secure.winred.com Open in urlscan Pro
2606:4700::6813:d359 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=2024122...
Submission: On December 27 via manual (December 27th 2024, 3:45:51 pm UTC) from US — Scanned from US

Summary HTTP 57 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 23 IPs in 3 countries across 22 domains to perform 57 HTTP transactions. The main IP is 2606:4700::6813:d359, located in United States and belongs to CLOUDFLARENET, US. The main domain is secure.winred.com. The Cisco Umbrella rank of the primary domain is 93759.
TLS certificate: Issued by WE1 on November 21st 2024. Valid for: 3 months.

This is the only time secure.winred.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 11	2606:4700::68... 2606:4700::6813:d359	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	3.168.102.4 3.168.102.4	16509 (AMAZON-02) (AMAZON-02)
4	2607:f8b0:400... 2607:f8b0:4006:817::200a	15169 (GOOGLE) (GOOGLE)
4	2600:9000:26f... 2600:9000:26fa:fe00:0:7d26:ee00:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:5049	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2607:f8b0:400... 2607:f8b0:4006:817::2008	15169 (GOOGLE) (GOOGLE)
8	151.101.64.176 151.101.64.176	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6813:d459	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4006:80a::2004	15169 (GOOGLE) (GOOGLE)
1	2001:4998:1c:... 2001:4998:1c:800::1001	14779 (YAHOO) (YAHOO)
2	2a03:2880:f01... 2a03:2880:f012:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
1	146.75.36.157 146.75.36.157	54113 (FASTLY) (FASTLY)
1	3.168.97.94 3.168.97.94	16509 (AMAZON-02) (AMAZON-02)
1	38.70.189.70 38.70.189.70	399647 (RUMBLE) (RUMBLE)
4 5	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
1 1	69.173.151.100 69.173.151.100	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	68.67.181.103 68.67.181.103	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	142.250.72.98 142.250.72.98	15169 (GOOGLE) (GOOGLE)
1 2	104.18.26.193 104.18.26.193	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2001:4860:480... 2001:4860:4802:32::178	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c09::9b	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f112:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	162.159.140.229 162.159.140.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1	52.72.192.139 52.72.192.139	14618 (AMAZON-AES) (AMAZON-AES)
57	23

11 2606:4700::6813:d359 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

secure.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.168.102.4 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-168-102-4.jfk52.r.cloudfront.net

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:817::200a (United States)

ASN15169 (GOOGLE, US)

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:26fa:fe00:0:7d26:ee00:93a1 (United States)

ASN16509 (AMAZON-02, US)

d35ligi1n5bgzc.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5049 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:817::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 151.101.64.176 (San Francisco, United States)

ASN54113 (FASTLY, US)

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:d459 (United States)

ASN13335 (CLOUDFLARENET, US)

app.revv.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80a::2004 (United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4998:1c:800::1001 (United States)

ASN14779 (YAHOO, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:8:face:b00c:0:1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.36.157 (Reston, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.168.97.94 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-168-97-94.jfk52.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 38.70.189.70 (Toronto, Canada)

ASN399647 (RUMBLE, US)

a.ads.rmbl.ws	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.33.220.150 (Seattle, United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.151.100 (United States) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.181.103 (North Bergen, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.72.98 (Plainview, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s32-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.26.193 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2001:4860:4802:32::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c09::9b (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f112:83:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.159.140.229 (None, )

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.72.192.139 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-72-192-139.compute-1.amazonaws.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	winred.com 1 redirects secure.winred.com — Cisco Umbrella Rank: 93759 gtm.winred.com Failed	211 KB
10	stripe.com js.stripe.com — Cisco Umbrella Rank: 1073	182 KB
6	adsrvr.org 4 redirects js.adsrvr.org — Cisco Umbrella Rank: 1531 insight.adsrvr.org — Cisco Umbrella Rank: 960 match.adsrvr.org — Cisco Umbrella Rank: 377	9 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	475 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 36	22 KB
4	cloudfront.net d35ligi1n5bgzc.cloudfront.net	3 MB
4	googleapis.com maps.googleapis.com — Cisco Umbrella Rank: 466	238 KB
3	doubleclick.net 2 redirects cm.g.doubleclick.net — Cisco Umbrella Rank: 284 stats.g.doubleclick.net — Cisco Umbrella Rank: 135	2 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 120	215 B
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 607	1 KB
2	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 281	2 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 192	77 KB
1	yahoo.com sp.analytics.yahoo.com — Cisco Umbrella Rank: 1654	676 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 991	726 B
1	t.co t.co — Cisco Umbrella Rank: 904	630 B
1	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 419	1 KB
1	rmbl.ws a.ads.rmbl.ws — Cisco Umbrella Rank: 23480	2 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 1016	16 KB
1	yimg.com s.yimg.com — Cisco Umbrella Rank: 768	7 KB
1	google.com www.google.com — Cisco Umbrella Rank: 3
1	revv.co app.revv.co — Cisco Umbrella Rank: 362909	1 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 617	7 KB
57	22

	Domain	Requested by
11	secure.winred.com	1 redirects secure.winred.com static.cloudflareinsights.com
10	js.stripe.com	secure.winred.com js.stripe.com
5	www.googletagmanager.com	secure.winred.com www.googletagmanager.com
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com secure.winred.com
4	d35ligi1n5bgzc.cloudfront.net	secure.winred.com
4	maps.googleapis.com	secure.winred.com maps.googleapis.com
3	match.adsrvr.org	3 redirects
2	www.facebook.com	secure.winred.com
2	dsum-sec.casalemedia.com	1 redirects secure.winred.com
2	cm.g.doubleclick.net	2 redirects
2	ib.adnxs.com	2 redirects
2	insight.adsrvr.org	1 redirects js.adsrvr.org
2	connect.facebook.net	secure.winred.com connect.facebook.net
1	sp.analytics.yahoo.com	secure.winred.com
1	analytics.twitter.com	secure.winred.com
1	t.co	secure.winred.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	pixel.rubiconproject.com	1 redirects
1	a.ads.rmbl.ws	www.googletagmanager.com
1	js.adsrvr.org	www.googletagmanager.com
1	static.ads-twitter.com	secure.winred.com
1	s.yimg.com	secure.winred.com s.yimg.com
1	www.google.com	www.googletagmanager.com
1	app.revv.co	secure.winred.com
1	static.cloudflareinsights.com	secure.winred.com
0	gtm.winred.com Failed	www.googletagmanager.com
57	26

This site contains links to these domains. Also see Links.

Domain
winred.com
bit.ly
www.nrsc.org

Subject Issuer	Validity	Valid
secure.winred.com WE1	`2024-11-21` - `2025-02-19`	3 months	crt.sh
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA	`2024-12-16` - `2025-04-03`	4 months	crt.sh
upload.video.google.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2024-07-30` - `2025-07-03`	a year	crt.sh
cloudflareinsights.com WE1	`2024-11-01` - `2025-01-30`	3 months	crt.sh
*.google-analytics.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
revv.co WE1	`2024-10-31` - `2025-01-29`	3 months	crt.sh
*.google.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.api.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2024-12-09` - `2025-01-29`	2 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-10-05` - `2025-01-03`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2024-04-23` - `2025-05-25`	a year	crt.sh
a.ads.rmbl.ws E6	`2024-12-11` - `2025-03-11`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
t.co E6	`2024-11-26` - `2025-02-24`	3 months	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-10-07` - `2025-10-06`	a year	crt.sh
*.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2024-07-30` - `2025-01-22`	6 months	crt.sh

This page contains 12 frames:

Primary Page: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227
Frame ID: 9F0C7639DE45694D7160A023E34C71A3
Requests: 45 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-with-preconnect-5f8fe069f0f25d457a465ae97c75bf56.html
Frame ID: 5FFE874E4FA38C0C581E1004A1BBAA07
Requests: 1 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-card-f368aac4cf9e919ac8dcbb7f4a4c0834.html
Frame ID: 853C28C78E0CD6AD96085F69CB118954
Requests: 1 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-with-preconnect-5f8fe069f0f25d457a465ae97c75bf56.html
Frame ID: 2CB4139F83EE48E0BAECC9C43D82F977
Requests: 1 HTTP requests in this frame

Frame: https://js.stripe.com/v3/payment-request-inner-google-pay-4c9e178fd7d3dedf3a60076092cf3ce5.html
Frame ID: 8D6960D333E3D9972A55DF896511B315
Requests: 1 HTTP requests in this frame

Frame: https://js.stripe.com/v3/payment-request-inner-browser-2844110fc082720a991c1b220231ca83.html
Frame ID: 254F631371FC1F33AF4CC9FC751D5712
Requests: 1 HTTP requests in this frame

Frame: https://secure.winred.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js
Frame ID: D97BF2B38F5860A5482486C21FFD22BE
Requests: 2 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/4cc0/sw_iframe.html?origin=https%3A%2F%2Fsecure.winred.com
Frame ID: 3CAEEAB0F16A90CAAC9025D0DEDB3B3D
Requests: 1 HTTP requests in this frame

Frame: https://js.stripe.com/v3/link-modal-inner-c7480bff66257def906dac57edb61162.html
Frame ID: 5381CFF24D22FCF4CC185D5CF8BDABC3
Requests: 1 HTTP requests in this frame

Frame: https://js.stripe.com/v3/hcaptcha-invisible-f737ecc4e6747e080a02e619e64d0932.html
Frame ID: 82F01A0508EDDF248045E02F43C646C3
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=lp1nhxa&ref=https%3A%2F%2Fsecure.winred.com%2Fnrsc%2Fcongrats-trump-card-eoy-inaugration-e-pa%2F%3Famtposition%3D4%26recurring%3Dtrue%26utm_campaign%3D20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc%26utm_content%3Dfundraising%26utm_medium%3Demail%26utm_source%3Do2m_nrsc_pa%26utm_tc%3DAFR-20241227&upid=8mv19bm&upv=1.1.0&paapi=1
Frame ID: B53E9D4120872198A52FD44557856C98
Requests: 1 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html
Frame ID: 395173867D29E04A1DE9ABB43FB79FAD
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Congratulations, President Trump!

Detected technologies

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

Stripe (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.stripe\.com

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Page Statistics

57
Requests

91 %
HTTPS

48 %
IPv6

22
Domains

26
Subdomains

23
IPs

3
Countries

4024 kB
Transfer

7205 kB
Size

42
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://winred.com/terms/donor-terms/
Title: terms of use

Search URL Search Domain Scan URL

URL: https://winred.com/privacy
Title: privacy policy

Search URL Search Domain Scan URL

URL: http://bit.ly/2Xax3XL
Title: https://action.nrsc.org/petition/mobile-messaging-terms-conditions/

Search URL Search Domain Scan URL

URL: https://www.nrsc.org/privacy-policy/
Title: https://www.nrsc.org/privacy-policy/

Search URL Search Domain Scan URL

URL: https://winred.com/
Title: Powered by

Search URL Search Domain Scan URL

URL: https://winred.com/about-our-ads/
Title: About Our Ads

Search URL Search Domain Scan URL

URL: https://winred.com/support/
Title: Questions about your charge? Go to our Support Center

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 20

https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://secure.winred.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js

Request Chain 29

https://insight.adsrvr.org/track/pxl/?adv=lp1nhxa&ct=0:fwv0le5&fmt=3&gtmcb=1246258656 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=e075f877-38fa-4893-826c-0f8b880bb4a6&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=e075f877-38fa-4893-826c-0f8b880bb4a6 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3De075f877-38fa-4893-826c-0f8b880bb4a6 HTTP 302
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=2956633057950020809&ttd_tdid=e075f877-38fa-4893-826c-0f8b880bb4a6 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ZTA3NWY4NzctMzhmYS00ODkzLTgyNmMtMGY4Yjg4MGJiNGE2&gdpr=0&gdpr_consent=&ttd_tdid=e075f877-38fa-4893-826c-0f8b880bb4a6 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm=&google_sc=&google_hm=ZTA3NWY4NzctMzhmYS00ODkzLTgyNmMtMGY4Yjg4MGJiNGE2&gdpr=0&gdpr_consent=&ttd_tdid=e075f877-38fa-4893-826c-0f8b880bb4a6&google_tc= HTTP 302
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=e075f877-38fa-4893-826c-0f8b880bb4a6&google_gid=CAESEKVfWARpJ0xexzm0CgQHX1Q&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=e075f877-38fa-4893-826c-0f8b880bb4a6&expiration=1737906346&gdpr=0&gdpr_consent= HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=e075f877-38fa-4893-826c-0f8b880bb4a6&expiration=1737906346&gdpr=0&gdpr_consent=&C=1

57 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request / Show response
secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/ 46 KB
12 KB 112ms
87ms Document
text/html 2606:4700::6813:d359
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:d359 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c6b44dfdced70486684e1e7535d08c6e855d3cd8a6f57e1a6b6af0c0f15478b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=0, private, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8f8a707eddac4319-EWR
content-encoding: br
content-type: text/html; charset=utf-8
date: Fri, 27 Dec 2024 15:45:44 GMT
priority: u=0,i
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC" cfExtPri
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-rack-cors: miss; no-origin
x-request-id: 1fcc9c2b-4419-4648-bba4-e6f39f67d1ac
x-revv-cache: Hit from Revv
x-revv-landing-page: 1
x-runtime: 0.036476
x-xss-protection: 1; mode=block

GET
H2 200 / Show response
js.stripe.com/v3/ 694 KB
181 KB 32ms
7ms Script
text/javascript 3.168.102.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.168.102.4 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-168-102-4.jfk52.r.cloudfront.net

Software

Cloudfront /

Resource Hash

49eb91ccb014544e86ffd670d8f1f1c2048d59e663c41655ad02651b0a1e302f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

content-encoding: br
etag: W/"057d0c0fbd2c6945e582717c1b7e7e73"
age: 46
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: BxlDX-eudUb3keaXFxkNx9zb4Nen4ZC7l0_7mOSjE7ar2UuVeVRYrg==
date: Fri, 27 Dec 2024 15:45:00 GMT
content-type: text/javascript; charset=utf-8
last-modified: Mon, 23 Dec 2024 22:36:46 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31556926; includeSubDomains; preload
cache-control: max-age=60
timing-allow-origin: *
via: 1.1 9d9b3f05e994245e3be7cd3dbae1ce50.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK52-P6
server: Cloudfront

GET
H3 200 landing_page-6039c7fb49af57af18c66c1f088ebc528623b4d6ac05ce2e3229ba0b335bc92b.css
secure.winred.com/assets/ 223 KB
34 KB 36ms
34ms Stylesheet
text/css 2606:4700::6813:d359
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/landing_page-6039c7fb49af57af18c66c1f088ebc528623b4d6ac05ce2e3229ba0b335bc92b.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:d359 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6039c7fb49af57af18c66c1f088ebc528623b4d6ac05ce2e3229ba0b335bc92b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"0d589e3ee739618497567fffac3f6955"
age: 4891
x-amz-version-id: I8F5HhRXCvfk04n68eSc1_WylsULBZmZ
x-content-type-options: nosniff
expires: Fri, 27 Dec 2024 19:45:44 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 27 Dec 2024 15:45:44 GMT
content-type: text/css
last-modified: Thu, 05 Dec 2024 02:03:18 GMT
vary: Accept-Encoding
priority: u=0,i=?0
x-amz-id-2: jU9QHH7rjLYapEDOcw0KlnF+1Y7y904HxLO1tv8NLkMdBOsqIdNG/3xpoAs9czJ18uV6Q0TUr2U=
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=14400
cf-ray: 8f8a707f7e3f4319-EWR
x-amz-request-id: 2YCSVD0CQ5R8CJA4
server: cloudflare

GET
H3 200 1734704236.css
secure.winred.com/stylesheets/rv_page_01jfj6vw9d88tfyaj4dnx1x94t/ 9 KB
3 KB 74ms
72ms Stylesheet
text/css 2606:4700::6813:d359
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/stylesheets/rv_page_01jfj6vw9d88tfyaj4dnx1x94t/1734704236.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:d359 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

319bd99d85091fdf6419d7218cb458ed17b59a30d4c5cad92594332c4cf0ddda

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227

Response headers

x-request-id: a1417dd2-8261-4046-b336-eaf4c9aa66dc
content-encoding: gzip
cf-cache-status: HIT
age: 92009
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
expires: Sat, 27 Dec 2025 21:34:56 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 27 Dec 2024 15:45:44 GMT
content-type: text/css; charset=utf-8
last-modified: Thu, 26 Dec 2024 14:12:15 GMT
vary: Accept-Encoding
x-runtime: 0.063418
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
priority: u=0,i=?0
cache-control: public, max-age=31556952
x-rack-cors: miss; no-origin
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8f8a707f7e424319-EWR
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 400 KB
125 KB 83ms
54ms Script
text/javascript 2607:f8b0:4006:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

22a7a737385350087375b064933835ba5addbe6a89f4edc9e63004970cd7c44a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

cache-control: public, max-age=1800, stale-while-revalidate=3600
timing-allow-origin: *
content-encoding: gzip
etag: 6f24cf04
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 127869
date: Fri, 27 Dec 2024 15:45:45 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
vary: Accept-Language, Origin, X-Origin, Referer
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN

GET
H3 200 application-landing-page-08ae498f27cd9805f52e51bcdd29c2773054affd19730fba0022227d4e89b350.js Show response
secure.winred.com/assets/ 492 KB
139 KB 38ms
37ms Script
application/javascript 2606:4700::6813:d359
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/application-landing-page-08ae498f27cd9805f52e51bcdd29c2773054affd19730fba0022227d4e89b350.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:d359 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

08ae498f27cd9805f52e51bcdd29c2773054affd19730fba0022227d4e89b350

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"2c99f844585737759d94b3e922fb1a4f"
age: 2854
x-amz-version-id: QPhc1z96ZIQQmM5vEYzRtaN7vot4gVRO
x-content-type-options: nosniff
expires: Fri, 27 Dec 2024 19:45:44 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 27 Dec 2024 15:45:44 GMT
content-type: application/javascript
last-modified: Thu, 05 Dec 2024 02:03:15 GMT
vary: Accept-Encoding
priority: u=1,i=?0
x-amz-id-2: /N7zBQBwgW8Kt9j11f/0GjByLKXTtARq0qWx3Ifkxf6tFLhNVarVHlx4LDApnq0m8nCrqMlO8XM=
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=14400
cf-ray: 8f8a707f7e444319-EWR
x-amz-request-id: 8XDMQFACQ7XE6DQZ
server: cloudflare

GET
H2 200 Generic_Surrogates_Trump-Donald_MMS_500x500_V1.png
d35ligi1n5bgzc.cloudfront.net/logos/logo_assets/000/836/324/large/ 2 MB
3 MB 30ms
6ms Image
image/png 2600:9000:26fa:fe00:0:7d26:ee00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/logos/logo_assets/000/836/324/large/Generic_Surrogates_Trump-Donald_MMS_500x500_V1.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26fa:fe00:0:7d26:ee00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e51815a6fa2b341d36e7fa22f8258b3eab5b492af53dd2a79458d70bab20750f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

x-amz-version-id: XCSPFw3su0cDpCbI5JUniF.yLSIiRcTr
etag: "cad18199807d7016b49febc03a538e71"
age: 67463
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: PrxuFt4swlij7UVa6_YIPDPqi8xIYjWqje4pIclWp1ll-wQc7IzYbA==
date: Thu, 26 Dec 2024 21:01:22 GMT
content-type: image/png
vary: accept-encoding
last-modified: Mon, 22 Jan 2024 21:05:16 GMT
via: 1.1 cd691f5232ad8151e816e4693db0dfac.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 2620151
x-amz-cf-pop: JFK52-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 default-360x250.png
d35ligi1n5bgzc.cloudfront.net/profiles/images/000/012/048/square/ 10 KB
10 KB 28ms
4ms Image
image/png 2600:9000:26fa:fe00:0:7d26:ee00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/profiles/images/000/012/048/square/default-360x250.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26fa:fe00:0:7d26:ee00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f38456ec82ed63fda4f038cb5f6cf4afcb11b28825242c0b1a1000a6b35bea23

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

x-amz-version-id: g3HO94iOuW2BZonuVejzoTFgWKG9BruR
etag: "4d1514e7a61275dc48eb6284c6215857"
age: 85527
via: 1.1 cd691f5232ad8151e816e4693db0dfac.cloudfront.net (CloudFront)
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
content-length: 9912
x-amz-cf-id: qrIewwCtEvMhmusnwsfUw6sijkDuRGXzp5CvD1tRIvGWDhfnD5c8cw==
date: Thu, 26 Dec 2024 16:00:18 GMT
content-type: image/png
last-modified: Sat, 17 Jul 2021 18:30:35 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P1
x-amz-server-side-encryption: AES256

GET
H3 200 win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.png
secure.winred.com/assets/ 9 KB
9 KB 56ms
54ms Image
image/webp 2606:4700::6813:d359
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:d359 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36f0bf882a876b13aeb20cf7a495421a43f336da5422072a58f58ce303fb6284

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227

Response headers

cf-cache-status: HIT
etag: "972c0cca8d1e490484e89513f902e847"
age: 5173
cf-bgj: imgq:85,h2pri
x-amz-version-id: dXIH3dEWJ3Rui7mgD_aBNL2LpLuJ4a.5
x-content-type-options: nosniff
expires: Fri, 27 Dec 2024 19:45:44 GMT
cf-polished: origFmt=png, origSize=11635
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 27 Dec 2024 15:45:44 GMT
content-type: image/webp
content-disposition: inline; filename="win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.webp"
vary: Accept, Accept-Encoding
last-modified: Sat, 02 Nov 2024 01:19:14 GMT
x-amz-id-2: Qc/om/6ucOCQJq9OkRiL9wprdNLcy/GtEd4zpgOom/dwjGJBtzG+YpKco+dGYGd9DZEkAS5qkBc=
strict-transport-security: max-age=15552000; includeSubDomains
priority: u=2,i
cache-control: public, max-age=14400
cf-ray: 8f8a707fbe8a4319-EWR
x-amz-request-id: S4GW51Q4HGVD8ZB4
accept-ranges: bytes
content-length: 8708
server: cloudflare

GET
H3 200 win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg
secure.winred.com/assets/ 19 KB
7 KB 32ms
31ms Image
image/svg+xml 2606:4700::6813:d359
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:d359 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"d31530d4186af669daf4f47099614593"
age: 1201
x-amz-version-id: f4pEcXiD8ytcKkhv6Jg8V_T5YyE04Z7F
x-content-type-options: nosniff
expires: Fri, 27 Dec 2024 19:45:45 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 27 Dec 2024 15:45:45 GMT
content-type: image/svg+xml
last-modified: Sat, 02 Nov 2024 01:19:14 GMT
vary: Accept-Encoding
priority: u=2,i
x-amz-id-2: B99TwqMGudqXCstazdYQewOJec5xKI4AmMqrNKVjqV67yseCs58odeh35rYyU2vMChkyj7ZbVfE=
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=14400
cf-ray: 8f8a70803f2e4319-EWR
x-amz-request-id: C32CQT6C5N2QCJ93
server: cloudflare

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 37ms
20ms Script
text/javascript 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://secure.winred.com
Referer: https://secure.winred.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 8f8a7080b81642db-EWR
access-control-allow-origin: *
date: Fri, 27 Dec 2024 15:45:45 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 512 KB
120 KB 69ms
35ms Script
application/javascript 2607:f8b0:4006:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

58b8018304ed799ead35ff3094477c78bc668237cae8edc287616368286748d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

content-encoding: gzip
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Fri, 27 Dec 2024 15:45:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 27 Dec 2024 15:45:45 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 27 Dec 2024 15:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 123086
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 353 KB
118 KB 63ms
29ms Script
application/javascript 2607:f8b0:4006:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-52RXXMH

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9cae0d7093951805aaeb04b8598d95dc02f1334d748f99a10081c49258cb5d61

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Fri, 27 Dec 2024 15:45:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 27 Dec 2024 15:45:45 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 27 Dec 2024 15:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 119958
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 Gold-Card_WR-Background.jpg
d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/596/818/large/ 202 KB
203 KB 9ms
7ms Image
image/jpeg 2600:9000:26fa:fe00:0:7d26:ee00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/596/818/large/Gold-Card_WR-Background.jpg
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/stylesheets/rv_page_01jfj6vw9d88tfyaj4dnx1x94t/1734704236.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26fa:fe00:0:7d26:ee00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 83d0f78290d4be7bedcd76b4396f52bcfd8a583317de74ebea3252639b526d87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

x-amz-version-id: aRhAEyIBBTaLoMoySI4XIV0T3VsEqDbS
etag: "3f8d969e54be115d7a9653b5e6338263"
age: 33872
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: uawHSVXkjEHrOlIU_3Pb_xqApR-fNu8X8Avl0IR9XRsiT57YKpjuqw==
date: Fri, 27 Dec 2024 06:21:14 GMT
content-type: image/jpeg
vary: accept-encoding
last-modified: Tue, 04 Apr 2023 16:44:22 GMT
via: 1.1 cd691f5232ad8151e816e4693db0dfac.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 207021
x-amz-cf-pop: JFK52-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 icon-dropdown-background-52b35865280d33e30f9708871085b8db6862e75bc159d6e8e3cd77af6c36bdde.png
secure.winred.com/assets/ 290 B
864 B 44ms
44ms Image
image/webp 2606:4700::6813:d359
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/icon-dropdown-background-52b35865280d33e30f9708871085b8db6862e75bc159d6e8e3cd77af6c36bdde.png

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/landing_page-6039c7fb49af57af18c66c1f088ebc528623b4d6ac05ce2e3229ba0b335bc92b.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:d359 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

96b04ef160f8b50520a48707a452fecdd6e6771c643706d5949020a2dea15962

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/assets/landing_page-6039c7fb49af57af18c66c1f088ebc528623b4d6ac05ce2e3229ba0b335bc92b.css

Response headers

cf-cache-status: HIT
etag: "571ee659b7ee9af9291e7dd8176721d5"
age: 904
cf-bgj: imgq:85,h2pri
x-amz-version-id: oyZd8M9jF3T.Weca10NPhqBiTm_aALG2
x-content-type-options: nosniff
expires: Fri, 27 Dec 2024 19:45:45 GMT
cf-polished: origFmt=png, origSize=560
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 27 Dec 2024 15:45:45 GMT
content-type: image/webp
content-disposition: inline; filename="icon-dropdown-background-52b35865280d33e30f9708871085b8db6862e75bc159d6e8e3cd77af6c36bdde.webp"
vary: Accept, Accept-Encoding
last-modified: Thu, 05 Dec 2024 02:03:17 GMT
x-amz-id-2: fWbf6p/CiM992CNCyGe1WhvbPpBcucv3HhqYo44j9ASGAncsAHSxVhUFRNYDyfs/uTl2Klsgj74=
strict-transport-security: max-age=15552000; includeSubDomains
priority: u=3,i
cache-control: public, max-age=14400
cf-ray: 8f8a7080cfe74319-EWR
x-amz-request-id: S5N25M3DX1JDWRYZ
accept-ranges: bytes
content-length: 290
server: cloudflare

GET
H2 200 controller-with-preconnect-5f8fe069f0f25d457a465ae97c75bf56.html
js.stripe.com/v3/ Frame 5FFE 0
0 19ms
4ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/controller-with-preconnect-5f8fe069f0f25d457a465ae97c75bf56.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 56
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=60, stale-while-revalidate=900
content-encoding: br
content-length: 403
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Fri, 27 Dec 2024 15:45:45 GMT
etag: "5f8fe069f0f25d457a465ae97c75bf56"
last-modified: Mon, 23 Dec 2024 21:44:29 GMT
origin-agent-cluster: ?1
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 14
x-content-type-options: nosniff
x-request-id: 1a69bedc-6c89-45a2-9096-9f65ae98a02c
x-served-by: cache-lga21951-LGA

GET
H2 200 elements-inner-card-f368aac4cf9e919ac8dcbb7f4a4c0834.html
js.stripe.com/v3/ Frame 853C 0
0 8ms
3ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-card-f368aac4cf9e919ac8dcbb7f4a4c0834.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com https://files.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 323676
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=31536000
content-encoding: br
content-length: 512
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com https://files.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Fri, 27 Dec 2024 15:45:45 GMT
etag: "f368aac4cf9e919ac8dcbb7f4a4c0834"
last-modified: Mon, 23 Dec 2024 21:44:29 GMT
origin-agent-cluster: ?1
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 6407
x-content-type-options: nosniff
x-request-id: 0f71ec58-0886-411d-83aa-6d886441e87a
x-served-by: cache-lga21951-LGA

GET
H3 200 current_with_info Show response
app.revv.co/api/v3/users/ 162 B
1 KB 127ms
96ms XHR
application/vnd.api+json 2606:4700::6813:d459
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.revv.co/api/v3/users/current_with_info?organization_token=rv_org_6KNvU36Z2qWJ2gfUBWqGZGoc&redirect=https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-08ae498f27cd9805f52e51bcdd29c2773054affd19730fba0022227d4e89b350.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ad9d96dc918ac14513bac95cfa66367ea9a9c2ece1102cb1dd5ef384f778a1da

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.winred.com/

Response headers

access-control-max-age: 0
x-request-id: 97b43e37-c5ae-4fb2-90f2-bf558c955133
access-control-expose-headers
content-encoding: br
cf-cache-status: DYNAMIC
etag: W/"ad9d96dc918ac14513bac95cfa66367e"
access-control-allow-methods: GET, POST, OPTIONS
x-content-type-options: nosniff
x-rack-cors-original-access-control-max-age: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 27 Dec 2024 15:45:45 GMT
content-type: application/vnd.api+json
vary: Origin, Accept-Encoding
x-runtime: 0.010140
priority: u=1,i
x-rack-cors-original-access-control-allow-origin: https://secure.winred.com
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: max-age=0, private, must-revalidate
x-rack-cors: hit
access-control-allow-credentials: true
x-rack-cors-original-access-control-expose-headers
cf-ray: 8f8a7081c95a0f98-EWR
x-rack-cors-original-access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://secure.winred.com
x-rack-cors-original-access-control-allow-credentials: true
server: cloudflare

GET
H2 200 controller-with-preconnect-5f8fe069f0f25d457a465ae97c75bf56.html
js.stripe.com/v3/ Frame 2CB4 0
0 6ms
6ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/controller-with-preconnect-5f8fe069f0f25d457a465ae97c75bf56.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

Security Headers

Name

Value

Content-Security-Policy

base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report

X-Content-Type-Options

nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 56
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=60, stale-while-revalidate=900
content-encoding: br
content-length: 403
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Fri, 27 Dec 2024 15:45:45 GMT
etag: "5f8fe069f0f25d457a465ae97c75bf56"
last-modified: Mon, 23 Dec 2024 21:44:29 GMT
origin-agent-cluster: ?1
server: Fastly
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 14
x-content-type-options: nosniff
x-request-id: 1a69bedc-6c89-45a2-9096-9f65ae98a02c
x-served-by: cache-lga21951-LGA

GET
H3 200 payment-request-inner-google-pay-4c9e178fd7d3dedf3a60076092cf3ce5.html
js.stripe.com/v3/ Frame 8D69 0
0 22ms
17ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/payment-request-inner-google-pay-4c9e178fd7d3dedf3a60076092cf3ce5.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.64.176 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'none'; form-action 'none'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; script-src 'self' https://pay.google.com; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 323379
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=31536000
content-encoding: br
content-length: 181
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'none'; form-action 'none'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; script-src 'self' https://pay.google.com; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'none'; form-action 'none'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; script-src 'self' https://pay.google.com; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Fri, 27 Dec 2024 15:45:45 GMT
etag: "4c9e178fd7d3dedf3a60076092cf3ce5"
last-modified: Mon, 23 Dec 2024 21:44:42 GMT
origin-agent-cluster: ?1
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 1907
x-content-type-options: nosniff
x-request-id: b9c076d9-4aef-4a17-b9d0-117ec5e57494
x-served-by: cache-lga21982-LGA

GET
H3 200 payment-request-inner-browser-2844110fc082720a991c1b220231ca83.html
js.stripe.com/v3/ Frame 254F 0
0 20ms
18ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/payment-request-inner-browser-2844110fc082720a991c1b220231ca83.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.64.176 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 60
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=60, stale-while-revalidate=900
content-encoding: br
content-length: 160
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Fri, 27 Dec 2024 15:45:45 GMT
etag: "2844110fc082720a991c1b220231ca83"
last-modified: Mon, 23 Dec 2024 21:44:42 GMT
origin-agent-cluster: ?1
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 2
x-content-type-options: nosniff
x-request-id: 45524621-fcb0-4603-a387-6128c6550a1b
x-served-by: cache-lga21982-LGA

GET
H3

200

main.js Show response
secure.winred.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/ Frame D97B
Redirect Chain

https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://secure.winred.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?

9 KB
4 KB

36ms
35ms

Script
application/javascript

2606:4700::6813:d359
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?

Requested by

Protocol

Server

2606:4700::6813:d359 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3f9ee71a6162e6c931991b506168be93fe968648cdb0f9eb1d8abc6acafc5b72

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding: br
x-content-type-options: nosniff
cf-ray: 8f8a7082fa4b4319-EWR
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 27 Dec 2024 15:45:45 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

Redirect headers

strict-transport-security: max-age=15552000; includeSubDomains
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?
x-content-type-options: nosniff
cf-ray: 8f8a7081d91c4319-EWR
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfExtPri
date: Fri, 27 Dec 2024 15:45:45 GMT
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
44 B 174ms
58ms XHR
application/json 2607:f8b0:4006:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
content-encoding: gzip
x-content-type-options: nosniff
access-control-allow-origin: https://secure.winred.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
date: Fri, 27 Dec 2024 15:45:45 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
vary: Origin, X-Origin, Referer
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN

POST
H3 200 collect
www.google.com/ccm/ 0
0 145ms
46ms Ping
text/plain 2607:f8b0:4006:80a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fsecure.winred.com%2Fnrsc%2Fcongrats-trump-card-eoy-inaugration-e-pa%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=500386771.1735314345&dt=Congratulations%2C%20President%20Trump!&auid=783287459.1735314345&navt=n&npa=0&gtm=45He4cc1v76254334za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1735314345368&tfd=617&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52RXXMH
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80a::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 325 KB
108 KB 54ms
53ms Script
application/javascript 2607:f8b0:4006:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-7NKV2JR6LG&l=dataLayer&cx=c&gtm=45He4cc1v76254334za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52RXXMH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ac04576455cd9fc8163f673956a29073602b7d500e7d0a5b602815ed5508846f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 27 Dec 2024 15:45:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 27 Dec 2024 15:45:45 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 110143
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 19 KB
7 KB 177ms
20ms Script
application/javascript 2001:4998:1c:800::1001
YAHOO

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:1c:800::1001 , United States, ASN14779 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

aebe8df81ee2ba5bc51e3abc322910ee5122a0ac06edfbcf7a04e1659d17dc9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

content-encoding: gzip
etag: "bc033c3a83e1880e480086bf11ac0b0a-df"
x-amz-version-id: 5HsDWpm4ZbPfEUvUg7HPM8RCfDfmGF6v
age: 3013
date: Fri, 27 Dec 2024 14:55:33 GMT
last-modified: Tue, 10 Dec 2024 07:07:30 GMT
vary: Origin, Accept-Encoding
x-amz-expiration: expiry-date="Thu, 15 Jan 2026 00:00:00 GMT", rule-id="standard-lifecycle"
content-type: application/javascript
x-amz-id-2: BWxgkbLpYgsdvyItufq2XaZEvmhJ4SSO/cYnHYku/2vStpZF3MGsCRDNwzsDCoA4XxXA/RQI7PkKMkHzhndd9GCgVRIo2s1j
strict-transport-security: max-age=31536000
x-amz-replication-status: REPLICA
ats-carp-promotion: 1, 1
referrer-policy: no-referrer-when-downgrade
x-amz-request-id: 7RYG1W5KDYXM1HG8
accept-ranges: bytes
content-length: 6826
server: ATS
x-amz-server-side-encryption: AES256

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 239 KB
61 KB 105ms
33ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

24751cbae618f6fbeb532498fd1ceeda5350f30085086cd5426961a2695e3d9f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'nonce-wrIh5plE' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 27 Dec 2024 15:45:45 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'nonce-wrIh5plE' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=21, rtx=0, c=23, mss=1232, tbw=4511, tp=9, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: oBSIBiX/kaqOl0VVTi60IYp15V4SJrWPjFmNN3AxRkczKTdKPb2mqrJSCiSkwIC4s727MkSUFxKzPpyPRA1DlQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 62282
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 57 KB
16 KB 410ms
44ms Script
application/javascript 146.75.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.36.157 Reston, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "4328e910de583ad53b3a7a76455af005+gzip"
accept-ranges: bytes
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 15926
date: Fri, 27 Dec 2024 15:45:45 GMT
x-tw-cdn: FT
last-modified: Tue, 29 Oct 2024 01:22:31 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kcgs7200152-IAD
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 15 KB
6 KB 121ms
36ms Script
application/javascript 3.168.97.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52RXXMH
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.97.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-97-94.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bb19cc9bb9e4e0f0237ee1f0c213487452c77e6f9fa6fa9edcb87f4de9f0c21a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

Transfer-Encoding: chunked
Vary: accept-encoding
Content-Encoding: gzip
ETag: W/"dd635a85604f92ec6b3a600d010dd4e3"
Age: 76532
Connection: keep-alive
Via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: CXHVoxnKwvgEF-Yskuj4m40st6GND8fxHyeK5v9HCjXHFKPapgQz3Q==
Date: Thu, 26 Dec 2024 18:30:14 GMT
Content-Type: application/javascript
Last-Modified: Tue, 24 Dec 2024 03:22:51 GMT
Server: AmazonS3
X-Amz-Cf-Pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 ratag Show response
a.ads.rmbl.ws/ 3 KB
2 KB 493ms
52ms Script
application/javascript 38.70.189.70
RUMBLE

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ads.rmbl.ws/ratag?id=AV-27906
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52RXXMH
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.70.189.70 Toronto, Canada, ASN399647 (RUMBLE, US),
Reverse DNS
Software: nginx /
Resource Hash: 706e4b2b1a0b48a95a2468ed5bbd10ea6cb9874aff64afd280e979c2f141cb0e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

cache-control: public, max-age=3600
content-encoding: gzip
etag: W/"b467be32e4974b38f38aeb3d9a695138"
access-control-allow-credentials: true
access-control-allow-origin: *
date: Fri, 27 Dec 2024 15:45:45 GMT
content-type: application/javascript; charset=UTF-8
server: nginx

GET
H2

200

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://insight.adsrvr.org/track/pxl/?adv=lp1nhxa&ct=0:fwv0le5&fmt=3&gtmcb=1246258656
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=e075f877-38fa-4893-826c-0f8b880bb4a6&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=e075f877-38fa-4893-826c-0f8b880bb4a6
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3De075f877-38fa-4893-826c-0f8b880bb4a6
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=2956633057950020809&ttd_tdid=e075f877-38fa-4893-826c-0f8b880bb4a6
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ZTA3NWY4NzctMzhmYS00ODkzLTgyNmMtMGY4Yjg4MGJiNGE2&gdpr=0&gdpr_consent=&ttd_tdid=e075f877-38fa-4893-826c-0f8b8...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm=&google_sc=&google_hm=ZTA3NWY4NzctMzhmYS00ODkzLTgyNmMtMGY4Yjg4MGJiNGE2&gdpr=0&gdpr_consent=&ttd_tdid=e075f877-38fa-4893-826c-0f8...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=e075f877-38fa-4893-826c-0f8b880bb4a6&google_gid=CAESEKVfWARpJ0xexzm0CgQHX1Q&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=e075f877-38fa-4893-826c-0f8b880bb4a6&expiration=1737906346&gdpr=0&gdpr_consent=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=e075f877-38fa-4893-826c-0f8b880bb4a6&expiration=1737906346&gdpr=0&gdpr_consent=&C=1

43 B
341 B

24ms
23ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=e075f877-38fa-4893-826c-0f8b880bb4a6&expiration=1737906346&gdpr=0&gdpr_consent=&C=1
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227
Protocol: H2
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1VOSLxCT21H35Ln9Ma5DEOediFyUO80cfHCmZ%2BoXdmG4A8dfFVFDLXW2zZTic2vQrFDT1G6nLWzc5SF15RN2eYYkb3k2mHrIkT%2F%2FTf%2BcmPQWGS2pRit1LExo%2FZo0ByLULBuLv%2FHDoB84Jg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8f8a70872929424c-EWR
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 27 Dec 2024 15:45:46 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache
location: /rum?cm_dsp_id=39&external_user_id=e075f877-38fa-4893-826c-0f8b880bb4a6&expiration=1737906346&gdpr=0&gdpr_consent=&C=1
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zBUOd%2Bv52S2AvEKCBXuTUD0d6sQNJeINjvaexn9JarSnmWh1%2F%2BDJOVau3adgJcyTi0RKIshgstLBq3FNPPmG08OBGzSfhXEVz9KYBxDpJYV5rMnCTIkxCbC0dDKOCOAAiG8dVLwBdBnxrQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8f8a7086f8dd424c-EWR
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 27 Dec 2024 15:45:46 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 395 KB
129 KB 104ms
103ms Script
application/javascript 2607:f8b0:4006:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c&gtm=45He4cc1v72410129za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e9dd00e1a9b646ffc5cf2032ba83240597539bd7cc1273de9f66cbb96f83b388

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 27 Dec 2024 15:45:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 27 Dec 2024 15:45:45 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 131996
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 98ms
27ms Script
text/javascript 2001:4860:4802:32::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

content-encoding: gzip
age: 4324
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Fri, 27 Dec 2024 16:33:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 27 Dec 2024 14:33:41 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

GET
H2 200 sw_iframe.html
www.googletagmanager.com/static/service_worker/4cc0/ Frame 3CAE 0
0 108ms
17ms Document
text/html 2607:f8b0:4006:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/4cc0/sw_iframe.html?origin=https%3A%2F%2Fsecure.winred.com

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-52RXXMH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 82220
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1476
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Thu, 26 Dec 2024 16:55:25 GMT
expires: Fri, 26 Dec 2025 16:55:25 GMT
last-modified: Thu, 12 Dec 2024 10:18:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 link-modal-inner-c7480bff66257def906dac57edb61162.html
js.stripe.com/v3/ Frame 5381 0
0 29ms
28ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/link-modal-inner-c7480bff66257def906dac57edb61162.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.64.176 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://r.stripe.com https://errors.stripe.com https://api.stripe.com https://merchant-ui-api.stripe.com; default-src 'self'; form-action 'none'; frame-src 'self' https://b.stripecdn.com https://checkout.link.com; img-src 'self' https://js.stripe.com https://q.stripe.com https://b.stripecdn.com; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 23
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=60, stale-while-revalidate=900
content-encoding: br
content-length: 454
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com https://errors.stripe.com https://api.stripe.com https://merchant-ui-api.stripe.com; default-src 'self'; form-action 'none'; frame-src 'self' https://b.stripecdn.com https://checkout.link.com; img-src 'self' https://js.stripe.com https://q.stripe.com https://b.stripecdn.com; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com https://errors.stripe.com https://api.stripe.com https://merchant-ui-api.stripe.com; default-src 'self'; form-action 'none'; frame-src 'self' https://b.stripecdn.com https://checkout.link.com; img-src 'self' https://js.stripe.com https://q.stripe.com https://b.stripecdn.com; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Fri, 27 Dec 2024 15:45:45 GMT
etag: "c7480bff66257def906dac57edb61162"
last-modified: Mon, 23 Dec 2024 21:44:42 GMT
origin-agent-cluster: ?1
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 4
x-content-type-options: nosniff
x-request-id: b73cfceb-0404-492c-ab4b-71f95baa6804
x-served-by: cache-lga21982-LGA

POST
H3 200 8f8a707eddac4319 Show response
secure.winred.com/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame D97B 0
732 B 45ms
39ms XHR
text/plain 2606:4700::6813:d359
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/challenge-platform/h/b/jsd/r/8f8a707eddac4319

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:d359 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
cf-ray: 8f8a70841b824319-EWR
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Fri, 27 Dec 2024 15:45:45 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare
priority: u=1,i

GET
H3 200 1880682728958632 Show response
connect.facebook.net/signals/config/ 84 KB
16 KB 39ms
38ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1880682728958632?v=2.9.179&r=stable&domain=secure.winred.com&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d626ec9117b8923f58e8bf71f19065c7684c4b0b096606546f4ba90be7f2a433

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'nonce-mXl5zFL3' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 27 Dec 2024 15:45:45 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'nonce-mXl5zFL3' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=26, rtx=0, c=77, mss=1232, tbw=71293, tp=67, tpl=0, uplat=7, ullat=-1
pragma: public
x-fb-debug: V5ggHEXQ9rD7mnEJ38P7hqG+rsQe0mLfmsesn2BDfYWyOfKmX2UM/U/37lVVR7ABdQJA2xfkuRtCHcvzC+ZDZQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 16750
x-xss-protection: 0
origin-agent-cluster: ?1

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
360 B 60ms
53ms XHR
text/plain 2001:4860:4802:32::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=822289336&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fnrsc%2Fcongrats-trump-card-eoy-inaugration-e-pa%2F%3Famtposition%3D4%26recurring%3Dtrue%26utm_campaign%3D20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc%26utm_content%3Dfundraising%26utm_medium%3Demail%26utm_source%3Do2m_nrsc_pa%26utm_tc%3DAFR-20241227&ul=en-us&de=UTF-8&dt=Congratulations%2C%20President%20Trump!&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAiEABBAAAACAEK~&jid=226951235&gjid=1888801250&cid=2027745546.1735314346&tid=UA-73658561-7&_gid=364445222.1735314346&_slc=1&gtm=45He4cc1n71NTQZ9Nv72410129za200&cd61=https%3A%2F%2Fsecure.winred.com%2Fnrsc%2Fcongrats-trump-card-eoy-inaugration-e-pa%2F%3Famtposition%3D4%26recurring%3Dtrue%26utm_campaign%3D20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc%26utm_content%3Dfundraising%26utm_medium%3Demail%26utm_source%3Do2m_nrsc_pa%26utm_tc%3DAFR-20241227&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&z=699892126

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://secure.winred.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 27 Dec 2024 15:45:45 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://secure.winred.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 3
server: Golfe2

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
647 B 147ms
52ms XHR
text/plain 2607:f8b0:4004:c09::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-73658561-7&cid=2027745546.1735314346&jid=226951235&gjid=1888801250&_gid=364445222.1735314346&_u=YGBAiEABBAAAAGAEK~&z=2013868809

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://secure.winred.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgdc:149:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 27 Dec 2024 15:45:45 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgdc:149:0
access-control-allow-origin: https://secure.winred.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 1
server: Golfe2

GET
H2 200 collect
www.google-analytics.com/ 35 B
407 B 36ms
35ms Image
image/gif 2001:4860:4802:32::178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=822289336&t=event&ni=0&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fnrsc%2Fcongrats-trump-card-eoy-inaugration-e-pa%2F%3Famtposition%3D4%26recurring%3Dtrue%26utm_campaign%3D20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc%26utm_content%3Dfundraising%26utm_medium%3Demail%26utm_source%3Do2m_nrsc_pa%26utm_tc%3DAFR-20241227&ul=en-us&de=UTF-8&dt=Congratulations%2C%20President%20Trump!&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=donation%20landing%20page&ea=user%20session%20start&el=landing%20page%20settings&_u=YGDAiEABBAAAAGAEK~&jid=&gjid=&cid=2027745546.1735314346&tid=UA-73658561-7&_gid=364445222.1735314346&gtm=45He4cc1n71NTQZ9Nv72410129za200&cd41=anonymous&cd58=t&cd61=https%3A%2F%2Fsecure.winred.com%2Fnrsc%2Fcongrats-trump-card-eoy-inaugration-e-pa%2F%3Famtposition%3D4%26recurring%3Dtrue%26utm_campaign%3D20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc%26utm_content%3Dfundraising%26utm_medium%3Demail%26utm_source%3Do2m_nrsc_pa%26utm_tc%3DAFR-20241227&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&z=1402686202

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

age: 68232
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],}
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 20:48:33 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 35
server: Golfe2

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 58ms
58ms Fetch
text/plain 2001:4860:4802:32::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-7NKV2JR6LG&gtm=45je4cc1v9116154046z876254334za200zb76254334&_p=1735314344895&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=2027745546.1735314346&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1735314345&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fnrsc%2Fcongrats-trump-card-eoy-inaugration-e-pa%2F%3Famtposition%3D4%26recurring%3Dtrue%26utm_campaign%3D20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc%26utm_content%3Dfundraising%26utm_medium%3Demail%26utm_source%3Do2m_nrsc_pa%26utm_tc%3DAFR-20241227&dt=Congratulations%2C%20President%20Trump!&en=page_view&_fv=1&_ss=1&tfd=951
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-7NKV2JR6LG&l=dataLayer&cx=c&gtm=45He4cc1v76254334za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://secure.winred.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 27 Dec 2024 15:45:45 GMT
content-type: text/plain
server: Golfe2

GET collect
gtm.winred.com/g/ 0
0

GET 10099393.json
s.yimg.com/wi/config/ 0
0

GET
H3 200 /
www.facebook.com/tr/ 0
16 B 41ms
14ms Image
text/plain 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1880682728958632&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Fnrsc%2Fcongrats-trump-card-eoy-inaugration-e-pa%2F%3Famtposition%3D4%26recurring%3Dtrue%26utm_campaign%3D20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc%26utm_content%3Dfundraising%26utm_medium%3Demail%26utm_source%3Do2m_nrsc_pa%26utm_tc%3DAFR-20241227&rl=&if=false&ts=1735314345791&sw=1600&sh=1200&v=2.9.179&r=stable&ec=0&o=4126&fbp=fb.1.1735314345788.49396222965581039&cs_est=true&ler=empty&cdl=API_unavailable&it=1735314345640&coo=false&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-asan /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=23, mss=1232, tbw=4555, tp=10, tpl=0, uplat=2, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Fri, 27 Dec 2024 15:45:45 GMT
content-type: text/plain
server: proxygen-asan
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
199 B 142ms
115ms Image
image/png 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1880682728958632&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Fnrsc%2Fcongrats-trump-card-eoy-inaugration-e-pa%2F%3Famtposition%3D4%26recurring%3Dtrue%26utm_campaign%3D20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc%26utm_content%3Dfundraising%26utm_medium%3Demail%26utm_source%3Do2m_nrsc_pa%26utm_tc%3DAFR-20241227&rl=&if=false&ts=1735314345791&sw=1600&sh=1200&v=2.9.179&r=stable&ec=0&o=4126&fbp=fb.1.1735314345788.49396222965581039&cs_est=true&ler=empty&cdl=API_unavailable&it=1735314345640&coo=false&rqm=FGET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7453118360799649428"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7453118360799649428"}],"group":"network-errors"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 27 Dec 2024 15:45:45 GMT
content-type: image/png
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7453118360799649428", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01}
cache-control: private, no-store, no-cache, must-revalidate
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=23, mss=1232, tbw=4923, tp=13, tpl=0, uplat=103, ullat=0
pragma: no-cache
x-fb-debug: F1Z2zGanZYmhtpCGXHKLxgoHmjz0Az9sK/4lbRtUDMkgBqnj1I5DE1Esjp5lkeajc57ofSfPQWY3f0Z6CLs5Yg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 hcaptcha-invisible-f737ecc4e6747e080a02e619e64d0932.html
js.stripe.com/v3/ Frame 82F0 0
0 12ms
11ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/hcaptcha-invisible-f737ecc4e6747e080a02e619e64d0932.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.64.176 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://errors.stripe.com https://r.stripe.com; default-src 'self'; form-action 'none'; frame-src 'self' https://b.stripecdn.com; img-src 'self' https://q.stripe.com; object-src 'none'; script-src 'self' 'sha256-e+0+bM5staBTB7IQqo+ZXQFkFrOYh8ySEkD0TeZCWCs='; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 323701
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=31536000
content-encoding: br
content-length: 24128
content-security-policy: base-uri 'none'; connect-src 'self' https://errors.stripe.com https://r.stripe.com; default-src 'self'; form-action 'none'; frame-src 'self' https://b.stripecdn.com; img-src 'self' https://q.stripe.com; object-src 'none'; script-src 'self' 'sha256-e+0+bM5staBTB7IQqo+ZXQFkFrOYh8ySEkD0TeZCWCs='; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Fri, 27 Dec 2024 15:45:45 GMT
etag: "6885945b2204f3d923be2e050bb2a313"
last-modified: Mon, 23 Dec 2024 21:44:42 GMT
origin-agent-cluster: ?1
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 8020
x-content-type-options: nosniff
x-request-id: 149a0978-898d-49e7-8dd7-22b9eca7b72e
x-served-by: cache-lga21982-LGA

GET
H2 200 adsct
t.co/1/i/ 43 B
630 B 201ms
177ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=0278b995-1e2e-4800-a63f-c1affde9e07c&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=74a40215-69c0-435a-b1c7-1bb7ad00f3d2&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fnrsc%2Fcongrats-trump-card-eoy-inaugration-e-pa%2F%3Famtposition%3D4%26recurring%3Dtrue%26utm_campaign%3D20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc%26utm_content%3Dfundraising%26utm_medium%3Demail%26utm_source%3Do2m_nrsc_pa%26utm_tc%3DAFR-20241227&tw_iframe_status=0&txn_id=oasgi&type=javascript&version=2.3.31

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 4b3ced06a7d66b04
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 4029937fb706dcf7e09524fe7fb9228ba86fa700889bee53937dae4971658341
cf-cache-status: DYNAMIC
cf-ray: 8f8a708578437292-EWR
x-response-time: 80
content-length: 43
date: Fri, 27 Dec 2024 15:45:46 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_b

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
726 B 190ms
106ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=0278b995-1e2e-4800-a63f-c1affde9e07c&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=74a40215-69c0-435a-b1c7-1bb7ad00f3d2&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fnrsc%2Fcongrats-trump-card-eoy-inaugration-e-pa%2F%3Famtposition%3D4%26recurring%3Dtrue%26utm_campaign%3D20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc%26utm_content%3Dfundraising%26utm_medium%3Demail%26utm_source%3Do2m_nrsc_pa%26utm_tc%3DAFR-20241227&tw_iframe_status=0&txn_id=oasgi&type=javascript&version=2.3.31

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 54e700dc09b0f351
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 6587f77603c7bd9c200ae6ff87b9d6382b074d47a35dc53b330112631929d2ed
x-response-time: 77
content-length: 43
date: Fri, 27 Dec 2024 15:45:45 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_b

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
676 B 79ms
14ms Image
image/gif 52.72.192.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Fri%2C%2027%20Dec%202024%2015%3A45%3A45%20GMT&n=10&b=Congratulations%2C%20President%20Trump!&.yp=10099393&f=https%3A%2F%2Fsecure.winred.com%2Fnrsc%2Fcongrats-trump-card-eoy-inaugration-e-pa%2F%3Famtposition%3D4%26recurring%3Dtrue%26utm_campaign%3D20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc%26utm_content%3Dfundraising%26utm_medium%3Demail%26utm_source%3Do2m_nrsc_pa%26utm_tc%3DAFR-20241227&enc=UTF-8&yv=1.16.5&tagmgr=gtm

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.72.192.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-72-192-139.compute-1.amazonaws.com

Software

ATS/9.1.10.144 /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
cache-control: no-cache, no-store, private, must-revalidate
pragma: no-cache
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-content-type-options: nosniff
via: http/1.1 traffic_server (ApacheTrafficServer/9.1.10.144)
expires: Fri, 27 Dec 2024 15:45:45 GMT
accept-ranges: bytes
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Fri, 27 Dec 2024 15:45:45 GMT
content-type: image/gif
server: ATS/9.1.10.144
x-frame-options: DENY

POST
H3 204 rum Show response
secure.winred.com/cdn-cgi/ 0
142 B 15ms
13ms XHR
text/plain 2606:4700::6813:d359
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:d359 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
x-content-type-options: nosniff
cf-ray: 8f8a70876fd64319-EWR
access-control-allow-origin: https://secure.winred.com
date: Fri, 27 Dec 2024 15:45:46 GMT
vary: Origin
server: cloudflare
x-frame-options: DENY

GET
H2 200 up
insight.adsrvr.org/track/ Frame B53E 0
0 27ms
11ms Document
text/html 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=lp1nhxa&ref=https%3A%2F%2Fsecure.winred.com%2Fnrsc%2Fcongrats-trump-card-eoy-inaugration-e-pa%2F%3Famtposition%3D4%26recurring%3Dtrue%26utm_campaign%3D20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc%26utm_content%3Dfundraising%26utm_medium%3Demail%26utm_source%3Do2m_nrsc_pa%26utm_tc%3DAFR-20241227&upid=8mv19bm&upv=1.1.0&paapi=1
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Fri, 27 Dec 2024 15:45:46 GMT
server: Kestrel
vary: Accept-Encoding

GET
H3 200 Artboard.png
d35ligi1n5bgzc.cloudfront.net/favicons/favicon_assets/000/015/569/original/ 1 KB
2 KB 6ms
5ms Other
image/png 2600:9000:26fa:fe00:0:7d26:ee00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d35ligi1n5bgzc.cloudfront.net/favicons/favicon_assets/000/015/569/original/Artboard.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:26fa:fe00:0:7d26:ee00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: fc1c77849ba3a6020b87884599c1aefa09a9e1d7bfed95ad3deec6a5d4c08902

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

x-amz-version-id: FN8PLjpE4LnyaM50_d0emgSd0vAz496F
age: 53490
etag: "7b9c8b7070c8f9c81fc9a133d26daf4e"
via: 1.1 46a179b8ac401f1f1def1c8690577c3e.cloudfront.net (CloudFront)
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
content-length: 1512
x-amz-cf-id: vzp-2QiEwb6HqS_rGy0liH-Nk2wubFGxF6LvSwU6N039hTon-k2ULQ==
date: Fri, 27 Dec 2024 00:54:17 GMT
content-type: image/png
last-modified: Wed, 10 Jul 2019 18:21:57 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P1
x-amz-server-side-encryption: AES256

POST collect
gtm.winred.com/g/ 0
0

GET
H3 200 m-outer-3437aaddcdf6922d623e172c2d6f9278.html
js.stripe.com/v3/ Frame 3951 0
0 3ms
3ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.64.176 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 3226167
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=31536000
content-encoding: br
content-length: 122
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Fri, 27 Dec 2024 15:45:50 GMT
etag: "3437aaddcdf6922d623e172c2d6f9278"
last-modified: Tue, 19 Nov 2024 21:02:53 GMT
origin-agent-cluster: ?1
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 548845
x-content-type-options: nosniff
x-request-id: 7010c914-ac26-40e9-ab6c-039e6b7b9112
x-served-by: cache-lga21982-LGA

GET
H3 200 common.js Show response
maps.googleapis.com/maps-api-v3/api/js/59/3a/ 268 KB
55 KB 41ms
40ms Script
text/javascript 2607:f8b0:4006:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/59/3a/common.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

249e85b9792cdfb9ce084d58830b251befb8fbeb9dae85fd252a3b252de6897f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

content-encoding: br
age: 77696
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
x-content-type-options: nosniff
expires: Fri, 26 Dec 2025 18:10:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 18:10:54 GMT
last-modified: Thu, 12 Dec 2024 05:43:02 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
accept-ranges: bytes
content-length: 56513
x-xss-protection: 0
server: sffe

GET
H3 200 util.js Show response
maps.googleapis.com/maps-api-v3/api/js/59/3a/ 189 KB
57 KB 43ms
42ms Script
text/javascript 2607:f8b0:4006:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/59/3a/util.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

00a2425f4782d1caf94db30cbe18a5d05488d59573b033146c351a5958e662d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

content-encoding: br
age: 3084
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
x-content-type-options: nosniff
expires: Sat, 27 Dec 2025 14:54:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 27 Dec 2024 14:54:26 GMT
last-modified: Thu, 12 Dec 2024 05:43:02 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
accept-ranges: bytes
content-length: 58839
x-xss-protection: 0
server: sffe

GET
H2 200 trusted-types-checker-efd8cf45ce422659c098993bfc62531b.js Show response
js.stripe.com/v3/fingerprinted/js/ 176 B
693 B 8ms
7ms Script
text/javascript 3.168.102.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/trusted-types-checker-efd8cf45ce422659c098993bfc62531b.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.168.102.4 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-168-102-4.jfk52.r.cloudfront.net

Software

Cloudfront /

Resource Hash

07b6b3d899dd69c0e9eb463e23e10e30e82588eddf95d15d45bb505c6703a813

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://secure.winred.com/

Response headers

etag: "96f5b26d366f47393b3ff36fe7471474"
age: 590
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: oHggK1j8ztcityU-UHKNHqFeHnaKQHJiW1GW0En9GijP9oP5MJ3ROA==
date: Fri, 27 Dec 2024 15:36:02 GMT
content-type: text/javascript; charset=utf-8
last-modified: Fri, 20 Dec 2024 21:10:49 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31556926; includeSubDomains; preload
cache-control: max-age=31536000
timing-allow-origin: *
via: 1.1 9d9b3f05e994245e3be7cd3dbae1ce50.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 176
x-amz-cf-pop: JFK52-P6
server: Cloudfront

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: gtm.winred.com
URL: https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je4cc1v867905447z872410129za200zb72410129&_p=1735314344895&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=2027745546.1735314346&ecid=1565480759&ul=en-us&sr=1600x1200&_fplc=0&ur=US-NY&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&sst.tft=1735314344895&sst.ude=0&_s=1&sid=1735314345&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fnrsc%2Fcongrats-trump-card-eoy-inaugration-e-pa%2F%3Famtposition%3D4%26recurring%3Dtrue%26utm_campaign%3D20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc%26utm_content%3Dfundraising%26utm_medium%3Demail%26utm_source%3Do2m_nrsc_pa%26utm_tc%3DAFR-20241227&dt=Congratulations%2C%20President%20Trump!&en=page_view&_fv=1&_ss=1&ep.pagepath=%2Fnrsc%2Fcongrats-trump-card-eoy-inaugration-e-pa%2F&ep.pagehostname=secure.winred.com&ep.parsedurl=https%3A%2F%2Fsecure.winred.com%2Fnrsc%2Fcongrats-trump-card-eoy-inaugration-e-pa&epn.load_time_sec=-1735314344.7&epn.event_fire_time=1735314345396&ep.event_uuid=33d9abcd-abb5-4850-826d-c503427d75e4&ep.isVideoPage=f&ep.referrer=&tfd=993&richsstsse

Domain: s.yimg.com
URL: https://s.yimg.com/wi/config/10099393.json

Domain: gtm.winred.com
URL: https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je4cc1v867905447z872410129za200zb72410129&_p=1735314344895&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=2027745546.1735314346&ecid=1565480759&ul=en-us&sr=1600x1200&_fplc=0&ur=US-NY&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&sst.tft=1735314344895&sst.ude=0&sid=1735314345&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fnrsc%2Fcongrats-trump-card-eoy-inaugration-e-pa%2F%3Famtposition%3D4%26recurring%3Dtrue%26utm_campaign%3D20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc%26utm_content%3Dfundraising%26utm_medium%3Demail%26utm_source%3Do2m_nrsc_pa%26utm_tc%3DAFR-20241227&dt=Congratulations%2C%20President%20Trump!&_s=2&tfd=1499&richsstsse

Verdicts & Comments Add Verdict or Comment

63 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

42 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
app.revv.co/api/v3/users	1970-01-21 11:37:54	Name: rvid Value: 42ba0ef6-1a6f-4cf3-a71d-abaa06b744e7
secure.winred.com/	1969-12-31 23:59:59	Name: __production_revv_csrftoken Value: 1735314344%7CBt%2B%2FsRrb1Vdtu63pC9WlUxBFzXmAA8fQ9NoBMGLgP%2Fg%3D%7C%2FPyy3poYMTXVLKUbMewjyonYWM2St2FM5Z8hzK5N5SM%3D
.winred.com/	1969-12-31 23:59:59	Name: _revv_v3_session Value: dU01WnZ0ZDM3WmozcWhHblFDY0FDODBiQ3lOcE5ZOEdFMlhlU0dVWm1RcFBBakZyeXltQXFNUmRXdGN6UFlWVXFLbWFOcHhWSVJ5R1Z5czhyLzYzTGJoRDRHQjlLYTFEa1lLbEtqMkF2cnVOSGVCMENpSU95Z2hRSlZaeElUYUY4d0NBQnRBRlFPam9VaWNrR0Y4c1FTaXovSWdJQ0VSRlBHQkdHbzNEajYwOGJzZDNiaCtZKzlZR1lkdGFrQ1U1eFlsYzk4djRibmFYUHd4czEwWk4zYmRaWUU0dEN2eUY1M0g3UlBtVXNNMGhnMnBWVkplYjJJNDNzL1ZKZklYZDBCWkpxTDg2Sm5RczZHYXJZd25pdGd5SDNYU0FaUnBvZ1oyaEI3SHVrNHc9LS16UnFXNzVxUVhiTWFnanVSWE83Tzd3PT0%3D--646d43bd1e3d97c7a3cffb5fedbffb3b462f47f5
secure.winred.com/	1969-12-31 23:59:59	Name: origin_url Value: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227
.revv.co/	1969-12-31 23:59:59	Name: _revv_v3_session Value: eU5TSDJpa0Z0L1hJcXNrMjlwZDFnb29MRUhvaEwwQkc0NXBTbXNEbW1vbVU0MXh6YUhFUmZ3eE1uVkpkdlNhSzVmVUVEYVlHSEc0aVIwM2VyamF4N0E9PS0tYWxjVFJ4elE2RE0rRnZZRU11TkV5UT09--59bba3f2b0b0411f5184fb19ca9a11366f10d27f
.winred.com/	1970-01-21 04:11:30	Name: _gcl_au Value: 1.1.783287459.1735314345
secure.winred.com/	1969-12-31 23:59:59	Name: sso_tries Value: 1
secure.winred.com/	1970-01-21 11:37:54	Name: rvid Value: 42ba0ef6-1a6f-4cf3-a71d-abaa06b744e7
.adsrvr.org/	1970-01-21 10:47:30	Name: TDID Value: e075f877-38fa-4893-826c-0f8b880bb4a6
.winred.com/	1970-01-21 02:03:20	Name: _gid Value: GA1.2.364445222.1735314346
.winred.com/	1970-01-21 02:01:54	Name: _dc_gtm_UA-73658561-7 Value: 1
.secure.winred.com/	1970-01-21 10:47:30	Name: cf_clearance Value: a134uau7QbnlRiyxn6EdxVbzKFwOcFS8LvwAG9HGG1c-1735314345-1.2.1.1-23VhZpFghUMcBg4vvFF3U1TEKrxEsT62r1cLnfwKCdxtdIjx1tYmU5boJr9dL0x5kfu5r82_mVx057kFVt6oH.tlMuwEueGfW_3FXvU2a91Q7hf7FRAb_kEqF1VtGabfXN_RzBl75JzUMJ8oHS5JKdRN4.9pc3YcD0sWvi9IC_sbUlX8zxYcN0Mh7yRKl0eEhH6YCNLUtnvzE2rQaUYNCqbHjD_r_17bD2HaEhG9lPZGJTdH.VA4Tu4h7WVs9JkBgvtQLMoulyuTzxaZ10Z8YGGUXkOj8GiO2RIQkY89QFOTuGE.qomFBbKbzuBi41_fH2vDZuhBo33oPbgZi4O.UdOowIhuN5lJwSrX7MmAQ4i1mMFJngHj_dhGbNCyQNqK
.winred.com/	1970-01-21 11:37:54	Name: _ga_7NKV2JR6LG Value: GS1.1.1735314345.1.0.1735314345.0.0.0
.winred.com/	1970-01-21 11:37:54	Name: _ga Value: GA1.1.2027745546.1735314346
.winred.com/	1970-01-21 04:11:30	Name: _fbp Value: fb.1.1735314345788.49396222965581039
.rubiconproject.com/	1970-01-21 10:47:30	Name: audit_p Value: 1\|SUdoP5hLsuF2I4qInUPsAhKtPgiH7m3od8hyqrEnKoZGXlzst0zOczZkg8Pcz/J0SwYV0Wz1XwPdcuVnQi+ATffq0lRWg1JcpX+27h+c8oxeBnn/z2PyK7zyN495JwrH6SnU2QGrSGk02Kg64hA7wattg7CETITnhEtZT8gQU1NA19Uy18rCHHvP52PeI+dpTjbsxdxTQ5bDGh6be8AxUuYKY0xKXIv2BplwajK/o1u5PVrRjiekRCDzwQ8ksA7X6Hb7liXo8URO+SITq6Q0XxqOcBxvXnxDzkBo8GvWj1Y=
.rubiconproject.com/	1970-01-21 10:47:30	Name: khaos Value: M56XCUMY-6-IB0P
.rubiconproject.com/	1970-01-21 10:47:30	Name: khaos_p Value: M56XCUMY-6-IB0P
.rubiconproject.com/	1970-01-21 10:47:30	Name: audit Value: 1\|SUdoP5hLsuF2I4qInUPsAhKtPgiH7m3od8hyqrEnKoZGXlzst0zOczZkg8Pcz/J0SwYV0Wz1XwPdcuVnQi+ATffq0lRWg1JcpX+27h+c8oxeBnn/z2PyK7zyN495JwrH6SnU2QGrSGk02Kg64hA7wattg7CETITnhEtZT8gQU1NA19Uy18rCHHvP52PeI+dpTjbsxdxTQ5bDGh6be8AxUuYKY0xKXIv2BplwajK/o1u5PVrRjiekRCDzwQ8ksA7X6Hb7liXo8URO+SITq6Q0XxqOcBxvXnxDzkBo8GvWj1Y=
secure.winred.com/	1970-01-21 04:25:54	Name: _cids Value: W10=
.adnxs.com/	1970-01-21 04:11:30	Name: XANDR_PANID Value: x6uinKRqMJ-RMnFj-ZG0rhYEaPVg1XcMfoY8MRcdEYcqObubge248AJU3da9Gc1ntJLEdD67pnIpnMug363OSusTENZ1OkCW9SiQY_YpXb4.
.adnxs.com/	1970-01-21 11:37:54	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-21 04:11:30	Name: uuid2 Value: 2956633057950020809
.yahoo.com/	1970-01-21 10:47:51	Name: A3 Value: d=AQABBKnLbmcCECV3Ge9ZeZdRY5bzjlHePN4FEgEBAQEdcGd4Z9wt0iMA_eMAAA&S=AQAAAhHAS6kQXyg5mBqf4tIJx10
.twitter.com/	1970-01-21 11:37:54	Name: guest_id_marketing Value: v1%3A173531434591262444
.twitter.com/	1970-01-21 11:37:54	Name: guest_id_ads Value: v1%3A173531434591262444
.twitter.com/	1970-01-21 11:37:54	Name: personalization_id Value: "v1_BO6uLc+79JUuTSPzRhEm9g=="
.twitter.com/	1970-01-21 11:37:54	Name: guest_id Value: v1%3A173531434591262444
.t.co/	1970-01-21 11:37:54	Name: muc_ads Value: d0781f67-d890-44de-8451-e00e0077e412
.t.co/	1970-01-21 02:01:56	Name: __cf_bm Value: FwpKbbi2dKjNcyzV77iz1wAZir0E1ByiXE7m1ZnF7vY-1735314346-1.0.1.1-.9iwx.iDpq84WJ.MHZzIDjQEXXLBwEUGRcyfFnsY3m_9Nrc4jqnSZehXm71Rsnz2QGQTIVM23Y.OjUMLH1lfsg
.doubleclick.net/	1970-01-21 11:37:54	Name: IDE Value: AHWqTUmO-BRVrad8m0Ve19sDUIpPC8cm8JAnwd__sCjZf4IX2JxUu8Zh6TdBOEVLioQ
.casalemedia.com/	1970-01-21 10:47:30	Name: CMID Value: Z27Lqkt3uZkAADSlBDEY8AAA
.casalemedia.com/	1970-01-21 04:11:30	Name: CMPS Value: 1221
.casalemedia.com/	1970-01-21 04:11:30	Name: CMPRO Value: 1221
.winred.com/	1970-01-21 11:37:54	Name: _ga_X6H0114PDF Value: GS1.1.1735314345.1.0.1735314346.0.0.1565480759
api2.hcaptcha.com/	1970-01-21 02:01:56	Name: __cflb Value: 0H28vk2VKwPbLoawFincekpozDKK5F2cfkWWJmajFhf
.pubmatic.com/	1970-01-21 04:11:30	Name: KRTBCOOKIE_377 Value: 6810-e075f877-38fa-4893-826c-0f8b880bb4a6&KRTB&22918-e075f877-38fa-4893-826c-0f8b880bb4a6&KRTB&22926-e075f877-38fa-4893-826c-0f8b880bb4a6&KRTB&23031-e075f877-38fa-4893-826c-0f8b880bb4a6
.pubmatic.com/	1970-01-21 02:45:06	Name: PugT Value: 1735311048
.bidswitch.net/	1970-01-21 10:47:30	Name: tuuid Value: 7a169dad-af9b-4e94-837f-65f77cb2ec64
.bidswitch.net/	1970-01-21 10:47:30	Name: c Value: 1735314346
.bidswitch.net/	1970-01-21 10:47:30	Name: tuuid_lu Value: 1735314346
.adsrvr.org/	1970-01-21 10:47:30	Name: TDCPM Value: CAESFgoHcnViaWNvbhILCOrv3_XxpdM9EAUSFwoIYXBwbmV4dXMSCwjko5b68aXTPRAFEhUKBmdvb2dsZRILCKasmvvxpdM9EAUSFQoGY2FzYWxlEgsItPOa-_Gl0z0QBRIXCghwdWJtYXRpYxILCKrGtfzxpdM9EAUSGAoJYmlkc3dpdGNoEgsI0Ou1_PGl0z0QBRgFIAIoAzILCPKVuKmIptM9EAVCDyINCAESCQoFdGllcjIQAVoHbHAxbmh4YWAB

15 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	warning	URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227 Message: [DOM] Found 2 elements with non-unique id #conduit_additional_fields_781884645_additional_field_id: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227 Message: [DOM] Found 2 elements with non-unique id #conduit_additional_fields_781884645_parameter_slug: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227 Message: [DOM] Found 2 elements with non-unique id #conduit_additional_fields_781884645_whitelisted_parameter_id: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227 Message: [DOM] Found 2 elements with non-unique id #conduit_employer_name: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227 Message: [DOM] Found 2 elements with non-unique id #conduit_mobile_number: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227 Message: [DOM] Found 2 elements with non-unique id #conduit_not_employed: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227 Message: [DOM] Found 2 elements with non-unique id #conduit_occupation: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	verbose	URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227 Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
recommendation	verbose	URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227 Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
javascript	error	URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227 Message: Access to XMLHttpRequest at 'https://s.yimg.com/wi/config/10099393.json' from origin 'https://secure.winred.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://s.yimg.com/wi/config/10099393.json Message: Failed to load resource: net::ERR_FAILED
other	warning	URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227 Message: Each dictionary in the list "icons" should contain a non-empty UTF8 string field "sizes".
other	warning	URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227 Message: Each dictionary in the list "icons" should contain a non-empty UTF8 string field "type".
other	warning	URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227 Message: Each dictionary in the list "icons" should contain a non-empty UTF8 string field "sizes".
other	warning	URL: https://secure.winred.com/nrsc/congrats-trump-card-eoy-inaugration-e-pa/?amtposition=4&recurring=true&utm_campaign=20241226_na_congratstrumpcardeoysms-v1_PA_nrsc_nrsc&utm_content=fundraising&utm_medium=email&utm_source=o2m_nrsc_pa&utm_tc=AFR-20241227 Message: Each dictionary in the list "icons" should contain a non-empty UTF8 string field "type".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.ads.rmbl.ws
analytics.twitter.com
app.revv.co
cm.g.doubleclick.net
connect.facebook.net
d35ligi1n5bgzc.cloudfront.net
dsum-sec.casalemedia.com
gtm.winred.com
ib.adnxs.com
insight.adsrvr.org
js.adsrvr.org
js.stripe.com
maps.googleapis.com
match.adsrvr.org
pixel.rubiconproject.com
s.yimg.com
secure.winred.com
sp.analytics.yahoo.com
static.ads-twitter.com
static.cloudflareinsights.com
stats.g.doubleclick.net
t.co
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
gtm.winred.com
s.yimg.com
104.18.26.193
104.244.42.3
142.250.72.98
146.75.36.157
151.101.64.176
162.159.140.229
2001:4860:4802:32::178
2001:4998:1c:800::1001
2600:9000:26fa:fe00:0:7d26:ee00:93a1
2606:4700::6810:5049
2606:4700::6813:d359
2606:4700::6813:d459
2607:f8b0:4004:c09::9b
2607:f8b0:4006:80a::2004
2607:f8b0:4006:817::2008
2607:f8b0:4006:817::200a
2a03:2880:f012:8:face:b00c:0:1
2a03:2880:f112:83:face:b00c:0:25de
3.168.102.4
3.168.97.94
3.33.220.150
38.70.189.70
52.72.192.139
68.67.181.103
69.173.151.100
00a2425f4782d1caf94db30cbe18a5d05488d59573b033146c351a5958e662d4
07b6b3d899dd69c0e9eb463e23e10e30e82588eddf95d15d45bb505c6703a813
08ae498f27cd9805f52e51bcdd29c2773054affd19730fba0022227d4e89b350
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
22a7a737385350087375b064933835ba5addbe6a89f4edc9e63004970cd7c44a
24751cbae618f6fbeb532498fd1ceeda5350f30085086cd5426961a2695e3d9f
249e85b9792cdfb9ce084d58830b251befb8fbeb9dae85fd252a3b252de6897f
319bd99d85091fdf6419d7218cb458ed17b59a30d4c5cad92594332c4cf0ddda
36f0bf882a876b13aeb20cf7a495421a43f336da5422072a58f58ce303fb6284
3f9ee71a6162e6c931991b506168be93fe968648cdb0f9eb1d8abc6acafc5b72
49eb91ccb014544e86ffd670d8f1f1c2048d59e663c41655ad02651b0a1e302f
58b8018304ed799ead35ff3094477c78bc668237cae8edc287616368286748d6
5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848
6039c7fb49af57af18c66c1f088ebc528623b4d6ac05ce2e3229ba0b335bc92b
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
706e4b2b1a0b48a95a2468ed5bbd10ea6cb9874aff64afd280e979c2f141cb0e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83d0f78290d4be7bedcd76b4396f52bcfd8a583317de74ebea3252639b526d87
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
8c6b44dfdced70486684e1e7535d08c6e855d3cd8a6f57e1a6b6af0c0f15478b
96b04ef160f8b50520a48707a452fecdd6e6771c643706d5949020a2dea15962
9cae0d7093951805aaeb04b8598d95dc02f1334d748f99a10081c49258cb5d61
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ac04576455cd9fc8163f673956a29073602b7d500e7d0a5b602815ed5508846f
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad9d96dc918ac14513bac95cfa66367ea9a9c2ece1102cb1dd5ef384f778a1da
aebe8df81ee2ba5bc51e3abc322910ee5122a0ac06edfbcf7a04e1659d17dc9c
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
bb19cc9bb9e4e0f0237ee1f0c213487452c77e6f9fa6fa9edcb87f4de9f0c21a
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60
d626ec9117b8923f58e8bf71f19065c7684c4b0b096606546f4ba90be7f2a433
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e51815a6fa2b341d36e7fa22f8258b3eab5b492af53dd2a79458d70bab20750f
e9dd00e1a9b646ffc5cf2032ba83240597539bd7cc1273de9f66cbb96f83b388
f38456ec82ed63fda4f038cb5f6cf4afcb11b28825242c0b1a1000a6b35bea23
fc1c77849ba3a6020b87884599c1aefa09a9e1d7bfed95ad3deec6a5d4c08902

secure.winred.com Open in urlscan Pro 2606:4700::6813:d359 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

57 Requests

91 %HTTPS

48 %IPv6

22 Domains

26 Subdomains

23 IPs

3 Countries

4024 kBTransfer

7205 kBSize

42 Cookies

7 Outgoing links

Redirected requests

57 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

secure.winred.com Open in urlscan Pro
2606:4700::6813:d359 Public Scan

Screenshot
Live screenshot

Full Image

57
Requests

91 %
HTTPS

48 %
IPv6

22
Domains

26
Subdomains

23
IPs

3
Countries

4024 kB
Transfer

7205 kB
Size

42
Cookies

57 HTTP transactions
0 data transactions