67ms
21ms Script
text/javascript 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
Origin: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:28:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51119
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 30 Oct 2021 16:28:02 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211027/r20110914/elements/html/ Frame F5C1 8 KB
3 KB 20ms
19ms Script
text/javascript 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211027/r20110914/elements/html/omrhp.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:29:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 626
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3128
x-xss-protection: 0
server: cafe
etag: 3658073882064373855
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 Nov 2021 06:29:35 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211027/r20110914/ Frame F5C1 24 KB
9 KB 21ms
21ms Script
text/javascript 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211027/r20110914/abg_lite.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df660fd3ad4168b7c32eadc3b588ee90334003a7ea1af3299536be4e6697fcd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:33:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 405
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9375
x-xss-protection: 0
server: cafe
etag: 6887285106501176819
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 Nov 2021 06:33:16 GMT

GET
H/1.1

200
OK

merge Show response
ce.lijit.com/ Frame D209
Redirect Chain

https://d.turn.com/r/dd/id/L21rdC8xMjcvY2lkLzI4NTUyOTczL3QvMg/url/https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D1%263pid%3D%24!%7BTURN_UUID%7D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=1&3pid=8713549251317042223&gdpr=0&gdpr_consent=

43 B
1 KB

27ms
26ms

Document
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/merge?pid=1&3pid=8713549251317042223&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/

Response headers

Server: nginx
Date: Sat, 30 Oct 2021 06:40:01 GMT
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
X-Powered-By: raptor
X-Sovrn-Pod: ad_ap1dca1

Redirect headers

p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
pragma: no-cache
location: https://ce.lijit.com/merge?pid=1&3pid=8713549251317042223&gdpr=0&gdpr_consent=
content-length: 0
date: Sat, 30 Oct 2021 06:40:01 GMT

GET
H2 200 0608867b Show response
rtb.gumgum.com/usync/ Frame 9843 4 KB
2 KB 102ms
24ms Document
text/html 52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: f167a788bec0db4b26d9dd1735f0e19d7d1cbbcd3bc6ff2d0db59f128be96e44

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/

Response headers

date: Sat, 30 Oct 2021 06:40:01 GMT
content-type: text/html;charset=UTF-8
server: nginx
p3p: CP="This is not a P3P policy"
etag: W/"08cdd7ace69973651c28a91be9349b78a"
timing-allow-origin: *
content-encoding: gzip

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 9311 14 KB
5 KB 64ms
18ms Document
text/html 104.126.113.6
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.126.113.6 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-126-113-6.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=116761
expires: Sun, 31 Oct 2021 15:06:02 GMT
date: Sat, 30 Oct 2021 06:40:01 GMT
vary: Accept-Encoding

GET
H2 200 cm Show response
us-u.openx.net/w/1.0/ Frame E5C8 780 B
813 B 36ms
34ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 2668c140d028e900cc2cffd3464297b120c044a3c130565422cfcfdc1b009140

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/

Response headers

vary: Accept, Accept-Encoding
server: OXGW/16.217.1
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 30 Oct 2021 06:40:01 GMT
content-type: text/html
content-length: 479
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame EC67 14 KB
5 KB 65ms
20ms Document
text/html 104.126.113.6
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=1&gdpr_consent=ABCFETYFDJLNBFCV&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13404110
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.126.113.6 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-126-113-6.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=116761
expires: Sun, 31 Oct 2021 15:06:02 GMT
date: Sat, 30 Oct 2021 06:40:01 GMT
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame E48C 0
733 B 21ms
20ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 , United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:01 GMT
X-Proxy-Origin: 37.120.205.148; 37.120.205.148; 673.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 9df0c582-7efd-4a26-91ac-dfb942022e1e
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 6979 0
733 B 38ms
19ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 , United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:01 GMT
X-Proxy-Origin: 37.120.205.148; 37.120.205.148; 673.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 2c2a8087-b9e0-48b5-9e02-c2e2eadf6c62
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame FB72
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy=
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

281 B
554 B

21ms
21ms

Document
text/html

104.105.42.146
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.105.42.146 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-105-42-146.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: about:blank

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 26 Oct 2021 17:01:05 GMT
ETag: "40334-119-5cf446c48f640"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sat, 30 Oct 2021 06:40:01 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Date: Sat, 30 Oct 2021 06:40:01 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 3871
Redirect Chain

https://x.bidswitch.net/sync?ssp=the33across&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=the33across&us_privacy=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch&ttd_tpi=1&ttd_puid=the33across&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=93&user_id=dfc84948-51af-4a0f-b6e1-c55e98473d85&expires=30&ssp=the33across&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_21}
https://ssc-cms.33across.com/ps/?gdpr_consent=&ri=10&ru=https%3A%2F%2Fcms-xch.33across.com%2Fmatch%3Fgdpr_58%3D%24gdpr_58%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26bidder_id%3...
https://cms-xch.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=4297e232-e191-49ae-a5c8-d105f494249b
https://cms-xch-chicago.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=4297e232-e191-49ae-a5c8-d105f494249b

68 B
127 B

39ms
28ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=4297e232-e191-49ae-a5c8-d105f494249b
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol: H2
Server: 34.117.239.71 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

location: https://cms-xch-chicago.33across.com:443/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=4297e232-e191-49ae-a5c8-d105f494249b
date: Sat, 30 Oct 2021 06:40:02 GMT
server: awselb/2.0
content-length: 134
content-type: text/html

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 3871
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1635576001260.3&ri=1&ru=https%3A%2F%2Fsync.mathtag.com%2Fsync%2Fimg%3Fus_privacy%3D%24%7BUS_PRIVACY%7D%26mt_exid%3D73%26redir%3Dhttps%253A%252F%252Fc...
https://sync.mathtag.com/sync/img?us_privacy=&mt_exid=73&redir=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fus_privacy%3D%26bidder_id%3D1%26external_user_id%3D%5BMM_UUID%5D
https://cms-xch-chicago.33across.com/match?us_privacy=&bidder_id=1&external_user_id=f679617c-e8bc-4500-8869-484d925f2ac3

68 B
213 B

62ms
28ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?us_privacy=&bidder_id=1&external_user_id=f679617c-e8bc-4500-8869-484d925f2ac3
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol: H2
Server: 34.117.239.71 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

Date: Sat, 30 Oct 2021 06:40:01 GMT
Server: MT3 4067 88cc6bf master iad-pixel-x5 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cms-xch-chicago.33across.com/match?us_privacy=&bidder_id=1&external_user_id=f679617c-e8bc-4500-8869-484d925f2ac3
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sat, 30 Oct 2021 06:40:00 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 3871
Redirect Chain

https://ups.analytics.yahoo.com/ups/58350/sync?redir=true
https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-ekeWxv9E2uEPwASfZpyTy2po6rxFT16E~A
https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-ekeWxv9E2uEPwASfZpyTy2po6rxFT16E%7EA&ts=1635576001&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
127 B

29ms
28ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-ekeWxv9E2uEPwASfZpyTy2po6rxFT16E%7EA&ts=1635576001&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol: H2
Server: 34.117.239.71 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
referrer-policy: unsafe-url
server: 33XP003
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-ekeWxv9E2uEPwASfZpyTy2po6rxFT16E%7EA&ts=1635576001&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 3871
Redirect Chain

https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy=
https://33across-match.dotomi.com/match/bounce/current?DotomiTest=29a5d7f6cd861217&is_secure=true&networkId=78390&version=1&us_privacy=
https://ssc-cms.33across.com/ps?xi=64&xu=AAAGbJLEv-e8pwMqdUSmAAAAAAA&expiration=1635662402&is_secure=true&us_privacy=
https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGbJLEv-e8pwMqdUSmAAAAAAA&ts=1635576002&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
127 B

37ms
27ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGbJLEv-e8pwMqdUSmAAAAAAA&ts=1635576002&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol: H2
Server: 34.117.239.71 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
referrer-policy: unsafe-url
server: 33XP002
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGbJLEv-e8pwMqdUSmAAAAAAA&ts=1635576002&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 3871
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=f0v35ew&ttd_tpi=1&us_privacy=
https://ssc-cms.33across.com/ps/?ri=102&ru=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fbidder_id%3D102%26ttl%3D1638168001%26external_user_id%3Ddfc84948-51af-4a0f-b6e1-c55e98473d85
https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1638168001&external_user_id=dfc84948-51af-4a0f-b6e1-c55e98473d85

68 B
127 B

63ms
30ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1638168001&external_user_id=dfc84948-51af-4a0f-b6e1-c55e98473d85
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol: H2
Server: 34.117.239.71 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
referrer-policy: unsafe-url
server: 33XP003
x-33x-status: 40000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1638168001&external_user_id=dfc84948-51af-4a0f-b6e1-c55e98473d85
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 3844
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy=
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

281 B
554 B

32ms
21ms

Document
text/html

104.105.42.146
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.105.42.146 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-105-42-146.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: about:blank

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 26 Oct 2021 17:01:05 GMT
ETag: "40334-119-5cf446c48f640"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sat, 30 Oct 2021 06:40:01 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Date: Sat, 30 Oct 2021 06:40:01 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame EF25
Redirect Chain

https://x.bidswitch.net/sync?ssp=the33across&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=the33across&us_privacy=
https://t.pswec.com/bsw_sync?ssp=the33across&bsw_user_id=4297e232-e191-49ae-a5c8-d105f494249b
https://t.pswec.com/ul_cb/bsw_sync?ssp=the33across&bsw_user_id=4297e232-e191-49ae-a5c8-d105f494249b
https://x.bidswitch.net/sync?dsp_id=2&user_id=03273763-d040-438f-9d82-bb003a31013c&expires=3&user_group=1&ssp=the33across
https://ssc-cms.33across.com/ps/?gdpr_consent=&ri=10&ru=https%3A%2F%2Fcms-xch.33across.com%2Fmatch%3Fgdpr_58%3D%24gdpr_58%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26bidder_id%3...
https://cms-xch.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=4297e232-e191-49ae-a5c8-d105f494249b
https://cms-xch-chicago.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=4297e232-e191-49ae-a5c8-d105f494249b

68 B
127 B

28ms
27ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=4297e232-e191-49ae-a5c8-d105f494249b
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol: H2
Server: 34.117.239.71 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

location: https://cms-xch-chicago.33across.com:443/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=4297e232-e191-49ae-a5c8-d105f494249b
date: Sat, 30 Oct 2021 06:40:02 GMT
server: awselb/2.0
content-length: 134
content-type: text/html

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame EF25
Redirect Chain

https://ups.analytics.yahoo.com/ups/58350/sync?redir=true
https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-ekeWxv9E2uEPwASfZpyTy2po6rxFT16E~A
https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-ekeWxv9E2uEPwASfZpyTy2po6rxFT16E%7EA&ts=1635576001&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
127 B

243ms
242ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-ekeWxv9E2uEPwASfZpyTy2po6rxFT16E%7EA&ts=1635576001&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol: H2
Server: 34.117.239.71 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
referrer-policy: unsafe-url
server: 33XP004
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-ekeWxv9E2uEPwASfZpyTy2po6rxFT16E%7EA&ts=1635576001&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame EF25
Redirect Chain

https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy=
https://33across-match.dotomi.com/match/bounce/current?DotomiTest=30263b681a71217&is_secure=true&networkId=78390&version=1&us_privacy=
https://ssc-cms.33across.com/ps?xi=64&xu=AAAGbUiq4WVFBQNn38CCAAAAAAA&expiration=1635662402&is_secure=true&us_privacy=
https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGbUiq4WVFBQNn38CCAAAAAAA&ts=1635576002&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
127 B

33ms
26ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGbUiq4WVFBQNn38CCAAAAAAA&ts=1635576002&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol: H2
Server: 34.117.239.71 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
referrer-policy: unsafe-url
server: 33XP002
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGbUiq4WVFBQNn38CCAAAAAAA&ts=1635576002&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame EF25
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=f0v35ew&ttd_tpi=1&us_privacy=
https://ssc-cms.33across.com/ps/?ri=102&ru=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fbidder_id%3D102%26ttl%3D1638168001%26external_user_id%3Ddfc84948-51af-4a0f-b6e1-c55e98473d85
https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1638168001&external_user_id=dfc84948-51af-4a0f-b6e1-c55e98473d85

68 B
127 B

62ms
29ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1638168001&external_user_id=dfc84948-51af-4a0f-b6e1-c55e98473d85
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol: H2
Server: 34.117.239.71 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
referrer-policy: unsafe-url
server: 33XP004
x-33x-status: 40000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1638168001&external_user_id=dfc84948-51af-4a0f-b6e1-c55e98473d85
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame EF25
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1635576001261.3&ri=1&ru=https%3A%2F%2Fsync.mathtag.com%2Fsync%2Fimg%3Fus_privacy%3D%24%7BUS_PRIVACY%7D%26mt_exid%3D73%26redir%3Dhttps%253A%252F%252Fc...
https://sync.mathtag.com/sync/img?us_privacy=&mt_exid=73&redir=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fus_privacy%3D%26bidder_id%3D1%26external_user_id%3D%5BMM_UUID%5D
https://cms-xch-chicago.33across.com/match?us_privacy=&bidder_id=1&external_user_id=f679617c-e8bc-4500-8869-484d925f2ac3

68 B
127 B

59ms
30ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?us_privacy=&bidder_id=1&external_user_id=f679617c-e8bc-4500-8869-484d925f2ac3
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol: H2
Server: 34.117.239.71 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=bkadmUFZKr6QucaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

Date: Sat, 30 Oct 2021 06:40:01 GMT
Server: MT3 4067 88cc6bf master iad-pixel-x10 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cms-xch-chicago.33across.com/match?us_privacy=&bidder_id=1&external_user_id=f679617c-e8bc-4500-8869-484d925f2ac3
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sat, 30 Oct 2021 06:40:00 GMT

GET
H2 200 buyers Show response
dmx.districtm.io/s/v1/ Frame 65F3 448 B
720 B 67ms
66ms XHR
application/json 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/buyers

Requested by

Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

87800bc721393557e1636df3229169b156a7519c20be6251d4153c229198e6ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:01 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: DELETE, GET, OPTIONS, POST
content-type: application/json
access-control-allow-origin: https://cdn.districtm.io
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6a62a65b5f0062f4-ORD
access-control-allow-headers: Origin, Content-Type

GET
H2 200 buyers Show response
dmx.districtm.io/s/v1/ Frame E125 476 B
678 B 70ms
70ms XHR
application/json 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/buyers

Requested by

Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f5625f7f670a19959086168fab0f64561110dba5c0c7c227d1bfb56c31af4dd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:01 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: DELETE, GET, OPTIONS, POST
content-type: application/json
access-control-allow-origin: https://cdn.districtm.io
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6a62a65b5f0162f4-ORD
access-control-allow-headers: Origin, Content-Type

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 74FE 22 KB
8 KB 19ms
19ms Document
text/html 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 29 Oct 2021 16:28:03 GMT
expires: Sat, 29 Oct 2022 16:28:03 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 51118
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3E74 1 KB
845 B 19ms
19ms Document
text/html 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

219.235.75.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Fri, 29 Oct 2021 21:56:09 GMT
expires: Sat, 30 Oct 2021 21:56:09 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 31432
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 69EF 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0b22e4756a6684891ae1a6a11b25a1b279a1b25c52ca61f3eab66527c68d6ee3

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

Ud0YaNQbyZLtskXE9n21 Show response
dmx.districtm.io/s/10027/ Frame 65F3
Redirect Chain

https://us.creativecdn.com/cm-notify?pi=districtm
https://us.creativecdn.com/cm-notify?pi=districtm&tc=1
https://dmx.districtm.io/s/10027/Ud0YaNQbyZLtskXE9n21?pi=districtm&tc=1

76 B
214 B

70ms
69ms

Script
application/javascript

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10027/Ud0YaNQbyZLtskXE9n21?pi=districtm&tc=1

Protocol

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb11d323bd8f1361840399d65734197d4ddd9f5d9f86b339d59fbdf196eefa6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Sat, 30 Oct 2021 06:40:02 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6a62a65d985e62f4-ORD

Redirect headers

location: https://dmx.districtm.io/s/10027/Ud0YaNQbyZLtskXE9n21?pi=districtm&tc=1
pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT, Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

YXzovAAAtXyO_gAz Show response
dmx.us-east-32.districtm.io/s/10016/ Frame 65F3
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/1477?redir=https%3A//dmx.us-east-32.districtm.io/s/10016/$%7BTM_USER_ID%7D
https://dmx.us-east-32.districtm.io/s/10016/YXzovAAAtXyO_gAz

72 B
209 B

132ms
35ms

Script
application/javascript

34.75.235.219
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.us-east-32.districtm.io/s/10016/YXzovAAAtXyO_gAz

Protocol

Server

34.75.235.219 , United States, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

Software

Resource Hash

cc9880ff5cbdebfcacb581ab0df8806ea1d5c1ade974f133986696acfcdc9dd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
content-length: 72
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1635576002.939302,VS0,VE0
x-served-by: cache-yul12826-YUL
x-cache: HIT
location: https://dmx.us-east-32.districtm.io/s/10016/YXzovAAAtXyO_gAz
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

968907253326064169 Show response
dmx.districtm.io/s/10056/ Frame 65F3
Redirect Chain

https://p.rfihub.com/cm?pub=36496&in=1
https://dmx.districtm.io/s/10056/968907253326064169

74 B
128 B

64ms
64ms

Script
application/javascript

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10056/968907253326064169

Protocol

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f8ecef4497bd55e630e42f761c85d5849ef8b331bf946201385af5a4879ecacd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Sat, 30 Oct 2021 06:40:02 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6a62a65ea95462f4-ORD

Redirect headers

Location: https://dmx.districtm.io/s/10056/968907253326064169
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

e113ba51-7df4-4deb-abd0-55e535411daf Show response
dmx.districtm.io/s/10059/ Frame 65F3
Redirect Chain

https://match.sharethrough.com/1PQ8qgv7/v1/
https://dmx.districtm.io/s/10059/e113ba51-7df4-4deb-abd0-55e535411daf

92 B
140 B

68ms
68ms

Script
application/javascript

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10059/e113ba51-7df4-4deb-abd0-55e535411daf

Protocol

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a1de8a8cb1ab2c3b036ce60ee628df0092284a9c76b588d1affeb22487bdd24c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Sat, 30 Oct 2021 06:40:02 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6a62a65d080362f4-ORD

Redirect headers

location: https://dmx.districtm.io/s/10059/e113ba51-7df4-4deb-abd0-55e535411daf
date: Sat, 30 Oct 2021 06:40:02 GMT
content-length: 0

GET
H2

200

7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341 Show response
dmx.districtm.io/s/10001/ Frame 65F3
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=96
https://dmx.districtm.io/s/10001/7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341

106 B
242 B

64ms
63ms

Script
application/javascript

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10001/7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341

Protocol

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

da00e8f37fe90e2773e0b9aee11f10eb39b7152bcbef0af5a482661b80804644

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Sat, 30 Oct 2021 06:40:02 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6a62a65ceff762f4-ORD

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://dmx.districtm.io/s/10001/7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2

200

YXzovAAAtXyO_gAz Show response
dmx.us-east-31.districtm.io/s/10016/ Frame E125
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/1477?redir=https%3A//dmx.us-east-31.districtm.io/s/10016/$%7BTM_USER_ID%7D
https://dmx.us-east-31.districtm.io/s/10016/YXzovAAAtXyO_gAz

72 B
209 B

122ms
35ms

Script
application/javascript

34.75.117.5
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.us-east-31.districtm.io/s/10016/YXzovAAAtXyO_gAz

Protocol

Server

34.75.117.5 , United States, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

5.117.75.34.bc.googleusercontent.com

Software

Resource Hash

cc9880ff5cbdebfcacb581ab0df8806ea1d5c1ade974f133986696acfcdc9dd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
content-length: 72
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1635576002.941960,VS0,VE0
x-served-by: cache-yul12826-YUL
x-cache: HIT
location: https://dmx.us-east-31.districtm.io/s/10016/YXzovAAAtXyO_gAz
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

sync Show response
x.bidswitch.net/ Frame E125
Redirect Chain

https://x.bidswitch.net/sync?ssp=districtm&user_id=20DP5W5d8w5Xy6SB2Ck1DXtTFmu
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=4297e232-e191-49ae-a5c8-d105f494249b&ssp=districtm&gdpr=&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10593873700793157953&gdpr=&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.vis...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2910&partner_device_id=10593873700793157953&gdpr=&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26s...
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=847721d1-9bd1-4e21-b195-5a1bd45c889e&ssp=districtm&gdpr_consent=&gdpr=
https://aa.agkn.com/adscores/g.pixel?sid=9212302828&puid=[mPlatform_cookie_ID]&ssp=%3CSSP_VALUE%3E&gdpr=&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_785409&src.visitorId=205060203955011053798&ssp=%3CSSP_VALUE%3E&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=419&user_id=10593873700793157953&ssp=%3CSSP_VALUE%3E&gdpr=&gdpr_consent=

43 B
235 B

37ms
37ms

Script
image/gif

35.211.178.172
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL: https://x.bidswitch.net/sync?dsp_id=419&user_id=10593873700793157953&ssp=%3CSSP_VALUE%3E&gdpr=&gdpr_consent=
Protocol: HTTP/1.1
Server: 35.211.178.172 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 172.178.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: e2d868f56353cfa8f98f458b5bb7edf7585e67750a7dc681947d86c10f680499

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
location: https://x.bidswitch.net/sync?dsp_id=419&user_id=10593873700793157953&ssp=<SSP_VALUE>&gdpr=&gdpr_consent=
cache-control: no-cache, no-store, must-revalidate
alt-svc: clear
content-length: 0
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

e349be8c-19b2-432f-aae2-4ce474f4010f Show response
dmx.districtm.io/s/10059/ Frame E125
Redirect Chain

https://match.sharethrough.com/1PQ8qgv7/v1/
https://dmx.districtm.io/s/10059/e349be8c-19b2-432f-aae2-4ce474f4010f

92 B
141 B

69ms
69ms

Script
application/javascript

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10059/e349be8c-19b2-432f-aae2-4ce474f4010f

Protocol

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c77e898aed0e566559b10fa1fccf44a86fb4a7314d4e0ccaca803bbc7ee4665c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Sat, 30 Oct 2021 06:40:02 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6a62a65d080562f4-ORD

Redirect headers

location: https://dmx.districtm.io/s/10059/e349be8c-19b2-432f-aae2-4ce474f4010f
date: Sat, 30 Oct 2021 06:40:02 GMT
content-length: 0

GET
H2

200

978758874792604269 Show response
dmx.districtm.io/s/10056/ Frame E125
Redirect Chain

https://p.rfihub.com/cm?pub=36496&in=1
https://dmx.districtm.io/s/10056/978758874792604269

74 B
128 B

72ms
71ms

Script
application/javascript

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10056/978758874792604269

Protocol

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ce1b01b907565f6adc97f79c7b1a996493d8bac9d395e7b88bbce62cf36e85a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Sat, 30 Oct 2021 06:40:02 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6a62a65ea95562f4-ORD

Redirect headers

Location: https://dmx.districtm.io/s/10056/978758874792604269
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341 Show response
dmx.districtm.io/s/10001/ Frame E125
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=96
https://dmx.districtm.io/s/10001/7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341

106 B
151 B

73ms
71ms

Script
application/javascript

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10001/7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341

Protocol

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

da00e8f37fe90e2773e0b9aee11f10eb39b7152bcbef0af5a482661b80804644

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Sat, 30 Oct 2021 06:40:02 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6a62a65ceffa62f4-ORD

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://dmx.districtm.io/s/10001/7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H/1.1 200
OK merge
ce.lijit.com/ Frame E5C8 43 B
1 KB 41ms
29ms Image
image/gif 63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=76&3pid=b870822a-ab57-4efa-9e0a-4338bc32ac01&gdpr=0&gdpr_consent=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:01 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame E5C8
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8713549251317042223&gdpr=0&gdpr_consent=&us_privacy=

43 B
106 B

26ms
26ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8713549251317042223&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google
server: OXGW/16.217.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8713549251317042223&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame E5C8
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YXzovAAAtXyO_gAz

43 B
106 B

29ms
28ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537148856&val=YXzovAAAtXyO_gAz
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google
server: OXGW/16.217.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1635576002.995544,VS0,VE0
x-served-by: cache-yul12826-YUL
x-cache: HIT
location: https://us-u.openx.net/w/1.0/sd?id=537148856&val=YXzovAAAtXyO_gAz
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 40593aae-d14f-e6be-e861-e36b3bd45e1a
pr-bh.ybp.yahoo.com/sync/openx/ Frame E5C8 43 B
869 B 227ms
32ms Image
image/gif 2600:1f18:4e9:5a02:b622:7561:2233:a602
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/40593aae-d14f-e6be-e861-e36b3bd45e1a?gdpr=0

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:b622:7561:2233:a602 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame E5C8
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=d49e5cea-41e3-74f7-d9b6-f59ec4839353&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=dfc84948-51af-4a0f-b6e1-c55e98473d85&ttd_puid=d49e5cea-41e3-74f7-d9b6-f59ec4839353

43 B
249 B

27ms
27ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=dfc84948-51af-4a0f-b6e1-c55e98473d85&ttd_puid=d49e5cea-41e3-74f7-d9b6-f59ec4839353
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google
server: OXGW/16.217.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=dfc84948-51af-4a0f-b6e1-c55e98473d85&ttd_puid=d49e5cea-41e3-74f7-d9b6-f59ec4839353
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 293

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame E5C8 170 B
188 B 39ms
38ms Image
image/png 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZjhmMThmMjAtODg5NC0yYTUzLWNjNTYtYWYyNzBlNjE1ZDMz

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame E5C8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENrzWmRoI0KNQS0x9RVtF6U&google_cver=1

43 B
106 B

27ms
27ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENrzWmRoI0KNQS0x9RVtF6U&google_cver=1
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google
server: OXGW/16.217.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENrzWmRoI0KNQS0x9RVtF6U&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/ Frame 0742 4 KB
2 KB 22ms
21ms Document
text/html 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/index.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e1f57ba1d4dc9b0b016b496ad209e9b9433ce3eb634254a4beeda55ad9f097b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 1511
date: Sat, 30 Oct 2021 00:05:26 GMT
expires: Sun, 31 Oct 2021 00:05:26 GMT
last-modified: Mon, 18 Oct 2021 16:59:46 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 23675
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame F5C1 0
24 B 71ms
45ms Ping
image/gif 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuIqND_kL1XSfhgjWmBIRBHIu-oZHmALjmIc6HvUa_TBSxYyxUhOC0QbLc5vUozhnPR4xaImkpObBwN6m6qe2OAqWhhofgp0KiAwbE4WfcLJOULWfcv52vvpGHcxXKcuzZQLzz6BJ0PftmHfW2RMtmBFHx8mETJGq-No8qK9-RZd2s3Nxn5pSsf3IFDdeCZH-fWSNQ3fE8yUmUWVo1FMIUY0x1J1wbmSS0PtqD4P0bEyT5w8ds35pHtQTfLFzcFN50LLxLyPUNxPUQOzt8gbxMQ72UK9xktX9jYV_nUyD1otNU8FMMhbk6rGEeJhd3tNvDXHYFGdBX6Atqx5m5VdOBzEO9DbomweF5Gn1TijGPx-IkHqDgfQyupniexTD2cHF6xVF3qa_gjCAlNGBFTeQOmlN88DnImAJyTHeU9f4yj3Uz0JGQAkFo7l-rUM1J3rKfpPmjNtCvE_TxLQLOLIbQ6NQG2jDcT22OJwZyy7rh94BWwhqDNoBQMyqudog2YWusAiwvo_0ON5T9z7C0lncvjcFd4RYdCBSyplIKK7W89-GYoPU1EIEM2X-dZNzANf3jdcAIl3Poyl9armWdsudJ8fdWzumC1t9jQnKuhBH6XVXBLC5mghbHf9y04gALrfc_sIF-hwtXmk38sORQ8mtTTDxsC3kXK_R6ChEJvRzCmG-0yB7k5MvoX7W0ksPZxCclavlRuUflnm0TF9jYSfbbPI_zMqVnoHTcm3HFIYBh_DE-X-lsJ_0WCxuhYRj_4i0b3WgL77LSBiNB37hAT6GkMeA-bc0TWo58um7aX7OnifgEIqcM1j294RKNag5WyrytRdsi9iArs01Q8bzjB3FvfoRO9MYbHLi1Sy-eIxEEulQzX71uERoOAHKuP6J-46x42cEclza6f78wcY1PeWiNGFWUM2dmxsyu28jyaMab0QxR1GK3HemhpNxZE5XrDkc81srT_Z3V0TS-d9KEvY6pjNzWyOMK5tt1DyLmuao7Rr-BzKlo3Ri8lCK_qIf0wJG9aoM3wfuJLASoJwK2FHgeScazwTVBuBXjqDUiVJU2wT9ZuZZUhXTGcqfuKXwF6Aw1EzoQjAvUZwt_FfOUOzKJM9Zv-sM1LEQ6Ii0BQCvFn0vYVgM0S4svx1hTkfGKNBoblBPFWRVen4ftMHahJmUviv4k_2eWq2_bxs7qyra4Zu4jIw4wGLc4rel4ptgrKzYEasPHLVkTkEa1XtdRcfsqbXdFcwOTyIcaZIABA1UtakZC535i1gpJpE14K7j4CTPobCXs6XY8wzrmUeV5M_Q&sai=AMfl-YRzM1LJwstCXxzordXI15rT2JXPe1UBvQNoLAUYzsekwhZ4H1PaMMjbfJeNxAOYkWTrL1dREIT9R--e0eqCQC1nilmbiza3rVK4-c-_oJF0O1ppzuE_1tQ-F6ziv7uHD5qYjt9GJK0xcRzObI-HqlkjOZ7BcMnimI7Jd4-1i7E6dkc29_AY3A&sig=Cg0ArKJSzIqO-aaaS12-EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=244&cbvp=1&cstd=226&cisv=r20211027.32224&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: nowtoronto.com
URL: https://nowtoronto.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sat, 30 Oct 2021 06:40:02 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame FB72 31 KB
10 KB 23ms
22ms Script
text/html 104.105.42.146
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.105.42.146 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-105-42-146.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: d8c259eba0c949dd085f3ae0941f8da6def8ec9627981a0763e234347aaddb04

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 06:40:01 GMT
Content-Encoding: gzip
Last-Modified: Fri, 29 Oct 2021 15:57:03 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=35475
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9396
Expires: Sat, 30 Oct 2021 16:31:16 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame F5C1 41 KB
15 KB 23ms
21ms Script
text/javascript 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:28:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51120
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sat, 29 Oct 2022 16:28:02 GMT

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 929B 1 KB
788 B 18ms
18ms Document
text/html 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Fri, 29 Oct 2021 21:56:09 GMT
expires: Sat, 30 Oct 2021 21:56:09 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 31433
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame F5C1 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c500be557812ddefe6ed5bdb82e233676c51e5fb122fb6d561264cca5903befc

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 3844 31 KB
10 KB 25ms
24ms Script
text/html 104.105.42.146
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.105.42.146 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-105-42-146.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: d8c259eba0c949dd085f3ae0941f8da6def8ec9627981a0763e234347aaddb04

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
Content-Encoding: gzip
Last-Modified: Fri, 29 Oct 2021 15:57:03 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=35474
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9396
Expires: Sat, 30 Oct 2021 16:31:16 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame 9843
Redirect Chain

https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID
https://rtb.gumgum.com/usersync?b=apn&i=9024276516877405506

35 B
237 B

44ms
44ms

Image
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=apn&i=9024276516877405506
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
X-Proxy-Origin: 37.120.205.148; 37.120.205.148; 568.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 9ac0df9f-e319-4e79-8950-7f058107dcb2
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://rtb.gumgum.com/usersync?b=apn&i=9024276516877405506
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame 9843
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_c8029167-e2cf-4718-8050-795cba34996f&gdpr=0&gdpr_consent=&us_privacy=
https://pixel.quantserve.com/pixel/p-zLwwakwy-hZw3.gif?idmatch=0&ssp=gumgum2&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=76&user_group=2&ssp=gumgum2&gdpr=0&user_id=EgbIQ0EPnBIJBMYYFQDSQ0EOmxgJBZlBHFMQR62m
https://rtb.gumgum.com/usersync?b=bsw&i=4297e232-e191-49ae-a5c8-d105f494249b

35 B
237 B

38ms
29ms

Image
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=bsw&i=4297e232-e191-49ae-a5c8-d105f494249b
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: //rtb.gumgum.com/usersync?b=bsw&i=4297e232-e191-49ae-a5c8-d105f494249b
Date: Sat, 30 Oct 2021 06:40:02 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

usersync
rtb.gumgum.com/ Frame 9843
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=sta&i=0-f5cabfcf-f9c1-4856-6018-ce81e39ef2ac$ip$37.120.205.148

35 B
237 B

32ms
31ms

Image
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=sta&i=0-f5cabfcf-f9c1-4856-6018-ce81e39ef2ac$ip$37.120.205.148
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: https://rtb.gumgum.com/usersync?b=sta&i=0-f5cabfcf-f9c1-4856-6018-ce81e39ef2ac$ip$37.120.205.148
Date: Sat, 30 Oct 2021 06:40:02 GMT
Connection: keep-alive
Content-Length: 123
Content-Type: text/html; charset=utf-8

GET
H2

200

usersync
rtb.gumgum.com/ Frame 9843
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=u_c8029167-e2cf-4718-8050-795cba34996f&gdpr=0&gdpr_consent=&us_privacy=
https://stags.bluekai.com/site/23178?id=s251QGK7hcqYYdqAgeUN&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT24ZSGUYVCR2LG5UGG4KZLFSHCQLHMVKU4
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=s251QGK7hcqYYdqAgeUN

35 B
237 B

34ms
33ms

Image
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=s251QGK7hcqYYdqAgeUN
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
P3p: CP="We do not support P3P header."
Location: https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=s251QGK7hcqYYdqAgeUN
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 98
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9843
Redirect Chain

https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4160547941
https://sync.1rx.io/usersync/tradedesk/dfc84948-51af-4a0f-b6e1-c55e98473d85
https://sync.targeting.unrulymedia.com/csync/RX-4ea9ead0-d0d3-4bd9-8a07-13f5ca5a85b3-005?redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D56%263pid%3DRX-4ea9ead0-d0d3-4bd9-8a07-13f5ca5a85b3-005
https://ce.lijit.com/merge?pid=56&3pid=RX-4ea9ead0-d0d3-4bd9-8a07-13f5ca5a85b3-005

43 B
4 KB

28ms
27ms

Image
image/gif

63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=56&3pid=RX-4ea9ead0-d0d3-4bd9-8a07-13f5ca5a85b3-005
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: Tengine
ETag: RX4ea9ead0d0d34bd98a0713f5ca5a85b3005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://ce.lijit.com/merge?pid=56&3pid=RX-4ea9ead0-d0d3-4bd9-8a07-13f5ca5a85b3-005
Connection: keep-alive
Content-Type: text/html

GET
H2

200

usersync
rtb.gumgum.com/ Frame 9843
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://rtb.gumgum.com/usersync?b=pln&i=PA1F75UsQ7cr&ev=1&pid=558355

35 B
237 B

38ms
38ms

Image
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=pln&i=PA1F75UsQ7cr&ev=1&pid=558355
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-CA
location: https://rtb.gumgum.com/usersync?b=pln&i=PA1F75UsQ7cr&ev=1&pid=558355
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-6c44d49bd7-pw96q
expires: -1

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame 9843
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D
https://rtb.gumgum.com/usersync?b=obn&i=ENC%28MxSEsyg2hZ0eHQiFs_M6iN2l556RZOf13LWO1nDewv0FD6CfrnPx5hPVtNpMd_ew%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26pla...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_c8029167-e2cf-4718-8050-795cba34996f&obuid=ENC(MxSEsyg2hZ0eHQiFs_M6iN2l556RZOf13LWO1nDewv0FD6CfrnPx5hPVtNpMd_ew)
https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
https://pixel.advertising.com/ups/58440/sync?&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&redir=true
https://pixel.advertising.com/ups/58440/sync?&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&redir=true&verify=true
https://ups.analytics.yahoo.com/ups/58440/sync?&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&redir=true&apid=UP3604bafa-394c-11ec-9f59-0e6e94203e0b
https://sync.outbrain.com/cookie-sync?p=oath&uid=UP3604bafa-394c-11ec-9f59-0e6e94203e0b

0
309 B

21ms
21ms

Image
text/plain

64.202.112.63
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=oath&uid=UP3604bafa-394c-11ec-9f59-0e6e94203e0b
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 64.202.112.63 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
Cache-Control: no-cache
X-TraceId: 6d410eebc76f8307df8a5a4e5b019126
Content-Length: 0

Redirect headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: ATS/7.1.2.138
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://sync.outbrain.com/cookie-sync?p=oath&uid=UP3604bafa-394c-11ec-9f59-0e6e94203e0b
Connection: keep-alive
Content-Length: 0

GET
H2

200

usersync
rtb.gumgum.com/ Frame 9843
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://rtb.gumgum.com/usersync?b=opx&i=23a3f89a-69f6-4ca1-becd-e5730cd39215

35 B
237 B

34ms
32ms

Image
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=opx&i=23a3f89a-69f6-4ca1-becd-e5730cd39215
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

date: Sat, 30 Oct 2021 06:40:02 GMT
content-encoding: gzip
server: OXGW/16.217.1
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://rtb.gumgum.com/usersync?b=opx&i=23a3f89a-69f6-4ca1-becd-e5730cd39215
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H2 200 gumgum
pr-bh.ybp.yahoo.com/sync/ Frame 9843 43 B
323 B 116ms
29ms Image
image/gif 2600:1f18:4e9:5a02:b622:7561:2233:a602
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:b622:7561:2233:a602 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H2

200

usersync
rtb.gumgum.com/ Frame 9843
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%...
https://rtb.gumgum.com/usersync?b=vnt&i=35aa3e57-394c-11ec-81ab-33deef32883a

35 B
237 B

35ms
33ms

Image
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=vnt&i=35aa3e57-394c-11ec-81ab-33deef32883a
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: https://rtb.gumgum.com/usersync?b=vnt&i=35aa3e57-394c-11ec-81ab-33deef32883a
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 0
X-CI-RTID: 35aa3e58-394c-11ec-81ab-33deef32883a

GET
H2

200

usersync
rtb.gumgum.com/ Frame 9843
Redirect Chain

https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=&cb=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
https://rtb.gumgum.com/usersync?b=snc&i=391B7AC3626D4034B58EDECD3F82E530

35 B
237 B

36ms
36ms

Image
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=snc&i=391B7AC3626D4034B58EDECD3F82E530
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 varnish
server: nginx
age: 0
location: https://rtb.gumgum.com/usersync?b=snc&i=391B7AC3626D4034B58EDECD3F82E530
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: text/plain
access-control-allow-origin: https://rtb.gumgum.com/
access-control-allow-credentials: true
x-varnish: 340604200
content-length: 0

GET
H2 200 142
match.deepintent.com/usersync/ Frame 9843 0
222 B 123ms
24ms Image
image/gif 169.197.150.8
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.8 Albuquerque, United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:01 GMT
server: c
content-type: image/gif
content-length: 0
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'

GET
H2

200

usersync
rtb.gumgum.com/ Frame 9843
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://rtb.gumgum.com/usersync?b=idi&i=189ae856-2260-43d8-9276-6406203c9958

35 B
237 B

51ms
24ms

Image
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=idi&i=189ae856-2260-43d8-9276-6406203c9958
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

location: https://rtb.gumgum.com/usersync?b=idi&i=189ae856-2260-43d8-9276-6406203c9958
date: Sat, 30 Oct 2021 06:40:02 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

usersync
rtb.gumgum.com/ Frame 9843
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15
https://rtb.gumgum.com/usersync?b=sad&i=1964693808678375274&gdpr=1&gdpr_consent=

35 B
237 B

47ms
30ms

Image
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=sad&i=1964693808678375274&gdpr=1&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

location: https://rtb.gumgum.com/usersync?b=sad&i=1964693808678375274&gdpr=1&gdpr_consent=
date: Sat, 30 Oct 2021 06:40:01 GMT
content-length: 0

GET
H/1.1 200
OK merge
ce.lijit.com/ Frame 9843 43 B
3 KB 28ms
27ms Image
image/gif 63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=36&3pid=u_c8029167-e2cf-4718-8050-795cba34996f
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1dca1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 9311 5 KB
6 KB 114ms
33ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=80057923&p=137711&s=137812&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: c8ab24d5a427fbfc60d398c0560ecf8f4ce9143937e9533b5ae94c826f0e9f20

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:01 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 69EF 0
23 B 43ms
42ms Ping
image/gif 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sat, 30 Oct 2021 06:40:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame E208 14 KB
5 KB 30ms
24ms Document
text/html 104.126.113.6
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.126.113.6 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-126-113-6.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=116760
expires: Sun, 31 Oct 2021 15:06:02 GMT
date: Sat, 30 Oct 2021 06:40:02 GMT
vary: Accept-Encoding

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 0179
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=ttd&i=dfc84948-51af-4a0f-b6e1-c55e98473d85&t=1638168002

35 B
237 B

39ms
36ms

Document
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=ttd&i=dfc84948-51af-4a0f-b6e1-c55e98473d85&t=1638168002
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: text/html
content-length: 209
location: https://rtb.gumgum.com/usersync?b=ttd&i=dfc84948-51af-4a0f-b6e1-c55e98473d85&t=1638168002
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 5E5C
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

29ms
26ms

Document
text/html

104.105.42.146
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.105.42.146 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-105-42-146.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 26 Oct 2021 17:01:05 GMT
ETag: "40334-119-5cf446c48f640"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sat, 30 Oct 2021 06:40:02 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://eus.rubiconproject.com/usync.html?p=gumgum
Date: Sat, 30 Oct 2021 06:40:02 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 8234
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://rtb.gumgum.com/usersync?b=mmh&i=f679617c-e8bc-4500-8869-484d925f2ac3&gdpr=0&gdpr_consent=

35 B
237 B

37ms
35ms

Document
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=mmh&i=f679617c-e8bc-4500-8869-484d925f2ac3&gdpr=0&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
Content-Type: image/gif
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=360
Server: MT3 4067 88cc6bf master iad-pixel-x29 config:1.0.0
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://rtb.gumgum.com/usersync?b=mmh&i=f679617c-e8bc-4500-8869-484d925f2ac3&gdpr=0&gdpr_consent=
Expires: Sat, 30 Oct 2021 06:40:01 GMT

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame A775
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=atm&i=YXzovAAAtXyO_gAz&gdpr=0&gdpr_consent=

35 B
237 B

39ms
38ms

Document
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=atm&i=YXzovAAAtXyO_gAz&gdpr=0&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

server: Varnish
retry-after: 0
location: https://rtb.gumgum.com/usersync?b=atm&i=YXzovAAAtXyO_gAz&gdpr=0&gdpr_consent=
accept-ranges: bytes
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 varnish
x-served-by: cache-yul12826-YUL
x-cache: HIT
x-cache-hits: 0
x-timer: S1635576002.113921,VS0,VE0
cache-control: no-cache
pragma: no-cache
content-length: 0

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame 68B0 170 B
188 B 43ms
41ms Document
image/png 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV9jODAyOTE2Ny1lMmNmLTQ3MTgtODA1MC03OTVjYmEzNDk5NmY=&gdpr=0&gdpr_consent=

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

content-type: image/png
date: Sat, 30 Oct 2021 06:40:02 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
server: HTTP server (unknown)
content-length: 170
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2

200

/ Show response
de.tynt.com/deb/ Frame 39BD
Redirect Chain

https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X

2 KB
3 KB

37ms
36ms

Document
text/html

67.202.105.33
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.33 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip33.67-202-105.static.steadfastdns.net
Software: /
Resource Hash: fc380fdc1bf24d2fa276f7425965d75d5b37d45bf097911739890e1e03caea2a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
expires: Sat, 26 Jul 1997 05:00:00 GMT
referrer-policy: unsafe-url
content-type: text/html
content-length: 2302
date: Sat, 30 Oct 2021 06:40:02 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

Redirect headers

p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate
expires: Thu, 01-Jan-70 00:00:01 GMT
x-33x-status: 8340000A
server: 33XP003
location: https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
content-length: 0
date: Sat, 30 Oct 2021 06:40:02 GMT

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 5B72
Redirect Chain

https://cs.emxdgt.com/um?redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID
https://ib.adnxs.com/getuid?https://cs.emxdgt.com/umcheck?apnxid=$UID&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24EMXUID&b64_redirect=aHR0cHM6Ly9ydGIuZ3VtZ3VtLmNvbS91c2Vyc3l...
https://cs.emxdgt.com/umcheck?apnxid=9024276516877405506&redirect=https://rtb.gumgum.com/usersync?b=emx&i=$EMXUID&b64_redirect=aHR0cHM6Ly9ydGIuZ3VtZ3VtLmNvbS91c2Vyc3luYz9iPWVteCZpPSRFTVhVSUQ=
https://rtb.gumgum.com/usersync?b=emx&i=9024276516877405506brt50311635576002226605b8

35 B
237 B

45ms
30ms

Document
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=emx&i=9024276516877405506brt50311635576002226605b8
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

Content-Type: text/html
Date: Sat, 30 Oct 2021 06:40:01 GMT
Location: https://rtb.gumgum.com/usersync?b=emx&i=9024276516877405506brt50311635576002226605b8
Connection: Keep-Alive
Content-Length: 0

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame BD61
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://rtb.gumgum.com/usersync?b=sus&i=YXzowsCo8XoAAD3Lsu0AAAAA

35 B
237 B

32ms
32ms

Document
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=sus&i=YXzowsCo8XoAAD3Lsu0AAAAA
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

Server: nginx
Date: Sat, 30 Oct 2021 06:40:02 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private
Location: https://rtb.gumgum.com/usersync?b=sus&i=YXzowsCo8XoAAD3Lsu0AAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-Ads-Time: 2
X-SO-HostName: m-ad218.dc4p.scaleout.jp
X-SO-LB-Hostname: m-tgng22.dc4p.scaleout.jp
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":26,"gdpr":false,"ipv4":"37.120.205.148","key":"YXzowsCo8XoAAD3Lsu0AAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad218"}
X-SO-Key: YXzowsCo8XoAAD3Lsu0AAAAA
X-SO-IP: 37.120.205.148
X-SO-Cluster-ID: 26
X-SO-Upstream-ID: m-ad218

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame C833
Redirect Chain

https://p.rfihub.com/cm?pub=42796&in=1
https://rtb.gumgum.com/usersync?b=zet&i=968062825672697095

35 B
237 B

36ms
35ms

Document
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=zet&i=968062825672697095
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://rtb.gumgum.com/usersync?b=zet&i=968062825672697095
Content-Length: 0
Server: Jetty(9.3.29.v20201019)

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 1903
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://rtb.gumgum.com/usersync?b=rth&i=Ud0YaNQbyZLtskXE9n21&pi=gumgum

35 B
237 B

36ms
34ms

Document
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=rth&i=Ud0YaNQbyZLtskXE9n21&pi=gumgum
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

date: Sat, 30 Oct 2021 06:40:02 GMT Sat, 30 Oct 2021 06:40:02 GMT
location: https://rtb.gumgum.com/usersync?b=rth&i=Ud0YaNQbyZLtskXE9n21&pi=gumgum
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
content-length: 0

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame FB72
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy=
https://ssc-cms.33across.com/ps/?xi=1&xu=KVDFPVGC-I-75ZC
https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KVDFPVGC-I-75ZC&ts=1635576002&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
127 B

46ms
20ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KVDFPVGC-I-75ZC&ts=1635576002&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: H2
Server: 34.117.239.71 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
referrer-policy: unsafe-url
server: 33XP003
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KVDFPVGC-I-75ZC&ts=1635576002&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2 200 Enabler.js Show response
s0.2mdn.net/ads/studio/ Frame 0742 134 KB
45 KB 21ms
20ms Script
text/javascript 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/Enabler.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

86441c9a21f4c77dcbb2a4f020d904179f15c8e9b35f3f85d5d053ee62c13232

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:32:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 429
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46298
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:10 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 30 Oct 2021 06:47:53 GMT

GET
H2 200 tweenmax_2.1.2_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 0742 113 KB
39 KB 38ms
37ms Script
text/javascript 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_2.1.2_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a863a77e9ee263a0ec9c1e792bb33ed0f663582b7369f472261df7b6040990c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39910
x-xss-protection: 0
last-modified: Mon, 11 Mar 2019 14:29:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 30 Oct 2021 06:40:02 GMT

GET
H2 200 default.min.css
s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/css/ Frame 0742 455 B
341 B 30ms
29ms Stylesheet
text/css 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/css/default.min.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9369c58c4e66600ff0d5e025d3fe845752fad38a9bf0e2ecb8117887b4536d87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 08:18:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 242
x-xss-protection: 0
last-modified: Mon, 18 Oct 2021 16:59:46 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 30 Oct 2021 08:18:08 GMT

GET
H2 200 style.css
s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/ Frame 0742 574 B
322 B 30ms
29ms Stylesheet
text/css 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fbce356f525a0372b3644f67290b4d7aef750fc3951ce01ef9817f7ee0c8bfdb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 01:20:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19160
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 230
x-xss-protection: 0
last-modified: Mon, 18 Oct 2021 16:59:46 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 31 Oct 2021 01:20:42 GMT

GET
H2 200 imagesloaded.pkgd.min.js Show response
s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/js/ Frame 0742 5 KB
2 KB 30ms
30ms Script
text/javascript 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/js/imagesloaded.pkgd.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96abf166b3cbb5f7df525d86fdeeeccea4af3c120b19bc26b0613530a94e8b44

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 04:04:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9310
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1810
x-xss-protection: 0
last-modified: Mon, 18 Oct 2021 16:59:46 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 31 Oct 2021 04:04:52 GMT

GET
H2 200 main.js Show response
s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/ Frame 0742 761 B
336 B 31ms
30ms Script
text/javascript 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80ea95b11bfc7f927a5b7b4eb315ccb1a0a3e441a48b517dce2d07d927e005ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 17:04:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48934
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 243
x-xss-protection: 0
last-modified: Mon, 18 Oct 2021 16:59:46 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 30 Oct 2021 17:04:28 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 3E74
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEKhvKCRY8LzJKb06X0WazQI&google_cver=1&google_push=AYg5qPIFjfMMADC7jFBGPFhKJuOL2mnc0QlJHLmb-GEsEU3PAdXlC4sWeEU27DXJsc5TTk9K2qhdklsnw87MjegybKfBQZwqtIa6
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODcxMzU0OTI1MTMxNzA0MjIyMw==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKhvKCRY8LzJKb06X0WazQI&google_cver=1

43 B
407 B

98ms
42ms

Image
image/gif

2620:112:f002:bbbb::21
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKhvKCRY8LzJKb06X0WazQI&google_cver=1
Protocol: H2
Server: 2620:112:f002:bbbb::21 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKhvKCRY8LzJKb06X0WazQI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 3E74 35 B
463 B 82ms
26ms Image
image/gif 2620:116:800b:21:d7a4:3372:2f4a:f3b0
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEAWA_A58l0eovYsTMMrQkmQ&google_cver=1&google_push=AYg5qPJf2i_8x104CljchY2oeSY-MnN_ut1tDISNoIR8JdSMy89cn26qLbclHWwXILtxWng9mO3VUMpSv-sF9tNLqRq_WW2kD3Fh

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800b:21:d7a4:3372:2f4a:f3b0 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3E74
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEFuw86ffDkPkM3veYWEbQW0&google_cver=1&google_push=AYg5qPKFYEjCS3w_uGlDFiuDpqzLqXym6fXFKXuG8328D94oXizMy9l...
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=400713cd109b1204&is_secure=true&networkId=14000&version=1&google_gid=CAESEFuw86ffDkPkM3veYWEbQW0&google_cver=1&google_push=AYg5qPKFYEjC...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGZi2tmJ5UjQMuDY-KAAAAAAA&expiration=1635662402&google_cver=1&is_secure=true&google_gid=CAESEFuw86ffDkPkM3veYWEbQ...

170 B
188 B

38ms
38ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGZi2tmJ5UjQMuDY-KAAAAAAA&expiration=1635662402&google_cver=1&is_secure=true&google_gid=CAESEFuw86ffDkPkM3veYWEbQW0&google_push=AYg5qPKFYEjCS3w_uGlDFiuDpqzLqXym6fXFKXuG8328D94oXizMy9lWOb5zhZHKEewqBys5liZMnAMUvW4z_vLBpHIBB8oUXjfg

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGZi2tmJ5UjQMuDY-KAAAAAAA&expiration=1635662402&google_cver=1&is_secure=true&google_gid=CAESEFuw86ffDkPkM3veYWEbQW0&google_push=AYg5qPKFYEjCS3w_uGlDFiuDpqzLqXym6fXFKXuG8328D94oXizMy9lWOb5zhZHKEewqBys5liZMnAMUvW4z_vLBpHIBB8oUXjfg
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3E74
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WVh6b3ZBQUF0WHlPX2dBeg==&google_gid=CAESEHmmGIYXKP9pAVlrW_Vo2yI&google_cver=1&google_push=AYg5qPItibpg5nrhTL68RBnuI_3j1mfKhT...

170 B
188 B

38ms
38ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WVh6b3ZBQUF0WHlPX2dBeg==&google_gid=CAESEHmmGIYXKP9pAVlrW_Vo2yI&google_cver=1&google_push=AYg5qPItibpg5nrhTL68RBnuI_3j1mfKhT3zygLw1vv4juAZ-yHsmCSKnKzeoVFtAOIAdQRKbCU5wbfJRtsIM7nr8ra0N8_vCr4

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1635576002.212506,VS0,VE0
x-served-by: cache-yul12826-YUL
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WVh6b3ZBQUF0WHlPX2dBeg==&google_gid=CAESEHmmGIYXKP9pAVlrW_Vo2yI&google_cver=1&google_push=AYg5qPItibpg5nrhTL68RBnuI_3j1mfKhT3zygLw1vv4juAZ-yHsmCSKnKzeoVFtAOIAdQRKbCU5wbfJRtsIM7nr8ra0N8_vCr4
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 3E74 0
141 B 53ms
24ms Image
text/plain 34.96.105.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEM8nvVVFX6gHSw12HlV2yG8&google_cver=1&google_push=AYg5qPKZZ0X5VR-hHdCn3S6iiRwAUnfLzRKDXPpkSpzcr9r148SPY20GacOf-gD2MMdgASUojcuA_QvZhqRiUnG8lVNIFjLCmpCV
Requested by: Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google
alt-svc: clear

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3E74
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEPLfeQTvGDrvutH_2xWj1BY&google_cver=1&google_push=AYg5qPK5JBfpw6XWIez0yqjiHGD4PQbWxtzEIX5SzsbDTSwR8-08s8w9BV2F58qPMB2-qUw5OpYRtmgU-4jEsthCjsEa...
https://p.rfihub.com/cm?in=1&pub=20513&ssp=google
https://x.bidswitch.net/sync?dsp_id=119&user_id=978758874792604269&expires=30&ssp=google
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPK5JBfpw6XWIez0yqjiHGD4PQbWxtzEIX5SzsbDTSwR8-08s8w9BV2F58qPMB2-qUw5OpYRtmgU-4jEsthCjsEaSro42IU&google_hm=QpfiMuGRSa6lyNEF9JQkmw==

170 B
188 B

56ms
51ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPK5JBfpw6XWIez0yqjiHGD4PQbWxtzEIX5SzsbDTSwR8-08s8w9BV2F58qPMB2-qUw5OpYRtmgU-4jEsthCjsEaSro42IU&google_hm=QpfiMuGRSa6lyNEF9JQkmw==

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPK5JBfpw6XWIez0yqjiHGD4PQbWxtzEIX5SzsbDTSwR8-08s8w9BV2F58qPMB2-qUw5OpYRtmgU-4jEsthCjsEaSro42IU&google_hm=QpfiMuGRSa6lyNEF9JQkmw==
Date: Sat, 30 Oct 2021 06:40:02 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3E74
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEJAXQtQRpA9Hzro4rDJkz7c&google_cver=1&google_push=AYg5qPJjvJQeDJ-4zCk7w0q5DJfCCRyUHMThPae0Wo957n78qWPyVAXq7gHpKm7Pi61QKUgmmDKTigdc_sfx793...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=bYtWppN5Qb1IjcejITJTPCV4zZQ&google_push=AYg5qPJjvJQeDJ-4zCk7w0q5DJfCCRyUHMThPae0Wo957n78qWPyVAXq7gHpKm7Pi61QKUgmmDKTigdc_sfx79...

170 B
188 B

38ms
37ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=bYtWppN5Qb1IjcejITJTPCV4zZQ&google_push=AYg5qPJjvJQeDJ-4zCk7w0q5DJfCCRyUHMThPae0Wo957n78qWPyVAXq7gHpKm7Pi61QKUgmmDKTigdc_sfx793xZw19kPcOmbI

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=bYtWppN5Qb1IjcejITJTPCV4zZQ&google_push=AYg5qPJjvJQeDJ-4zCk7w0q5DJfCCRyUHMThPae0Wo957n78qWPyVAXq7gHpKm7Pi61QKUgmmDKTigdc_sfx793xZw19kPcOmbI
Date: Sat, 30 Oct 2021 06:40:02 GMT
Connection: keep-alive
Content-Length: 241
Content-Type: text/html; charset=utf-8

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 3E74 0
12 B 39ms
36ms Image
text/html 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LiYndAqrQFpyXFAOitr1JbT5hIHEBadW_OfCW1NWdudBB9PTRNx9EtOjjQ8BscbSVty3YW

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame A390 22 KB
8 KB 19ms
19ms Document
text/html 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-nowtoronto/b-7b120a5-460a50dd.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 29 Oct 2021 16:28:03 GMT
expires: Sat, 29 Oct 2022 16:28:03 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 51119
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 sKl_vPiz0OchHmL4Vfbrj3Wozc3CsK_Jq53kDzx3_oA.js Show response
pagead2.googlesyndication.com/bg/ Frame 74FE 35 KB
13 KB 19ms
18ms Script
text/javascript 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/sKl_vPiz0OchHmL4Vfbrj3Wozc3CsK_Jq53kDzx3_oA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-233-68-37.compute-1.amazonaws.com

Software

sffe /

Resource Hash

b0a97fbcf8b3d0e7211e62f855f6eb8f75a8cdcdc2b0afc9ab9de40f3c77fe80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 21:13:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 206763
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13525
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 18:58:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Thu, 27 Oct 2022 21:13:59 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame FB72
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/UofaIjJf5YM8jglYV-Owyg?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=8264709623286246911

42 B
678 B

29ms
27ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=8264709623286246911
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 84e0f527cd81a00b0210e20b4ee7ed94
Content-Type: image/gif

Redirect headers

date: Sat, 30 Oct 2021 06:40:02 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=8264709623286246911
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame FB72
Redirect Chain

https://pixel.rubiconproject.com/token?pid=27384
https://beacon.krxd.net/usermatch.gif?partner=rubicon&partner_uid=KVDFPVGC-I-75ZC

0
337 B

164ms
22ms

Image
text/plain

34.192.88.23
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=rubicon&partner_uid=KVDFPVGC-I-75ZC
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: H2
Server: 34.192.88.23 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-192-88-23.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cache-control: private, no-cache, no-store
x-request-time: D=34 t=1635576002
x-served-by: beacon-n007-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location: https://beacon.krxd.net/usermatch.gif?partner=rubicon&partner_uid=KVDFPVGC-I-75ZC
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b5ba23d75d0dcd35432b720d73e3149b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame FB72
Redirect Chain

https://i.w55c.net/ping_match.gif?ei=RUBICON&rurl=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4210%26nid%3D1523%26put%3D_wfivefivec_%26expires%3D30
https://pixel.rubiconproject.com/tap.php?v=4210&nid=1523&put=AZwsuykA1MGI265&expires=30

42 B
678 B

39ms
25ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=4210&nid=1523&put=AZwsuykA1MGI265&expires=30
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: d3682eda7e5cb79782b1d5475f50e8fc
Content-Type: image/gif

Redirect headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:01 GMT
Server: PingMatch/v2.0.30-691-gbabbd08#rel-ec2-master i-0001c1771099ce77d@us-east-1b@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains
P3P: policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Location: https://pixel.rubiconproject.com/tap.php?v=4210&nid=1523&put=AZwsuykA1MGI265&expires=30
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame FB72
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=35aa3e57-394c-11ec-81ab-33deef32883a&expires=30

42 B
678 B

33ms
27ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=35aa3e57-394c-11ec-81ab-33deef32883a&expires=30
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 29af2665c43893332e84c235bac366c1
Content-Type: image/gif

Redirect headers

Location: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=35aa3e57-394c-11ec-81ab-33deef32883a&expires=30
Date: Sat, 30 Oct 2021 06:40:01 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 0
X-CI-RTID: 35b8e533-394c-11ec-b40a-db78886add51

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame FB72
Redirect Chain

https://um.simpli.fi/rb_match
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=C6997686B96A4621B237B6F9CADCD8C9&expires=365

42 B
678 B

32ms
26ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=C6997686B96A4621B237B6F9CADCD8C9&expires=365
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 8eb2d9eeed9b9c468975d0ba24565e5b
Content-Type: image/gif

Redirect headers

date: Sat, 30 Oct 2021 06:40:02 GMT
x-content-type-options: nosniff
server: openresty
location: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=C6997686B96A4621B237B6F9CADCD8C9&expires=365
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Fri, 29 Oct 2021 06:40:02 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame FB72
Redirect Chain

https://ad.turn.com/r/cs?pid=6
https://pixel.rubiconproject.com/tap.php?v=4212&nid=1185&put=8713549251317042223&expires=60&gdpr=0&gdpr_consent=

42 B
678 B

32ms
27ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=4212&nid=1185&put=8713549251317042223&expires=60&gdpr=0&gdpr_consent=
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 20e8391fc78a9019eb67dba4b22f0ac2
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=4212&nid=1185&put=8713549251317042223&expires=60&gdpr=0&gdpr_consent=
pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame FB72
Redirect Chain

https://pixel-a.sitescout.com/dmp/pixelSync?nid=1
https://pixel.rubiconproject.com/tap.php?v=7430&nid=2238&put=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341&expires=360&gdpr=0&gdpr_consent=

42 B
678 B

29ms
25ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7430&nid=2238&put=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341&expires=360&gdpr=0&gdpr_consent=
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 4f2e9ddc15e6cc2c3861f8e2683d2514
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://pixel.rubiconproject.com/tap.php?v=7430&nid=2238&put=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341&expires=360&gdpr=0&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame FB72
Redirect Chain

https://rbp.mxptint.net/sn.ashx
https://pixel.rubiconproject.com/tap.php?v=14321&nid=2313&put=R1B331_E5C15CF3_FCB69B2F&expires=60

42 B
678 B

26ms
25ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=14321&nid=2313&put=R1B331_E5C15CF3_FCB69B2F&expires=60
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 9e7742894a018a40b59a2ed2117c85b5
Content-Type: image/gif

Redirect headers

Location: https://pixel.rubiconproject.com/tap.php?v=14321&nid=2313&put=R1B331_E5C15CF3_FCB69B2F&expires=60
Date: Sat, 30 Oct 2021 06:40:01 GMT
Cache-Control: private
P3P: CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE", CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE"
Content-Length: 226
Strict-Transport-Security: max-age=-318562802; includeSubDomains
Content-Type: text/html; charset=utf-8

POST
H2 204 users Show response
dmx.districtm.io/s/v1/ Frame 65F3 0
529 B 70ms
62ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/users

Requested by

Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://cdn.districtm.io/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: DELETE, GET, OPTIONS, POST
access-control-allow-origin: https://cdn.districtm.io
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6a62a65f99ea62f4-ORD
access-control-allow-headers: Origin, Content-Type

POST
H2 204 users Show response
dmx.districtm.io/s/v1/ Frame E125 0
525 B 70ms
60ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/users

Requested by

Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://cdn.districtm.io/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: DELETE, GET, OPTIONS, POST
access-control-allow-origin: https://cdn.districtm.io
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6a62a65f99f662f4-ORD
access-control-allow-headers: Origin, Content-Type

OPTIONS
H2 204 users
dmx.districtm.io/s/v1/ Frame 0
0 132ms
60ms Preflight 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/users

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://cdn.districtm.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cf-ray: 6a62a65f1a3d2cdd-ORD
access-control-allow-origin: https://cdn.districtm.io
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type
access-control-allow-methods: DELETE, GET, OPTIONS, POST
access-control-max-age: 14400
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare

OPTIONS
H2 204 users
dmx.districtm.io/s/v1/ Frame 0
0 138ms
68ms Preflight 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/users

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://cdn.districtm.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cf-ray: 6a62a65f1a3f2cdd-ORD
access-control-allow-origin: https://cdn.districtm.io
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type
access-control-allow-methods: DELETE, GET, OPTIONS, POST
access-control-max-age: 14400
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 5E5C 31 KB
10 KB 24ms
22ms Script
text/html 104.105.42.146
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.105.42.146 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-105-42-146.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: d8c259eba0c949dd085f3ae0941f8da6def8ec9627981a0763e234347aaddb04

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
Content-Encoding: gzip
Last-Modified: Fri, 29 Oct 2021 15:57:03 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=35474
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9396
Expires: Sat, 30 Oct 2021 16:31:16 GMT

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 1602
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=94D83743-6FD8-46F9-9736-57386BF11D70
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=94D83743-6FD8-46F9-9736-57386BF11D70

35 B
467 B

25ms
8ms

Document
image/gif

185.167.164.37
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=94D83743-6FD8-46F9-9736-57386BF11D70

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.37 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

server: nginx
date: Sat, 30 Oct 2021 06:40:02 GMT
content-length: 0
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=94D83743-6FD8-46F9-9736-57386BF11D70
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 67FE
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YXzovAAAtXyO_gAz&gdpr=0&gdpr_consent=

1 B
547 B

114ms
17ms

Document
text/html

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YXzovAAAtXyO_gAz&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: text/html; charset=utf-8
content-length: 1
x-lat: njrpug009:0:528
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

server: Varnish
retry-after: 0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YXzovAAAtXyO_gAz&gdpr=0&gdpr_consent=
accept-ranges: bytes
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 varnish
x-served-by: cache-yul12826-YUL
x-cache: HIT
x-cache-hits: 0
x-timer: S1635576002.364662,VS0,VE0
cache-control: no-cache
pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

adx Show response
match.prod.bidr.io/cookie-sync/ Frame 815A
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCdmYwN0MtZElBQUJLSkJjZFY4dw&bee_sync_partners=syn%2Cpp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&...
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=syn%2Cpp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1

43 B
430 B

26ms
25ms

Document
image/gif

3.233.68.37
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=syn%2Cpp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.233.68.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, must-revalidate
content-type: image/gif
Date: Sat, 30 Oct 2021 06:40:02 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
pragma: no-cache
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
Content-Length: 43
Connection: keep-alive

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=syn%2Cpp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
date: Sat, 30 Oct 2021 06:40:02 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)
content-length: 361
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 usersync.aspx Show response
dis.criteo.com/dis/ Frame 238D 43 B
334 B 460ms
23ms Document
image/gif 74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: Kestrel /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif
server: Kestrel
cache-control: no-cache
pragma: no-cache
expires: Sat, 30 Oct 2021 00:00:00 GMT
x-errorlevel: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 544388

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 823A
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=35cedb3e-394c-11ec-8f32-7928c9698643

42 B
547 B

28ms
21ms

Document
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=35cedb3e-394c-11ec-8f32-7928c9698643
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: njrpug022:0:283
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
Content-Type: image/gif
Content-Length: 0
Connection: keep-alive
server: Cowboy
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=35cedb3e-394c-11ec-8f32-7928c9698643
X-RealServer-NX: lga-delivery-2
Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate
Pragma: no-cache
Expires: Thu, 23 Sep 2004 17:42:04 GMT
P3P: CP="NOI OTC OTP OUR NOR"
Access-Control-Allow-Origin: *

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 2190
Redirect Chain

https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_03cf2c50fa4849e7a3be2

42 B
215 B

100ms
16ms

Document
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_03cf2c50fa4849e7a3be2
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: njrpug019:0:551
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_03cf2c50fa4849e7a3be2
content-type: image/gif
content-length: 0
date: Sat, 30 Oct 2021 06:40:02 GMT
server: c

GET
H/1.1

200
OK

RX-4ea9ead0-d0d3-4bd9-8a07-13f5ca5a85b3-005 Show response
sync.targeting.unrulymedia.com/csync/ Frame 1B57
Redirect Chain

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=6716165514
https://sync.1rx.io/usersync/tradedesk/dfc84948-51af-4a0f-b6e1-c55e98473d85
https://sync.targeting.unrulymedia.com/csync/RX-4ea9ead0-d0d3-4bd9-8a07-13f5ca5a85b3-005

43 B
452 B

327ms
26ms

Document
image/gif

199.127.204.142
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-4ea9ead0-d0d3-4bd9-8a07-13f5ca5a85b3-005
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 199.127.204.142 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

Server: Tengine
Date: Sat, 30 Oct 2021 06:40:02 GMT
Content-Length: 43
Connection: keep-alive
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

Server: Tengine
Date: Sat, 30 Oct 2021 06:40:02 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-store, no-cache, must-revalidate
Expires: 0
Pragma: no-cache
Location: https://sync.targeting.unrulymedia.com/csync/RX-4ea9ead0-d0d3-4bd9-8a07-13f5ca5a85b3-005

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 22EB
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=bYtWppN5Qb1IjcejITJTPCV4zZQ

42 B
219 B

96ms
21ms

Document
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=bYtWppN5Qb1IjcejITJTPCV4zZQ
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: njrpug011:0:551
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

Content-Type: text/html; charset=utf-8
Date: Sat, 30 Oct 2021 06:40:02 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=bYtWppN5Qb1IjcejITJTPCV4zZQ
Content-Length: 159
Connection: keep-alive

GET
H2

200

i.match Show response
s.tribalfusion.com/z/ Frame 5915
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...

43 B
423 B

94ms
88ms

Document
image/gif

2606:4700::6812:c05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif; charset=utf-8
content-length: 43
p3p: CP="NOI DEVo TAIa OUR BUS"
x-function: 302
cache-control: no-cache private
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6a62a65fefbb4bd0-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: text/html
p3p: CP="NOI DEVo TAIa OUR BUS"
x-function: 206
x-reuse-index: 6
cache-control: no-cache private
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
location: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6a62a65f3f1e4bd0-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 71DC
Redirect Chain

https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q6888624011786407600

42 B
253 B

93ms
17ms

Document
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q6888624011786407600
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: njrpug007:0:482
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

Server: Apache/2.2.15 (CentOS)
Content-Length: 154
Content-Type: text/html
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q6888624011786407600
X-Powered-By: PHP/5.3.3
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Vary: Accept-Encoding
Cache-Control: max-age=61384
Date: Sat, 30 Oct 2021 06:40:02 GMT
Connection: keep-alive

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 8D40
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:AZwsuykA1MGI265&gdpr=0&gdpr_consent=

42 B
212 B

90ms
19ms

Document
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:AZwsuykA1MGI265&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: njrpug008:0:441
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

Cache-Control: no-cache, must-revalidate
Date: Sat, 30 Oct 2021 06:40:01 GMT
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:AZwsuykA1MGI265&gdpr=0&gdpr_consent=
P3P: policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Pragma: no-cache
Server: PingMatch/v2.0.30-691-gbabbd08#rel-ec2-master i-0705d816a3df65089@us-east-1e@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains
Content-Length: 0
Connection: keep-alive

GET
H2

200

rtb-h Show response
match.taboola.com/sg/pubmatic-ssp-network/1/ Frame DBC0
Redirect Chain

https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=03fd644e-de27-4824-996e-41eb3ee9b58b-tuct8766e42&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdSe...

0
149 B

82ms
21ms

Document
text/plain

151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=03fd644e-de27-4824-996e-41eb3ee9b58b-tuct8766e42&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
accept-ranges: bytes
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 varnish
x-served-by: cache-yul12824-YUL
x-cache: MISS
x-cache-hits: 0
x-timer: S1635576003.545613,VS0,VE10
content-length: 0

Redirect headers

server: nginx
location: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=03fd644e-de27-4824-996e-41eb3ee9b58b-tuct8766e42&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
accept-ranges: bytes
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 varnish
x-served-by: cache-yul12820-YUL
x-cache: MISS
x-cache-hits: 0
x-timer: S1635576002.457235,VS0,VE10
x-vcl-time-ms: 10
content-length: 0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame DC54
Redirect Chain

https://ums.acuityplatform.com/tum?umid=6
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=618590585680

42 B
206 B

52ms
21ms

Document
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=618590585680
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: njrpug012:0:543
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

Content-Length: 0
Access-Control-Allow-Origin: *
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=618590585680

GET
H/1.1 200
OK merge Show response
ce.lijit.com/ Frame FA67 43 B
3 KB 37ms
28ms Document
image/gif 63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/merge?pid=58&3pid=94D83743-6FD8-46F9-9736-57386BF11D70
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.86.49 Chicago, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

Server: nginx
Date: Sat, 30 Oct 2021 06:40:02 GMT
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
X-Powered-By: raptor
X-Sovrn-Pod: ad_ap1dca1

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 9311
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=lNg3Q2_YRvmXNlc4a_EdcA%3D%3D
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

14 KB
14 KB

19ms
19ms

Image
text/html

104.126.113.6
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.126.113.6 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-126-113-6.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
content-encoding: gzip
last-modified: Tue, 15 Jun 2021 06:08:03 GMT
server: Apache/2.2.15 (CentOS)
etag: "1300708-3945-5c4c7cc02bd56"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=116760
accept-ranges: bytes
content-type: text/html; charset=UTF-8
content-length: 5054
expires: Sun, 31 Oct 2021 15:06:02 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 272
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

458249.gif
idsync.rlcdn.com/ Frame 9311
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=94D83743-6FD8-46F9-9736-57386BF11D70
https://pippio.com/api/sync?pid=5324&it=1&iv=d0b5677fad11e744091dbb4ccdcc296a47b76e86ad087b9c1908248e1246a4b2791426b5417dce21&_=2
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlBkMGI1Njc3ZmFkMTFlNzQ0MDkxZGJiNGNjZGNjMjk2YTQ3Yjc2ZTg2YWQwODdiOWMxOTA4MjQ4ZTEyNDZhNGIyNzkxNDI2YjU...
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlBkMGI1Njc3ZmFkMTFlNzQ0MDkxZGJiNGNjZGNjMjk2YTQ3Yjc2ZTg2YWQwODdiOWMxOTA4MjQ4ZTEyNDZhNGIyNzkxNDI2YjU0MTdkY2UyMRAAGgwIwtHziwYSBAgCEABCAEoA&goog...
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
https://idsync.rlcdn.com/458249.gif?partner_uid=4babdf99-3f12-4c55-8996-8d1cc5da32c4

42 B
306 B

41ms
40ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/458249.gif?partner_uid=4babdf99-3f12-4c55-8996-8d1cc5da32c4
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 35.190.60.146 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 30 Oct 2021 06:40:03 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/458249.gif?partner_uid=4babdf99-3f12-4c55-8996-8d1cc5da32c4
date: Sat, 30 Oct 2021 06:40:03 GMT
via: 1.1 google
x-samesite: secure
alt-svc: clear
content-length: 111
content-type: text/html; charset=utf-8

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 9311
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=f679617c-e8bc-4500-8869-484d925f2ac3

0
260 B

103ms
19ms

Image
text/plain

104.36.115.114
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=f679617c-e8bc-4500-8869-484d925f2ac3
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.36.115.114 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: MT3 4067 88cc6bf master iad-pixel-x8 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=f679617c-e8bc-4500-8869-484d925f2ac3
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sat, 30 Oct 2021 06:40:01 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 9311
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OTREODM3NDMtNkZEOC00NkY5LTk3MzYtNTczODZCRjExRDcw&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
111 B

35ms
20ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug016:0:495
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 9311
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEB5Gd_qVzHfxroZib7P7glE&google_cver=1

42 B
283 B

31ms
17ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEB5Gd_qVzHfxroZib7P7glE&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug015:0:492
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEB5Gd_qVzHfxroZib7P7glE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 9311
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:C6997686B96A4621B237B6F9CADCD8C9

42 B
225 B

41ms
20ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:C6997686B96A4621B237B6F9CADCD8C9
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug018:0:447
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Sat, 30 Oct 2021 06:40:02 GMT
x-content-type-options: nosniff
server: openresty
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:C6997686B96A4621B237B6F9CADCD8C9
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Fri, 29 Oct 2021 06:40:02 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 9311
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8713549251317042223&gdpr=0&gdpr_consent=&us_privacy=

1 B
322 B

39ms
11ms

Image
text/html

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8713549251317042223&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:30:32 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug021:0:392
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8713549251317042223&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 9311
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=dfc84948-51af-4a0f-b6e1-c55e98473d85

42 B
295 B

36ms
20ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=dfc84948-51af-4a0f-b6e1-c55e98473d85
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug013:0:479
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=dfc84948-51af-4a0f-b6e1-c55e98473d85
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 313

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 9311
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:f679617c-e8bc-4500-8869-484d925f2ac3&gdpr=0&gdpr_consent=

42 B
342 B

35ms
18ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:f679617c-e8bc-4500-8869-484d925f2ac3&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug010:0:467
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: MT3 4067 88cc6bf master iad-pixel-x31 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:f679617c-e8bc-4500-8869-484d925f2ac3&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sat, 30 Oct 2021 06:40:01 GMT

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 9311
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=94D83743-6FD8-46F9-9736-57386BF11D70&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-ez8GyfBE2uXw66WkEzh1NWOPcVTclrY-~A&gdpr=0&gdpr_consent=

0
48 B

94ms
19ms

Image
text/plain

104.36.115.114
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-ez8GyfBE2uXw66WkEzh1NWOPcVTclrY-~A&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.36.115.114 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: ATS/7.1.2.138
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-ez8GyfBE2uXw66WkEzh1NWOPcVTclrY-~A&gdpr=0&gdpr_consent=
Connection: keep-alive
Content-Length: 0

GET
H2 200 94D83743-6FD8-46F9-9736-57386BF11D70
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 9311 43 B
869 B 45ms
24ms Image
image/gif 2600:1f18:4e9:5a02:b622:7561:2233:a602
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/94D83743-6FD8-46F9-9736-57386BF11D70?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:b622:7561:2233:a602 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 9311
Redirect Chain

https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=9024276516877405506&gdpr=0&gdpr_consent=

42 B
210 B

51ms
18ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=9024276516877405506&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug020:0:484
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
X-Proxy-Origin: 37.120.205.148; 37.120.205.148; 673.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: e5de5faf-cc1a-4107-966d-20502caf826a
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=9024276516877405506&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 9311 0
88 B 134ms
23ms Image
text/plain 54.236.227.29
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.236.227.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-236-227-29.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 0
Content-Type: text/plain

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 9311
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=35aa3e57-394c-11ec-81ab-33deef32883a&gdpr=0&gdpr_consent=

1 B
217 B

35ms
19ms

Image
text/html

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=35aa3e57-394c-11ec-81ab-33deef32883a&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug014:0:554
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=35aa3e57-394c-11ec-81ab-33deef32883a&gdpr=0&gdpr_consent=
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 0
X-CI-RTID: 35c5413e-394c-11ec-9d14-fb2c7a265914

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 9311
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=94D83743-6FD8-46F9-9736-57386BF11D70&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=6e17b180f7421201&is_secure=true&networkId=17100&version=1&nuid=94D83743-6FD8-46F9-9736-57386BF11D70&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGZdK6h3yLrQMgZQoVAAAAAAA&expiration=1635662402&nuid=94D83743-6FD8-46F9-9736-57386BF11D70&...

42 B
282 B

19ms
19ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGZdK6h3yLrQMgZQoVAAAAAAA&expiration=1635662402&nuid=94D83743-6FD8-46F9-9736-57386BF11D70&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug003:0:572
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGZdK6h3yLrQMgZQoVAAAAAAA&expiration=1635662402&nuid=94D83743-6FD8-46F9-9736-57386BF11D70&is_secure=true&gdpr_consent=&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 9311
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341&gdpr=0&gdpr_consent=

42 B
233 B

39ms
19ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug025:0:371
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341&gdpr=0&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame 9311
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R1B341_E5C15CF2_1D93B7777&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
266 B

57ms
56ms

Image
image/gif

4.78.226.233
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Server

4.78.226.233 Fort Worth, United States, ASN3356 (LEVEL3, US),

Reverse DNS

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-318562802; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Cache-Control: no-cache
Expires: -1
Content-Length: 43
Strict-Transport-Security: max-age=-318562802; includeSubDomains
Content-Type: image/gif

Redirect headers

location: https://pmp.mxptint.net/sn.ashx?ak=1
date: Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug005:0:552
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 9311
Redirect Chain

https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=DzyYIlw1zHMUOZ10DmmCIA5onXYUbswjAGyMJ8lg

42 B
273 B

32ms
18ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=DzyYIlw1zHMUOZ10DmmCIA5onXYUbswjAGyMJ8lg
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug017:0:587
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=DzyYIlw1zHMUOZ10DmmCIA5onXYUbswjAGyMJ8lg
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1

200
OK

sync
x.bidswitch.net/ Frame 9311
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=4297e232-e191-49ae-a5c8-d105f494249b&ssp=pubmatic&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10593873700793157953&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.vi...
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=847721d1-9bd1-4e21-b195-5a1bd45c889e&ssp=pubmatic&gdpr_consent=&gdpr=0
https://aa.agkn.com/adscores/g.pixel?sid=9212302828&puid=[mPlatform_cookie_ID]&ssp=%3CSSP_VALUE%3E&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_785409&src.visitorId=205050203955011295646&ssp=%3CSSP_VALUE%3E&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=419&user_id=10593873700793157953&ssp=%3CSSP_VALUE%3E&gdpr=0&gdpr_consent=

43 B
235 B

38ms
37ms

Image
image/gif

35.211.178.172
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=419&user_id=10593873700793157953&ssp=%3CSSP_VALUE%3E&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 35.211.178.172 Mountain View, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 172.178.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
location: https://x.bidswitch.net/sync?dsp_id=419&user_id=10593873700793157953&ssp=<SSP_VALUE>&gdpr=0&gdpr_consent=
cache-control: no-cache, no-store, must-revalidate
alt-svc: clear
content-length: 0
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 9311
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=2932017504707848070

42 B
252 B

19ms
19ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=2932017504707848070
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug002:0:485
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: nginx
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=2932017504707848070
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 9311
Redirect Chain

https://sync.resetdigital.co:10001/csync/pubmatic
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=00000086702C9908

42 B
209 B

20ms
20ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=00000086702C9908
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug009:0:823
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Sat, 30 Oct 2021 06:40:03 GMT
Server: nginx/1.18.0 (Ubuntu)
Front-End-Https: on
Content-Type: text/html
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=00000086702C9908
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 929B
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEORmGZQ4iBkMwXt-Puk1F3w&google_cver=1&google_push=AYg5qPIlAxmHEyPamb5bpbG34VYukN4HLsd9EnNAtrsxILrX-639DbNvgYUQwoyaQgKk387dzHt0dKcOn3sXdwn0...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=9nlhfOi8RQCIaUhNkl8qww&google_push=AYg5qPIlAxmHEyPamb5bpbG34VYukN4HLsd9EnNAtrsxILrX-639DbNvgYUQwoyaQgKk387dzHt0dKcOn3sXdwn0pV9VgR29...

170 B
188 B

50ms
38ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=9nlhfOi8RQCIaUhNkl8qww&google_push=AYg5qPIlAxmHEyPamb5bpbG34VYukN4HLsd9EnNAtrsxILrX-639DbNvgYUQwoyaQgKk387dzHt0dKcOn3sXdwn0pV9VgR29oB6f

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: MT3 4067 88cc6bf master iad-pixel-x7 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=9nlhfOi8RQCIaUhNkl8qww&google_push=AYg5qPIlAxmHEyPamb5bpbG34VYukN4HLsd9EnNAtrsxILrX-639DbNvgYUQwoyaQgKk387dzHt0dKcOn3sXdwn0pV9VgR29oB6f
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sat, 30 Oct 2021 06:40:01 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 929B
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEI_mCXlQFiGQ_RNep-geJWU&google_cver=1&google_push=AYg5qPJ2aoyKLj2xlZYNDr1bjcvN4mG97nP_swHEeSFKBxb5MN5d67E8PsSCyvQmBeGWMoSUO3XzqR3B_C4hMoSd1jDMwsbb0_Kc&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEI_mCXlQFiGQ_RNep-geJWU&google_cver=1&google_push=AYg5qPJ2aoyKLj2xlZYNDr1bjcvN4mG97nP_swHEeSFKBxb5MN5d67E8PsSCyvQmBeGWMoSUO3XzqR3B_C4hMoSd1jDMwsbb0_K...

43 B
388 B

92ms
92ms

Image
image/gif

2606:4700::6812:c05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEI_mCXlQFiGQ_RNep-geJWU&google_cver=1&google_push=AYg5qPJ2aoyKLj2xlZYNDr1bjcvN4mG97nP_swHEeSFKBxb5MN5d67E8PsSCyvQmBeGWMoSUO3XzqR3B_C4hMoSd1jDMwsbb0_Kc&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPJ2aoyKLj2xlZYNDr1bjcvN4mG97nP_swHEeSFKBxb5MN5d67E8PsSCyvQmBeGWMoSUO3XzqR3B_C4hMoSd1jDMwsbb0_Kc%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Protocol: H2
Server: 2606:4700::6812:c05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6a62a66048064bd0-YUL
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
content-type: image/gif; charset=utf-8
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 57
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6a62a65f3f204bd0-YUL
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEI_mCXlQFiGQ_RNep-geJWU&google_cver=1&google_push=AYg5qPJ2aoyKLj2xlZYNDr1bjcvN4mG97nP_swHEeSFKBxb5MN5d67E8PsSCyvQmBeGWMoSUO3XzqR3B_C4hMoSd1jDMwsbb0_Kc&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPJ2aoyKLj2xlZYNDr1bjcvN4mG97nP_swHEeSFKBxb5MN5d67E8PsSCyvQmBeGWMoSUO3XzqR3B_C4hMoSd1jDMwsbb0_Kc%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control: no-cache, private
content-type: text/html
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 929B
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEOUQ7f1sg3r1FPQPD2EbDG8&google_cver=1&google_push=AYg5qPI2lPv3qrqEX9VG8ZaoKw02KYYA4uMI0MxjM1rPq0paDBekeo6gB9iQteyXBdff29H_04i9RtR...
https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=fKtDbZ86S4eP3d-NAY8eYmF86ME

170 B
188 B

50ms
45ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=fKtDbZ86S4eP3d-NAY8eYmF86ME

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:01 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=fKtDbZ86S4eP3d-NAY8eYmF86ME
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 929B
Redirect Chain

https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEM8nvVVFX6gHSw12HlV2yG8&google_cver=1&google_push=AYg5qPL29BpmLxeWqwgug1AGUuu-8tSPAd3JCkuP1kOGzhaGsAfDozlba5QcHzq-CDOqxyvG2uepWs1GtBq0Wv...
https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AYg5qPL29BpmLxeWqwgug1AGUuu-8tSPAd3JCkuP1kOGzhaGsAfDozlba5QcHzq-CDOqxyvG2uepWs1GtBq0Wv1kJuUvkEPQoAmk&google_hm=hmF86MKLH-ETM0sXG...

170 B
188 B

49ms
44ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AYg5qPL29BpmLxeWqwgug1AGUuu-8tSPAd3JCkuP1kOGzhaGsAfDozlba5QcHzq-CDOqxyvG2uepWs1GtBq0Wv1kJuUvkEPQoAmk&google_hm=hmF86MKLH-ETM0sXGQ&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D617CE8C28B1FE113334B1719BLIS

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AYg5qPL29BpmLxeWqwgug1AGUuu-8tSPAd3JCkuP1kOGzhaGsAfDozlba5QcHzq-CDOqxyvG2uepWs1GtBq0Wv1kJuUvkEPQoAmk&google_hm=hmF86MKLH-ETM0sXGQ&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D617CE8C28B1FE113334B1719BLIS
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google
alt-svc: clear
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 929B
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEJAXQtQRpA9Hzro4rDJkz7c&google_cver=1&google_push=AYg5qPLa2hDgGBJWXbhRYF46TNegTqwWdKwKri43wdSiysXqzAgFpGpvYcB60ch7eTlAC9so7hAuJDULZNdA0x0...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=bYtWppN5Qb1IjcejITJTPCV4zZQ&google_push=AYg5qPLa2hDgGBJWXbhRYF46TNegTqwWdKwKri43wdSiysXqzAgFpGpvYcB60ch7eTlAC9so7hAuJDULZNdA0x...

170 B
188 B

48ms
45ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=bYtWppN5Qb1IjcejITJTPCV4zZQ&google_push=AYg5qPLa2hDgGBJWXbhRYF46TNegTqwWdKwKri43wdSiysXqzAgFpGpvYcB60ch7eTlAC9so7hAuJDULZNdA0x0cjmT4cll6Rsw

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=bYtWppN5Qb1IjcejITJTPCV4zZQ&google_push=AYg5qPLa2hDgGBJWXbhRYF46TNegTqwWdKwKri43wdSiysXqzAgFpGpvYcB60ch7eTlAC9so7hAuJDULZNdA0x0cjmT4cll6Rsw
Date: Sat, 30 Oct 2021 06:40:02 GMT
Connection: keep-alive
Content-Length: 241
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 929B
Redirect Chain

https://dsp.adkernel.com/sync?exchange=11&google_gid=CAESEGssGLlLNqIgHEevAXWIcfA&google_cver=1&google_push=AYg5qPItTtFKU1sF-jXmPdGZeldpeizP38YN8h53S4GSUcwiRlMLdx31YVqgwHjgKB9Pv0EGNTPwnY2jEt53DDDDQG...
https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTY3NzU4MzY3NjU0OTc0MDI4NTQ&google_push=AYg5qPItTtFKU1sF-jXmPdGZeldpeizP38YN8h53S4GSUcwiRlMLdx31YVqgwHjgKB9Pv0EGNTPwnY2jEt53DDDDQGrh...

170 B
188 B

46ms
38ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTY3NzU4MzY3NjU0OTc0MDI4NTQ&google_push=AYg5qPItTtFKU1sF-jXmPdGZeldpeizP38YN8h53S4GSUcwiRlMLdx31YVqgwHjgKB9Pv0EGNTPwnY2jEt53DDDDQGrh67eiql4

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTY3NzU4MzY3NjU0OTc0MDI4NTQ&google_push=AYg5qPItTtFKU1sF-jXmPdGZeldpeizP38YN8h53S4GSUcwiRlMLdx31YVqgwHjgKB9Pv0EGNTPwnY2jEt53DDDDQGrh67eiql4
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 929B
Redirect Chain

https://beacon.lynx.cognitivlabs.com/adx.gif?google_gid=CAESEGLHV1CKkyRxb4Lh1t7JJDI&google_cver=1&google_push=AYg5qPJD121Mx-6pwDP-MKTqraOzV6iCWIwEj_-_oufyHnxaip-d0GeW84bROXstJeKzrNuiQsug6eMoijNv6J3...
https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=-Cl5nQriyEy6XEIRod0XAw&google_push=AYg5qPJD121Mx-6pwDP-MKTqraOzV6iCWIwEj_-_oufyHnxaip-d0GeW84bROXstJeKzrNuiQsug6eMoijNv6J3DE_oKfbYG5...

170 B
188 B

46ms
40ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=-Cl5nQriyEy6XEIRod0XAw&google_push=AYg5qPJD121Mx-6pwDP-MKTqraOzV6iCWIwEj_-_oufyHnxaip-d0GeW84bROXstJeKzrNuiQsug6eMoijNv6J3DE_oKfbYG5vqDaA

Protocol

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=-Cl5nQriyEy6XEIRod0XAw&google_push=AYg5qPJD121Mx-6pwDP-MKTqraOzV6iCWIwEj_-_oufyHnxaip-d0GeW84bROXstJeKzrNuiQsug6eMoijNv6J3DE_oKfbYG5vqDaA
date: Sat, 30 Oct 2021 06:40:02 GMT
server: Kestrel
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 929B 0
12 B 56ms
46ms Image
text/html 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KOunnmIAl-TCDFD3R1lOenTlyP3g8vC8aeFof1qKu9xv298WYxEoyegghNNML9sX1KkBjuyg

Requested by

Host: 95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com
URL: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 frame1.jpg
s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/img/ Frame 0742 7 KB
7 KB 31ms
18ms Image
image/jpeg 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/img/frame1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e22f5e44bcd463eacf77dbc5fb11f02f25c2fd3c658e0108c2a9b3d75627c83c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 01:47:10 GMT
x-content-type-options: nosniff
age: 17572
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6803
x-xss-protection: 0
last-modified: Mon, 18 Oct 2021 16:59:46 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 31 Oct 2021 01:47:10 GMT

GET
H2 200 frame2.jpg
s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/img/ Frame 0742 6 KB
6 KB 31ms
19ms Image
image/jpeg 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/img/frame2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

269cd7cc9ef74066a58bd2b672f758dbb6b840fcaf970275023f855c1aa6dd76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 01:47:22 GMT
x-content-type-options: nosniff
age: 17560
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6542
x-xss-protection: 0
last-modified: Mon, 18 Oct 2021 16:59:46 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 31 Oct 2021 01:47:22 GMT

GET
H2 200 frame3.jpg
s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/img/ Frame 0742 7 KB
7 KB 32ms
20ms Image
image/jpeg 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/img/frame3.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98d93a1121f64d97b39a2034f1a9bd182ccd84321078217aac2f5870f8b38e52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 20:32:43 GMT
x-content-type-options: nosniff
age: 36439
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7386
x-xss-protection: 0
last-modified: Mon, 18 Oct 2021 16:59:46 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 30 Oct 2021 20:32:43 GMT

GET
H2 200 frame4.jpg
s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/img/ Frame 0742 6 KB
6 KB 32ms
21ms Image
image/jpeg 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/img/frame4.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

534cff61db8949045baae7865eb7b2cb41bc52d08ce6407329ae7026fa3e05b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 04:04:52 GMT
x-content-type-options: nosniff
age: 9310
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6495
x-xss-protection: 0
last-modified: Mon, 18 Oct 2021 16:59:46 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 31 Oct 2021 04:04:52 GMT

GET
H2 200 frame5.jpg
s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/img/ Frame 0742 8 KB
8 KB 33ms
22ms Image
image/jpeg 2607:f8b0:4006:80c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/img/frame5.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fa6a3d25c7345e98747514ac7123b0c5f84a6e4f705b5fa5ab759adc3953b9a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/10122320/1634576386190/2021-11-bi-holiday-savings-programmatic-display-non-bi-savethedate-320x50-us-can-final/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 00:05:37 GMT
x-content-type-options: nosniff
age: 23665
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8572
x-xss-protection: 0
last-modified: Mon, 18 Oct 2021 16:59:46 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 31 Oct 2021 00:05:37 GMT

GET
H2

200

cm Show response
us-u.openx.net/w/1.0/ Frame F7EC
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1635576002165.4&ri=70&ru=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fcm%3Fid%3Dc6a5ba0d-ce02-41bd-a1ea-842c68bd5108%26ph%3D8f5ed5d4-642c-4222-968a-d709c...
https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fus_privacy%3D%26bi...

1 KB
1011 B

32ms
28ms

Document
text/html

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fus_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 6467e184f51a1327e59eb7414a48e6f2e1731e31d763b4f3a4a89aeb193b7fb0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: about:blank

Response headers

vary: Accept, Accept-Encoding
server: OXGW/16.217.1
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: text/html
content-length: 688
content-encoding: gzip
via: 1.1 google
alt-svc: clear

Redirect headers

p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate
expires: Thu, 01-Jan-70 00:00:01 GMT
x-33x-status: 40000000008200000A
server: 33XP001
location: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fus_privacy%3D%26bidder_id%3D70%26external_user_id%3D
content-length: 0
date: Sat, 30 Oct 2021 06:40:01 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame 39BD
Redirect Chain

https://ssc-cms.33across.com/ps/?_=1635576002165.&ri=0013300001r0t9mAAA&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
https://rtb.gumgum.com/usersync?b=tta&i=1670516501678

35 B
237 B

47ms
29ms

Image
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=tta&i=1670516501678
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Protocol: H2
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
referrer-policy: unsafe-url
server: 33XP004
x-33x-status: 100000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://rtb.gumgum.com/usersync?b=tta&i=1670516501678
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 39BD
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1635576002165.2&ri=2&ru=https%3A%2F%2Fssum-sec.casalemedia.com%2Fusermatchredir%3Fs%3D191740%26us_privacy%3D%24%7BUS_PRIVACY%7D%26cb%3Dhttps%253A%252...
https://ssum-sec.casalemedia.com/usermatchredir?s=191740&us_privacy=&cb=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fus_privacy%3D%26bidder_id%3D2%26external_user_id%3D
https://cms-xch-chicago.33across.com/match?us_privacy=&bidder_id=2&external_user_id=YXzowaF-No2DUdyw-NpZWAAA%26512

68 B
127 B

30ms
29ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?us_privacy=&bidder_id=2&external_user_id=YXzowaF-No2DUdyw-NpZWAAA%26512
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Protocol: H2
Server: 34.117.239.71 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cms-xch-chicago.33across.com/match?us_privacy=&bidder_id=2&external_user_id=YXzowaF-No2DUdyw-NpZWAAA%26512
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 306
Expires: Sat, 30 Oct 2021 06:40:02 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 39BD
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1635576002165.3&ri=45&ru=https%3A%2F%2Fpixel-sync.sitescout.com%2Fdmp%2FpixelSync%3Fnid%3D104%26us_privacy%3D%24%7BUS_PRIVACY%7D%26redir%3Dhttps%253A...
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=104&us_privacy=&redir=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fus_privacy%3D%26bidder_id%3D45%26external_user_id%3D%7BuserId%7D
https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_i...
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341&partner_url=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fus_priva...
https://cms-xch-chicago.33across.com/match?us_privacy=&bidder_id=45&external_user_id=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341

68 B
127 B

171ms
171ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?us_privacy=&bidder_id=45&external_user_id=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Protocol: H2
Server: 34.117.239.71 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

location: https://cms-xch-chicago.33across.com/match?us_privacy=&bidder_id=45&external_user_id=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google
alt-svc: clear
content-length: 0
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 39BD
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1635576002165.5&ri=90&ru=https%3A%2F%2Fib.adnxs.com%2Fgetuid%3Fhttps%253A%252F%252Fcms-xch-chicago.33across.com%252Fmatch%253Fus_privacy%253D%24%7BUS...
https://ib.adnxs.com/getuid?https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fus_privacy%3D%26bidder_id%3D90%26external_user_id%3D%24UID
https://cms-xch-chicago.33across.com/match?us_privacy=&bidder_id=90&external_user_id=9024276516877405506

68 B
127 B

31ms
28ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?us_privacy=&bidder_id=90&external_user_id=9024276516877405506
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Protocol: H2
Server: 34.117.239.71 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
X-Proxy-Origin: 37.120.205.148; 37.120.205.148; 673.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: ded78076-87bb-4f7d-a752-4ec5a4b2f427
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cms-xch-chicago.33across.com/match?us_privacy=&bidder_id=90&external_user_id=9024276516877405506
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 39BD
Redirect Chain

https://bttrack.com/pixel/cookiesync?source=2c3b95b9-6513-42b2-beb7-260851c73b75&secure=1&us_privacy=&cb=1635576002165.6
https://ssc-cms.33across.com/ps/?xi=66&us_privacy=&xu=ec84ac1e-a660-4b1f-ae6b-1d917644a616
https://cms-xch-chicago.33across.com/match?bidder_id=66&external_user_id=ec84ac1e-a660-4b1f-ae6b-1d917644a616&ts=1635576002&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
127 B

102ms
102ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=66&external_user_id=ec84ac1e-a660-4b1f-ae6b-1d917644a616&ts=1635576002&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Protocol: H2
Server: 34.117.239.71 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
referrer-policy: unsafe-url
server: 33XP003
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=66&external_user_id=ec84ac1e-a660-4b1f-ae6b-1d917644a616&ts=1635576002&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 39BD
Redirect Chain

https://p.rfihub.com/cm?pub=35686&in=1&us_privacy=&lexicon_id=ggb002b0542d41c
https://ssc-cms.33across.com/ps/?xi=93&xu=978758874792604269&us_privacy=
https://cms-xch-chicago.33across.com/match?bidder_id=93&external_user_id=978758874792604269&ts=1635576002&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
127 B

30ms
28ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=93&external_user_id=978758874792604269&ts=1635576002&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Protocol: H2
Server: 34.117.239.71 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
referrer-policy: unsafe-url
server: 33XP003
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=93&external_user_id=978758874792604269&ts=1635576002&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame 5E5C
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum
https://rtb.gumgum.com/usersync?b=mag&i=KVDFPVGC-I-75ZC

35 B
237 B

38ms
32ms

Image
image/gif

52.71.93.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=mag&i=KVDFPVGC-I-75ZC
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: H2
Server: 52.71.93.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-93-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
content-type: image/gif;charset=UTF-8
server: nginx
p3p: CP="This is not a P3P policy"
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://rtb.gumgum.com/usersync?b=mag&i=KVDFPVGC-I-75ZC
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 84e0f527cd81a00b0210e20b4ee7ed94
Expires: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame F5C1 0
23 B 46ms
40ms Ping
image/gif 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuIqND_kL1XSfhgjWmBIRBHIu-oZHmALjmIc6HvUa_TBSxYyxUhOC0QbLc5vUozhnPR4xaImkpObBwN6m6qe2OAqWhhofgp0KiAwbE4WfcLJOULWfcv52vvpGHcxXKcuzZQLzz6BJ0PftmHfW2RMtmBFHx8mETJGq-No8qK9-RZd2s3Nxn5pSsf3IFDdeCZH-fWSNQ3fE8yUmUWVo1FMIUY0x1J1wbmSS0PtqD4P0bEyT5w8ds35pHtQTfLFzcFN50LLxLyPUNxPUQOzt8gbxMQ72UK9xktX9jYV_nUyD1otNU8FMMhbk6rGEeJhd3tNvDXHYFGdBX6Atqx5m5VdOBzEO9DbomweF5Gn1TijGPx-IkHqDgfQyupniexTD2cHF6xVF3qa_gjCAlNGBFTeQOmlN88DnImAJyTHeU9f4yj3Uz0JGQAkFo7l-rUM1J3rKfpPmjNtCvE_TxLQLOLIbQ6NQG2jDcT22OJwZyy7rh94BWwhqDNoBQMyqudog2YWusAiwvo_0ON5T9z7C0lncvjcFd4RYdCBSyplIKK7W89-GYoPU1EIEM2X-dZNzANf3jdcAIl3Poyl9armWdsudJ8fdWzumC1t9jQnKuhBH6XVXBLC5mghbHf9y04gALrfc_sIF-hwtXmk38sORQ8mtTTDxsC3kXK_R6ChEJvRzCmG-0yB7k5MvoX7W0ksPZxCclavlRuUflnm0TF9jYSfbbPI_zMqVnoHTcm3HFIYBh_DE-X-lsJ_0WCxuhYRj_4i0b3WgL77LSBiNB37hAT6GkMeA-bc0TWo58um7aX7OnifgEIqcM1j294RKNag5WyrytRdsi9iArs01Q8bzjB3FvfoRO9MYbHLi1Sy-eIxEEulQzX71uERoOAHKuP6J-46x42cEclza6f78wcY1PeWiNGFWUM2dmxsyu28jyaMab0QxR1GK3HemhpNxZE5XrDkc81srT_Z3V0TS-d9KEvY6pjNzWyOMK5tt1DyLmuao7Rr-BzKlo3Ri8lCK_qIf0wJG9aoM3wfuJLASoJwK2FHgeScazwTVBuBXjqDUiVJU2wT9ZuZZUhXTGcqfuKXwF6Aw1EzoQjAvUZwt_FfOUOzKJM9Zv-sM1LEQ6Ii0BQCvFn0vYVgM0S4svx1hTkfGKNBoblBPFWRVen4ftMHahJmUviv4k_2eWq2_bxs7qyra4Zu4jIw4wGLc4rel4ptgrKzYEasPHLVkTkEa1XtdRcfsqbXdFcwOTyIcaZIABA1UtakZC535i1gpJpE14K7j4CTPobCXs6XY8wzrmUeV5M_Q&sai=AMfl-YRzM1LJwstCXxzordXI15rT2JXPe1UBvQNoLAUYzsekwhZ4H1PaMMjbfJeNxAOYkWTrL1dREIT9R--e0eqCQC1nilmbiza3rVK4-c-_oJF0O1ppzuE_1tQ-F6ziv7uHD5qYjt9GJK0xcRzObI-HqlkjOZ7BcMnimI7Jd4-1i7E6dkc29_AY3A&sig=Cg0ArKJSzIqO-aaaS12-EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=776&vt=11&dtpt=532&dett=3&cstd=226&cisv=r20211027.32224&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: nowtoronto.com
URL: https://nowtoronto.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://95325b680bd491cfe01eeb0db817b850.safeframe.googlesyndication.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sat, 30 Oct 2021 06:40:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 sKl_vPiz0OchHmL4Vfbrj3Wozc3CsK_Jq53kDzx3_oA.js Show response
pagead2.googlesyndication.com/bg/ Frame A390 35 KB
13 KB 20ms
19ms Script
text/javascript 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/sKl_vPiz0OchHmL4Vfbrj3Wozc3CsK_Jq53kDzx3_oA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b0a97fbcf8b3d0e7211e62f855f6eb8f75a8cdcdc2b0afc9ab9de40f3c77fe80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 21:13:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 206763
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13525
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 18:58:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Thu, 27 Oct 2022 21:13:59 GMT

POST
H2 204 users Show response
dmx.districtm.io/s/v1/ Frame 65F3 0
603 B 63ms
63ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/users

Requested by

Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://cdn.districtm.io/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: DELETE, GET, OPTIONS, POST
access-control-allow-origin: https://cdn.districtm.io
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6a62a660fadd62f4-ORD
access-control-allow-headers: Origin, Content-Type

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame E48C 0
733 B 25ms
24ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 , United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
X-Proxy-Origin: 37.120.205.148; 37.120.205.148; 673.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: c9c2e7c5-9778-49d8-b2f3-c11634bbaf5f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 6979 0
733 B 34ms
34ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 , United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

49.246.178.107.bc.googleusercontent.com

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
X-Proxy-Origin: 37.120.205.148; 37.120.205.148; 673.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: ba1bab60-e65a-492f-af02-b19f31417c9a
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

OPTIONS
H2 204 users
dmx.districtm.io/s/v1/ Frame 0
0 68ms
65ms Preflight 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/users

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://cdn.districtm.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
cf-ray: 6a62a6608b842cdd-ORD
access-control-allow-origin: https://cdn.districtm.io
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type
access-control-allow-methods: DELETE, GET, OPTIONS, POST
access-control-max-age: 14400
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare

GET
H2 200 match
cms-xch-chicago.33across.com/ Frame F7EC 68 B
127 B 190ms
190ms Image
image/png 34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?us_privacy=&bidder_id=70&external_user_id=a2f55084-9f68-4418-b581-fa4eced7010c
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fus_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.239.71 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:03 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

GET
H2 200 709996.gif
id.rlcdn.com/ Frame F7EC 42 B
299 B 41ms
41ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/709996.gif
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fus_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

GET
H2

200

dds
rtb.openx.net/sync/ Frame F7EC
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=C8jW1uhlzdk_wrkpF5qp6Q==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
146 B

28ms
28ms

Image
image/gif

35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fus_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol: H2
Server: 35.227.252.103 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: clear
content-length: 43
x-request-id: i5qv90o8nhfua31gub3fhm2rbltsjv9k

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 249
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame F7EC
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
https://us-u.openx.net/w/1.0/sd?id=536872786&val=f679617c-e8bc-4500-8869-484d925f2ac3

43 B
106 B

29ms
28ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=536872786&val=f679617c-e8bc-4500-8869-484d925f2ac3
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fus_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol: H2
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google
server: OXGW/16.217.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: MT3 4067 88cc6bf master iad-pixel-x29 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://us-u.openx.net/w/1.0/sd?id=536872786&val=f679617c-e8bc-4500-8869-484d925f2ac3
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sat, 30 Oct 2021 06:40:01 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame F7EC
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
https://us-u.openx.net/w/1.0/sd?id=537073028&val=35aa3e57-394c-11ec-81ab-33deef32883a

43 B
106 B

29ms
28ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073028&val=35aa3e57-394c-11ec-81ab-33deef32883a
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fus_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol: H2
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google
server: OXGW/16.217.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: https://us-u.openx.net/w/1.0/sd?id=537073028&val=35aa3e57-394c-11ec-81ab-33deef32883a
Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 0
X-CI-RTID: 36107a43-394c-11ec-b248-b3be274fa7d2

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame F7EC
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072977&val=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341&gdpr=0&gdpr_consent=

43 B
106 B

44ms
43ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341&gdpr=0&gdpr_consent=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fus_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol: H2
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google
server: OXGW/16.217.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://us-u.openx.net/w/1.0/sd?id=537072977&val=7cab436d-9f3a-4b87-8fdd-df8d018f1e62-617ce8c1-4341&gdpr=0&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2 200 receive
pixel.tapad.com/idsync/ex/ Frame F7EC 95 B
425 B 41ms
36ms Image
image/png 107.178.246.49
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=d2e02f16-1ae4-4970-9357-6d48f70f525f

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fus_privacy%3D%26bidder_id%3D70%26external_user_id%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.178.246.49 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google
content-type: image/png
alt-svc: clear
content-length: 95
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/58294/ Frame F7EC
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9e0a35ea-c8e3-4b1b-9efa-4af6f54a373e&r=https://pixel.advertising.com/ups/58294/sync?_origin=1&uid={OPENX_ID}
https://pixel.advertising.com/ups/58294/sync?_origin=1&uid=fa5adf63-9989-4ebe-8a91-34945320673a
https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=fa5adf63-9989-4ebe-8a91-34945320673a&apid=UP3604bafa-394c-11ec-9f59-0e6e94203e0b

0
1 KB

32ms
32ms

Image
text/plain

54.175.87.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=fa5adf63-9989-4ebe-8a91-34945320673a&apid=UP3604bafa-394c-11ec-9f59-0e6e94203e0b

Requested by

Protocol

HTTP/1.1

Server

54.175.87.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-175-87-114.compute-1.amazonaws.com

Software

ATS/7.1.2.138 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 06:40:02 GMT
Server: ATS/7.1.2.138
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=fa5adf63-9989-4ebe-8a91-34945320673a&apid=UP3604bafa-394c-11ec-9f59-0e6e94203e0b
date: Sat, 30 Oct 2021 06:40:02 GMT
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

396846.gif
idsync.rlcdn.com/ Frame F7EC
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D
https://id.rlcdn.com/464246.gif?partner_uid=8158238c-8ca4-4297-86cf-756dfd18f28b
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=8158238c-8ca4-4297-86cf-756dfd18f28b

42 B
306 B

41ms
40ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=8158238c-8ca4-4297-86cf-756dfd18f28b
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fus_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol: H2
Server: 35.190.60.146 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 30 Oct 2021 06:40:03 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

Redirect headers

date: Sat, 30 Oct 2021 06:40:02 GMT
content-encoding: gzip
server: OXGW/16.217.1
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=8158238c-8ca4-4297-86cf-756dfd18f28b
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame F7EC
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=9024276516877405506

43 B
106 B

30ms
30ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=9024276516877405506
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fus_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol: H2
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
via: 1.1 google
server: OXGW/16.217.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
X-Proxy-Origin: 37.120.205.148; 37.120.205.148; 673.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: c5ecffe1-9e7c-42ed-bcb0-c260cad3bd20
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=9024276516877405506
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame F7EC 43 B
932 B 82ms
33ms Image
image/gif 209.54.177.54
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=8c482097-5d49-cf0d-19b8-7709acb058b3

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.177.54 Osaka, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 30 Oct 2021 06:40:02 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: CX5SB81DNCGN23EAB3AR
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 74FE 0
56 B 39ms
39ms Image
image/gif 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BiOeqweh8YeqYAYLBzgXxj5iYCAAAAAA4AeAEAg&bg=!mZqlmt7NAAZzbWp4c207ACkAdvg8Wv0pYVUoBJwivzacpgaio4dSYb-0FnM9HDOy0afffrJ1JHIMNAIAAAG4UgAAAB5oAQeZAxVwu2gSHEhOT0HrTyPe3GV2l9WNpq4reWemG_-pxU0whLyrMpsHqNIR4yqfZE0T62NimZ4VKl4DfAoiH57wWX5TPgGB9bK11n1IdRcWDr8EaVu2IBmLYJuW9RAbSe9NtGV3ZG0b77BGnvRlBphqC-b-wmUZAmTQRAJeNguh24NFpfvaEX8rQJPBo_ucdDMHrHhLCA4u_xnFS1-VmemK_UurgJ0Ts_lf67um3RE52ceG0QtxN6tRbbqmidRYeFJe5PL3FNelS6-uNghbQbPnZiPGPNt-pT247WBWn_GyxyvXK2PpiL0qO5ysZvVoyKGlt5Spoz_WqnBtrUNoQE59cmPO4PhIaTkJ6vAWtfVLiyBWXByxy7Q1-enXkpqfJ5oRPXyNWLcBc4hRD5VSqf1lrIR-uM__FMEg77FTrtp7grniL7B9Q656OUDMHAwr_VD5_GqfK33fL5dDKqyfsBbmU2ABOlbK5OTalnDDb93X-0Nm9UdQj2v1bZoE2m_H2po09AMupJgjG7bpeupO_P8SUBMAcCVnQx6EmnX54VYQwcowMKmNGfye6rbSDXHsZotJ-RR8WQ_joDaNq_ZXvIh-ZJ8ApWSrD57RdTxKYPABNyY8h2wnmN4iMwo1Bzlxq2LJC8cSeZJ1VRpTBsIlCznjGqX-IMPTHPm6tOIWlYywvXiUSJHEZSinkuNzGbTHf855RQ26RJkV6vWRwR5eVZaWrSUDOsvgFpCGKunMND0PcIf6px4uBXG7-lSFRVjOnuNXQ0D_Nm6rOaqKH7io-qezOeLlb4eXGSFMcgcTmObwYQFYE47OIpifqTK6QUwpdToGn-8-C45AD7rrzq1iHC0iqpuxgwDytyUdQcbDZsqhc31LLssmJrMvWPbNWOUVPAt64B0Z5hn5X6Zr81euBTnpEtQu-Gs-eAUFt0hzHD_vCREUCVNiUYEgJVv7VeLo5dNBWU0fkxQtkBexTCqTQ--tMahj9R9ioMR-Lq-s1wpQRUYwT7GW5MtkvMDc1ySd5xGYsjTpNb6tZ5JhyCMbLa7yES3fhCJaPFw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 30 Oct 2021 06:40:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A390 0
56 B 39ms
39ms Image
image/gif 142.251.41.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BTjiqweh8YamZH56qNYCzp-gIAAAAADgB4AQC&bg=!CwilCEzNAAZzbWp4c207ACkAdvg8WlpKKqRFjQt3A5vPs4bZiYt5-Iv5XXJ12g83DOUWjOL35oLqJwIAAAEuUgAAAAxoAQcKACUFf6m0C-rMLTz3w4Y-RdXCdt3rvNHRoOpqdF9mNqf9rutznTeWmQL10lF3e85n8txC4GEqzaofnw6sjtkcFihgxh0QWTNCin_SVK-EDufNZzsY5hx5AomthNVsONjws-Tk9voXwlMsELlzeeh1hKkMIYrUlJ8fBIQKP8LeftEgQyvTbUamvOx5rzyYkgNDcAZetS-baBpQzQuAZtAVhAkPu0dPWckmPlpuu_1eJdBv5jTqHX-9clqdpQoy8P_fBKb3sjyAWbE6FHrzvftqzsPIHJvx88qYlVSoU8juA869WEHRe_9VUgH8TnOYC2qy8-4QBz3SsnOwOPgnpbY7dWPIdGzGriQ0tIBsl5PGYNYWF8F7x-tVNGs-7t6EqLCJuNYd2FuIvw4UqmIg7Bnzb51_S6K-MxW2TB5Xx_kOdlvM686y_KoMpwa_aANZaq-Lb1l7RLNQWkPdbK_FlH_YvhZmSwXQDu8T4ocSd3R677rClwk5wWyJAfain2AeukVNwe_qox-bhAHCpVpnY58FbBMtY1c9EC6O5mws_arhTx5IaRRJAT9JFKBkvgoesma18IwbhjqXPEGy6a6-6PbbLgcphf7jxdl_faWj1LDSpgdphYKDMelBgOrlrJNzq9tzwwf2AnuWsTJMUZ3nKR8itHcvBbIMfCIqQj8bB66k4ZtCC_4rWbEMZFGYrVgmy-uPk4i6YtLOj4zfdEIGgBuZIj0Udm-pMIa9j2L_2a1qnhjs2per7BxdLGt_RDTIfLGyjJqLNuF2fBuqgtG8mg3w6uh8q_OkxluwAxkj8Go8_fuFPi_nEiskw0FOqraQhfRihWffsBQP0xOTScTdMU34_9i69nHXQPDVqUudAaRqPsdIPlLGrYpRwqNbDKM8oNSGfU53U-zSoHNFE2Pso4wAagn8SP-_jiEEcZiU0Z-5VbeJuRkVAWMFRiRi4-SBHy4QSso3vBIg1U7mRop3mYb_vxIqb9qRmZR2k0FcgUJT4J9QdEK-U5TZdYrSLsyfqI1YbCmFp5T2SGxkwtQ7c7Y5OU3-0VGc_6aNoQJNHs1bJA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS