www.firstfoundation.ca Open in urlscan Pro
172.66.43.88 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://rrsp-tfsa.ca/
Effective URL:
https://www.firstfoundation.ca/financial/
Submission: On November 19 via api (November 19th 2024, 7:51:08 pm UTC) from US — Scanned from CA

Summary HTTP 84 Redirects Links 25 Behaviour Indicators

Summary

This website contacted 25 IPs in 1 countries across 18 domains to perform 84 HTTP transactions. The main IP is 172.66.43.88, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.firstfoundation.ca.
TLS certificate: Issued by WE1 on November 3rd 2024. Valid for: 3 months.

This is the only time www.firstfoundation.ca was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	3.33.251.168 3.33.251.168	16509 (AMAZON-02) (AMAZON-02)
1 34	172.66.43.88 172.66.43.88	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 3	172.66.40.168 172.66.40.168	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:5049	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4004:c09::88	15169 (GOOGLE) (GOOGLE)
1	142.251.163.155 142.251.163.155	15169 (GOOGLE) (GOOGLE)
2	35.201.118.58 35.201.118.58	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2607:f8b0:400... 2607:f8b0:4004:c17::9a	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4004:c08::79	15169 (GOOGLE) (GOOGLE)
4	172.253.115.99 172.253.115.99	15169 (GOOGLE) (GOOGLE)
1	172.67.159.29 172.67.159.29	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2607:f8b0:400... 2607:f8b0:4004:c0b::61	15169 (GOOGLE) (GOOGLE)
4	31.13.66.19 31.13.66.19	32934 (FACEBOOK) (FACEBOOK)
2	2607:f8b0:400... 2607:f8b0:4004:c1b::8b	15169 (GOOGLE) (GOOGLE)
1	136.143.183.67 136.143.183.67	2639 (ZOHO-AS) (ZOHO-AS)
2	172.253.63.154 172.253.63.154	15169 (GOOGLE) (GOOGLE)
1	172.253.63.93 172.253.63.93	15169 (GOOGLE) (GOOGLE)
4	142.251.16.94 142.251.16.94	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4004:c07::65	15169 (GOOGLE) (GOOGLE)
1	13.33.252.96 13.33.252.96	16509 (AMAZON-02) (AMAZON-02)
3	31.13.66.35 31.13.66.35	32934 (FACEBOOK) (FACEBOOK)
1	136.143.182.97 136.143.182.97	2639 (ZOHO-AS) (ZOHO-AS)
3	2607:f8b0:400... 2607:f8b0:4004:c06::9c	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4004:c07::8a	15169 (GOOGLE) (GOOGLE)
2	142.251.16.157 142.251.16.157	15169 (GOOGLE) (GOOGLE)
1	142.250.31.97 142.250.31.97	15169 (GOOGLE) (GOOGLE)
3	199.67.84.76 199.67.84.76	2639 (ZOHO-AS) (ZOHO-AS)
84	25

1 3.33.251.168 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: aec037177372cc6cd.awsglobalaccelerator.com

rrsp-tfsa.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

34 172.66.43.88 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.firstfoundation.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.66.40.168 (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

firstfoundation.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5049 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c09::88 (Washington, United States)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.163.155 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: wv-in-f155.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.201.118.58 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 58.118.201.35.bc.googleusercontent.com

form.jotform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c17::9a (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4004:c08::79 (Washington, United States)

ASN15169 (GOOGLE, US)

www.websiteoptimizer.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.253.115.99 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f99.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.159.29 (United States)

ASN13335 (CLOUDFLARENET, US)

optimize.websiteoptimizer.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c0b::61 (Washington, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 31.13.66.19 (Ashburn, United States)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-iad3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c1b::8b (Washington, United States)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 136.143.183.67 (United States)

ASN2639 (ZOHO-AS, US)

salesiq.zoho.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.63.154 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f154.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.63.93 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f93.1e100.net

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.16.94 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f94.1e100.net

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c07::65 (Washington, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.252.96 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-252-96.jfk50.r.cloudfront.net

cdn.callrail.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 31.13.66.35 (Ashburn, United States)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-iad3.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 136.143.182.97 (United States)

ASN2639 (ZOHO-AS, US)

salesiq.zohopublic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4004:c06::9c (Washington, United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c07::8a (Washington, United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.16.157 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f157.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.31.97 (United States)

ASN15169 (GOOGLE, US)
PTR: bj-in-f97.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 199.67.84.76 (United States)

ASN2639 (ZOHO-AS, US)

css.zohocdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js.zohocdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
37	firstfoundation.ca 4 redirects www.firstfoundation.ca firstfoundation.ca	483 KB
9	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 135 googleads.g.doubleclick.net — Cisco Umbrella Rank: 43 td.doubleclick.net — Cisco Umbrella Rank: 182	6 KB
8	google.com www.google.com — Cisco Umbrella Rank: 3 apis.google.com — Cisco Umbrella Rank: 121 analytics.google.com — Cisco Umbrella Rank: 142	78 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	473 KB
4	google.ca www.google.ca — Cisco Umbrella Rank: 11557	254 B
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 192	153 KB
4	websiteoptimizer.dev www.websiteoptimizer.dev optimize.websiteoptimizer.dev	19 KB
3	zohocdn.com css.zohocdn.com — Cisco Umbrella Rank: 14373 js.zohocdn.com — Cisco Umbrella Rank: 14070	38 KB
3	facebook.com www.facebook.com — Cisco Umbrella Rank: 120	210 B
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 36	22 KB
2	jotform.com form.jotform.com — Cisco Umbrella Rank: 26107	3 KB
2	youtube.com www.youtube.com — Cisco Umbrella Rank: 79
1	zohopublic.com salesiq.zohopublic.com — Cisco Umbrella Rank: 16595	15 KB
1	callrail.com cdn.callrail.com — Cisco Umbrella Rank: 10001	577 B
1	zoho.com salesiq.zoho.com — Cisco Umbrella Rank: 16318	47 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 96	21 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 617	7 KB
1	rrsp-tfsa.ca 1 redirects rrsp-tfsa.ca	317 B
84	18

	Domain	Requested by
34	www.firstfoundation.ca	1 redirects www.firstfoundation.ca static.cloudflareinsights.com
5	www.googletagmanager.com	www.firstfoundation.ca www.googletagmanager.com www.google-analytics.com
4	www.google.ca
4	connect.facebook.net	www.firstfoundation.ca connect.facebook.net
4	www.google.com	www.firstfoundation.ca www.googletagmanager.com
4	stats.g.doubleclick.net	www.firstfoundation.ca www.google-analytics.com www.googletagmanager.com
3	td.doubleclick.net	www.googletagmanager.com
3	www.facebook.com	connect.facebook.net
3	www.websiteoptimizer.dev	www.firstfoundation.ca www.websiteoptimizer.dev
3	firstfoundation.ca	3 redirects
2	css.zohocdn.com	salesiq.zoho.com css.zohocdn.com
2	analytics.google.com	www.googletagmanager.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	googleads.g.doubleclick.net	www.googleadservices.com www.googletagmanager.com
2	apis.google.com	www.firstfoundation.ca apis.google.com
2	form.jotform.com	www.firstfoundation.ca form.jotform.com
2	www.youtube.com	www.firstfoundation.ca
1	js.zohocdn.com	salesiq.zoho.com
1	salesiq.zohopublic.com	salesiq.zoho.com
1	cdn.callrail.com	www.googletagmanager.com
1	salesiq.zoho.com	www.firstfoundation.ca
1	optimize.websiteoptimizer.dev	www.websiteoptimizer.dev
1	www.googleadservices.com	www.firstfoundation.ca
1	static.cloudflareinsights.com	www.firstfoundation.ca
1	rrsp-tfsa.ca	1 redirects
84	25

This site contains links to these domains. Also see Links.

Domain
first-foundation-mortgages-inc.mtg-app.com
support.firstfoundation.ca
bookings.firstfoundation.ca
firstfoundation.kioskassist.com
goo.gl
www.facebook.com
www.linkedin.com
x.com
www.youtube.com
shorturl.at
events.firstfoundation.ca
bit.ly
my.planswell.com
www.layoffinsurance.ca
mortgageproscan.ca

Subject Issuer	Validity	Valid
www.firstfoundation.ca WE1	`2024-11-03` - `2025-02-01`	3 months	crt.sh
cloudflareinsights.com WE1	`2024-11-01` - `2025-01-30`	3 months	crt.sh
*.google.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.googleadservices.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
jotform.com Sectigo RSA Domain Validation Secure Server CA	`2024-09-11` - `2025-09-11`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
www.websiteoptimizer.dev WR3	`2024-11-02` - `2025-01-31`	3 months	crt.sh
websiteoptimizer.dev E6	`2024-09-24` - `2024-12-23`	3 months	crt.sh
*.google-analytics.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-08-28` - `2024-11-26`	3 months	crt.sh
*.apis.google.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.zoho.com Sectigo RSA Domain Validation Secure Server CA	`2024-10-01` - `2025-10-01`	a year	crt.sh
*.google.ca WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
swappy.callrail.com Amazon RSA 2048 M03	`2024-06-10` - `2025-07-09`	a year	crt.sh
zohopublic.com R10	`2024-11-09` - `2025-02-07`	3 months	crt.sh
*.doubleclick.net WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.zohocdn.com Sectigo RSA Domain Validation Secure Server CA	`2024-07-17` - `2025-08-16`	a year	crt.sh

This page contains 9 frames:

Primary Page: https://www.firstfoundation.ca/financial/
Frame ID: EB5655ACE59D85ED37D95D299D744EF9
Requests: 73 HTTP requests in this frame

Frame: https://www.youtube.com/embed/DawQYnfyLVc
Frame ID: C80A09FB7323CE01EE369E03CEEB654D
Requests: 1 HTTP requests in this frame

Frame: https://www.firstfoundation.ca/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js
Frame ID: CEF9384C4D91B2A1500C0416BDCF8FC1
Requests: 3 HTTP requests in this frame

Frame: https://form.jotform.com/40126763331952?parentURL=https%3A%2F%2Fwww.firstfoundation.ca%2Ffinancial%2F&jsForm=true
Frame ID: D86E966D78CA77B98070B4B190F875E3
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/DawQYnfyLVc
Frame ID: D83ADACBE13A4B972172C491C7EBDD94
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fwww.firstfoundation.ca
Frame ID: 6C567BCAC7DCA547D3694D10961F47E1
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/1061587441?random=1732045862422&cv=11&fst=1732045862422&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4be0z86850853za201zb6850853&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstfoundation.ca%2Ffinancial%2F&hn=www.googleadservices.com&frm=0&tiba=Financial%20Planning%20and%20Wealth%20Advisor%20Services%20%7C%20Edmonton%20Calgary%20%7C%20First%20Foundation&npa=0&pscdl=noapi&auid=469264080.1732045862&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1
Frame ID: 7FCB149D994D5D5B365B755A0ADDB44B
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-CD6W6EB7M8&gacid=270188546.1732045862&gtm=45je4be0v9116765317z86850853za200zb6850853&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102077855&z=879183476
Frame ID: A5A20545231C7E6BB513A17A89335E16
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-GV9TPCY84G&gacid=270188546.1732045862&gtm=45je4be0v9116765317z86850853za200zb6850853&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102077855&z=11947285
Frame ID: F087871A8F9743A771B99C95B6704A91
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Financial Planning and Wealth Advisor Services | Edmonton Calgary | First Foundation

Page URL History Show full URLs

https://rrsp-tfsa.ca/ HTTP 301
https://www.firstfoundation.ca/financial/ Page URL

Detected technologies

ExpressionEngine (CMS) Expand

Overall confidence: 100%
Detected patterns

CodeIgniter (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/[a-z]*\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Page Statistics

84
Requests

95 %
HTTPS

33 %
IPv6

18
Domains

25
Subdomains

25
IPs

1
Countries

1361 kB
Transfer

3522 kB
Size

23
Cookies

25 Outgoing links

These are links going to different origins than the main page.

URL: https://first-foundation-mortgages-inc.mtg-app.com/
Title: Mortgage: Apply Now>>

Search URL Search Domain Scan URL

URL: https://support.firstfoundation.ca/portal/en/kb/first-foundation
Title: Mortgage Support

Search URL Search Domain Scan URL

URL: https://bookings.firstfoundation.ca/#/mortgage
Title: Schedule a Mortgage Review Today! »

Search URL Search Domain Scan URL

URL: https://support.firstfoundation.ca/portal/en/kb/grow-first-foundation-investment-team
Title: Financial Services Support

Search URL Search Domain Scan URL

URL: https://bookings.firstfoundation.ca/#/customer/tyler
Title: Schedule an Appointment »

Search URL Search Domain Scan URL

URL: https://firstfoundation.kioskassist.com/
Title: Insurance Client Portal >>

Search URL Search Domain Scan URL

URL: https://support.firstfoundation.ca/portal/en/kb/protect-ff-insurance-team
Title: Insurance Support

Search URL Search Domain Scan URL

URL: https://support.firstfoundation.ca/portal/en/kb/articles/how-to-make-an-insurance-payment-online
Title: Insurance Payment »

Search URL Search Domain Scan URL

URL: https://support.firstfoundation.ca/portal/en/kb/articles/insurance-carrier-claims-contact-directory
Title: Report a Claim »

Search URL Search Domain Scan URL

URL: https://goo.gl/P6lk37
Title: Mortgage Blog Category

Search URL Search Domain Scan URL

URL: https://goo.gl/8hCoHZ
Title: Financial Planning Blog Category

Search URL Search Domain Scan URL

URL: https://goo.gl/Miyi5h
Title: Insurance Blog Category

Search URL Search Domain Scan URL

URL: https://www.facebook.com/firstfoundationmain
Title: First Foundation Facebook

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/first-foundation-mortgages-investments-insurance
Title: First Foundation LinkedIn

Search URL Search Domain Scan URL

URL: https://x.com/firstfoundation/
Title: First Foundation on X

Search URL Search Domain Scan URL

URL: https://www.youtube.com/@FirstFoundationCA
Title: First Foundation YouTube

Search URL Search Domain Scan URL

URL: https://shorturl.at/EXUVf
Title: Contact Us »

Search URL Search Domain Scan URL

URL: https://support.firstfoundation.ca/portal/en/home
Title: Knowledge Base and Support

Search URL Search Domain Scan URL

URL: https://bookings.firstfoundation.ca/#/customer/firstfoundation
Title: Schedule an Appointment

Search URL Search Domain Scan URL

URL: https://events.firstfoundation.ca/events
Title: First Foundation Events

Search URL Search Domain Scan URL

URL: https://bit.ly/ff-live-chat
Title: First Foundation Live Chat »

Search URL Search Domain Scan URL

URL: https://bookings.firstfoundation.ca/#/customer/financialplan
Title: Schedule an Appointment With a CFP

Search URL Search Domain Scan URL

URL: https://my.planswell.com/en-CA/discovery/pw-tylerp
Title: Start Your Own Financial Plan Online

Search URL Search Domain Scan URL

URL: http://www.layoffinsurance.ca/
Title: Layoff Insurance

Search URL Search Domain Scan URL

URL: https://mortgageproscan.ca/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://rrsp-tfsa.ca/ HTTP 301
https://www.firstfoundation.ca/financial/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://firstfoundation.ca/assets/images/IIROC_ACPI_LOGO.png HTTP 301
https://www.firstfoundation.ca/assets/images/IIROC_ACPI_LOGO.png

Request Chain 4

https://firstfoundation.ca/media/imagic/Benefits_of_Working_with_a_Certified_Financial_Planner.png HTTP 301
https://www.firstfoundation.ca/media/imagic/Benefits_of_Working_with_a_Certified_Financial_Planner.png

Request Chain 5

https://firstfoundation.ca/uploads/PM/NORTHERN_ALBERTA_2023_6_YRS_TAG.png HTTP 301
https://www.firstfoundation.ca/uploads/PM/NORTHERN_ALBERTA_2023_6_YRS_TAG.png

Request Chain 21

https://www.firstfoundation.ca/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://www.firstfoundation.ca/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js

84 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request / Show response
www.firstfoundation.ca/financial/
Redirect Chain

https://rrsp-tfsa.ca/
https://www.firstfoundation.ca/financial/

37 KB
12 KB

554ms
398ms

Document
text/html

172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstfoundation.ca/financial/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

04528589e0063ae3141526f80cb38a24e47c776f0fadbff48d921ee30fbc37f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=1, private, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8e52bb7afc36a1e7-YYZ
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 19 Nov 2024 19:50:59 GMT
expect-ct: max-age=86400, enforce
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Tue, 19 Nov 2024 19:50:59 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
priority: u=0,i
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G2c6%2FtS0SvtCusXp5BGp5hlqFpTu9AdlA9W5EmfGdItlMYmUKzyVR2WxHbOGWdIHDJ0vOO95GmGNVyvPFVHnrpBOgpqwThNHXzYAzdnskyuY3Ts4nhCyWz0HszepqG09LmKTaS3XTJU%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC" cfL4;desc="?proto=QUIC&rtt=36996&sent=13&recv=11&lost=0&retrans=0&sent_bytes=4349&recv_bytes=4548&delivery_rate=545&cwnd=12000&unsent_bytes=0&cid=0569738bdedc903e&ts=445&x=1" cfExtPri cfHdrFlush;dur=0
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding
x-cache-nxaccel: BYPASS
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

Redirect headers

Connection: close
Content-Length: 76
Content-Type: text/html; charset=utf-8
Date: Tue, 19 Nov 2024 19:50:58 GMT
Location: https://www.firstfoundation.ca/financial/
Server: ip-10-123-124-15.ec2.internal
Vary: Accept-Encoding
X-Request-Id: 240c0b49-8189-4804-aefa-6c37cc2f9119

GET
H3 200 speculation
www.firstfoundation.ca/cdn-cgi/ 128 B
860 B 70ms
68ms Other
application/speculationrules+json 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstfoundation.ca/cdn-cgi/speculation

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.firstfoundation.ca
Referer: https://www.firstfoundation.ca/financial/

Response headers

expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5RCaVhwGR2ZzlfqLia061WMq11krwi4CVgkbRt1dZi2D%2BP9cMEM80VEkaZmV9aqtVSBQ1b%2FSw9D5HbF3OyQh%2BmzSehpaDeoOx0RDWHUKxnBDhL0zfFpPRTL5UbCA04Ru7Q1D9va%2BOyQ%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=36808&sent=31&recv=25&lost=0&retrans=0&sent_bytes=20223&recv_bytes=6549&delivery_rate=365645&cwnd=13200&unsent_bytes=0&cid=0569738bdedc903e&ts=716&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: application/speculationrules+json
vary: Origin, Accept-Encoding
priority: u=4,i
x-frame-options: SAMEORIGIN
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb7ed90aa1e7-YYZ
access-control-allow-origin: https://www.firstfoundation.ca
content-length: 128
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 above-the-fold.min.1558698904.css
www.firstfoundation.ca/assets/css/ 35 KB
9 KB 70ms
69ms Stylesheet
text/css 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstfoundation.ca/assets/css/above-the-fold.min.1558698904.css

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

98fd14a7dd74f7f92b926b55b1ff8fa04856dcfe3229b757910253ee5fa481a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/financial/

Response headers

x-cache-nxaccel: MISS
cf-cache-status: HIT
etag: W/"8c9e-589a0de7c1600"
age: 6633171
expect-ct: max-age=86400, enforce
content-encoding: br
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ciK1%2FFQxBHp0Vt13tqNvk5fnJraodG0zL0j8i%2F4%2F1XT8ZKq8GmCIF32a6PcnVqSTHyyFkkGrujS1TC5BQVgY0ERzC7ZWRNuGXtwP%2F09VKGsDRf2ruRPXhpQl6Ewwalk5JvVGaADtjbk%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 11 Sep 2024 01:06:12 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=36808&sent=32&recv=25&lost=0&retrans=0&sent_bytes=21106&recv_bytes=6549&delivery_rate=365645&cwnd=13200&unsent_bytes=0&cid=0569738bdedc903e&ts=718&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding
last-modified: Fri, 24 May 2019 11:55:04 GMT
priority: u=0,i=?0
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb7ed90fa1e7-YYZ
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 logo.png
www.firstfoundation.ca/assets/images/ 2 KB
3 KB 63ms
62ms Image
image/webp 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstfoundation.ca/assets/images/logo.png

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d0020742c62697f7ce1453e65054c48333fa7140961f952b5a2d220020a76771

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/financial/

Response headers

x-cache-nxaccel: MISS
cf-bgj: imgq:85,h2pri
etag: "ae9-4e10f1df1fd80"
age: 1401112
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fS3%2BqmV2MgrghEEzjte0e%2FGLm3zAzS0eyjby6xr2cP0eTD2dMpBJEPA%2B%2B0Bq%2Fwtnam7WJ4UCKdAdnX5htG5mmgLEO%2FdH6S6YC6HqzDFGHXBhMj%2FaVhEyOdArncTW4rI8LP3vqHaNXh4%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 04 Oct 2024 01:06:12 GMT
cf-polished: origFmt=png, origSize=2793
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=36808&sent=28&recv=25&lost=0&retrans=0&sent_bytes=16882&recv_bytes=6549&delivery_rate=365645&cwnd=13200&unsent_bytes=0&cid=0569738bdedc903e&ts=709&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: image/webp
content-disposition: inline; filename="logo.webp"
vary: Accept
last-modified: Tue, 09 Jul 2013 07:29:10 GMT
priority: u=2,i
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb7ed912a1e7-YYZ
accept-ranges: bytes
content-length: 2384
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3

200

IIROC_ACPI_LOGO.png
www.firstfoundation.ca/assets/images/
Redirect Chain

https://firstfoundation.ca/assets/images/IIROC_ACPI_LOGO.png
https://www.firstfoundation.ca/assets/images/IIROC_ACPI_LOGO.png

14 KB
15 KB

145ms
144ms

Image
image/webp

172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstfoundation.ca/assets/images/IIROC_ACPI_LOGO.png

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9c902c08b8661f4b92d55e49021b15a5ee1fe2dcf226b3545654832cad3eba17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

x-cache-nxaccel: MISS
cf-bgj: imgq:85,h2pri
etag: "4f7e-5d7c6dd4f2000"
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jjeuS4vfghhsrDUGUqVs5F1ITx5aPmHYFeKW3%2Bld8KzmsAtcTy3x9qJquoX3iR256rFogYofbdc%2FTNsc4oQIAevWA%2FEubo5iW%2FB0NE43DX0b4LQzDHXa9ckM6XjceR%2FrCD4gY1knd4M%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 04 Oct 2024 02:04:45 GMT
cf-polished: origFmt=png, origSize=20350
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=33252&sent=187&recv=108&lost=1&retrans=1&sent_bytes=186658&recv_bytes=17282&delivery_rate=1085320&cwnd=35700&unsent_bytes=0&cid=0569738bdedc903e&ts=1018&x=1", cfExtPri, cfHdrFlush;dur=7
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: image/webp
content-disposition: inline; filename="IIROC_ACPI_LOGO.webp"
vary: Accept
last-modified: Sat, 12 Feb 2022 00:00:00 GMT
priority: u=2,i
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb809ae3a1e7-YYZ
accept-ranges: bytes
content-length: 14372
x-xss-protection: 1; mode=block
server: cloudflare

Redirect headers

x-cache-nxaccel: MISS
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GwSEr7hJ26%2FkpR7EE%2F6qgoLujPig4WBD%2BttALR49HTx%2BqEnJIOr1awTMDnhbDmXO2kgNLlMtIo%2Fq7QqSA04n4IDM9%2Bm85oUN5ff9wlzvcl4XwSmGuyhHakXmW4LHY311I0fFNg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Mon, 21 Oct 2024 17:17:52 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=38966&sent=14&recv=11&lost=0&retrans=0&sent_bytes=5499&recv_bytes=5120&delivery_rate=18271&cwnd=12000&unsent_bytes=0&cid=66601deee9f8936c&ts=139&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: text/html; charset=iso-8859-1
vary: Accept-Encoding
priority: u=2,i
x-frame-options: SAMEORIGIN
cache-control: max-age=345600
location: https://www.firstfoundation.ca/assets/images/IIROC_ACPI_LOGO.png
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb80083da1e0-YYZ
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3

200

Benefits_of_Working_with_a_Certified_Financial_Planner.png
www.firstfoundation.ca/media/imagic/
Redirect Chain

https://firstfoundation.ca/media/imagic/Benefits_of_Working_with_a_Certified_Financial_Planner.png
https://www.firstfoundation.ca/media/imagic/Benefits_of_Working_with_a_Certified_Financial_Planner.png

140 KB
141 KB

145ms
144ms

Image
image/webp

172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstfoundation.ca/media/imagic/Benefits_of_Working_with_a_Certified_Financial_Planner.png

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

582843ef3c94fd8ac34f30ec3efeac9ad8f8236f597122d5b8d510f8b559b6f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

x-cache-nxaccel: MISS
cf-bgj: imgq:85,h2pri
etag: "2a0f2-5a6bc9ae03280"
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jyp34KaoEjP6Fr2bXmGVcAwf5ofsL0KbUW7FX4VNTx4WiEYha8hh4k%2FUItSQI1de%2F3o52GLz6ySFHFBxUYqT7e1uGIYAOW7m0rQrUlos35JAQ5dNfOoa91HZRDcJYUORGDWvmioflQc%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 04 Oct 2024 05:45:09 GMT
cf-polished: origFmt=png, origSize=172274
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=33252&sent=186&recv=107&lost=1&retrans=1&sent_bytes=186633&recv_bytes=16853&delivery_rate=1085320&cwnd=35700&unsent_bytes=0&cid=0569738bdedc903e&ts=1015&x=1", cfExtPri, cfHdrFlush;dur=10
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: image/webp
content-disposition: inline; filename="Benefits_of_Working_with_a_Certified_Financial_Planner.webp"
vary: Accept
last-modified: Thu, 28 May 2020 22:11:06 GMT
priority: u=2,i
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb809ae6a1e7-YYZ
accept-ranges: bytes
content-length: 143762
x-xss-protection: 1; mode=block
server: cloudflare

Redirect headers

x-cache-nxaccel: MISS
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NZ0juNJEIbzGwOgZI3ivf81qxI92wu0FA4ZKfY5dD7X9guT9ndB%2FyWvzdrf119aCt2Rbrdo6FwHj1Qi8uh4u%2FdwqK7SHJwsayPOg3pSjZLk0IaumHHGw4oy5OxwdKEv2uE7X1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 04 Sep 2024 01:08:03 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=38966&sent=15&recv=11&lost=0&retrans=0&sent_bytes=6620&recv_bytes=5120&delivery_rate=18271&cwnd=12000&unsent_bytes=0&cid=66601deee9f8936c&ts=145&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: text/html; charset=iso-8859-1
vary: Accept-Encoding
priority: u=2,i
x-frame-options: SAMEORIGIN
cache-control: max-age=345600
location: https://www.firstfoundation.ca/media/imagic/Benefits_of_Working_with_a_Certified_Financial_Planner.png
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb80083ba1e0-YYZ
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3

200

NORTHERN_ALBERTA_2023_6_YRS_TAG.png
www.firstfoundation.ca/uploads/PM/
Redirect Chain

https://firstfoundation.ca/uploads/PM/NORTHERN_ALBERTA_2023_6_YRS_TAG.png
https://www.firstfoundation.ca/uploads/PM/NORTHERN_ALBERTA_2023_6_YRS_TAG.png

72 KB
73 KB

73ms
72ms

Image
image/webp

172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstfoundation.ca/uploads/PM/NORTHERN_ALBERTA_2023_6_YRS_TAG.png

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3b0d69efedfb89da8e26d3f579de61f3ef732629b672b0fd853eabf2e1c4d5e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

x-cache-nxaccel: MISS
cf-bgj: imgq:85,h2pri
etag: "1c383-60710c1eb8eda"
age: 1401112
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aNB7hRSNUoxLTASJJe5lAtYjDeyQefP356536lKX9L2KF0e5UJxJwIAP4yEbXOaQzAR7p7VZ95ajEr0p7ibO6ZBEEA3CN6qGrFdScOVE2roUaBuY3exW6byBhXxQqfPlTCs5k0yXwy0%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 04 Oct 2024 01:09:47 GMT
cf-polished: origFmt=png, origSize=115587
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=33252&sent=156&recv=107&lost=1&retrans=1&sent_bytes=150933&recv_bytes=16853&delivery_rate=1085320&cwnd=35700&unsent_bytes=0&cid=0569738bdedc903e&ts=1000&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: image/webp
content-disposition: inline; filename="NORTHERN_ALBERTA_2023_6_YRS_TAG.webp"
vary: Accept
last-modified: Fri, 06 Oct 2023 18:53:34 GMT
priority: u=1,i
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb809ae0a1e7-YYZ
accept-ranges: bytes
content-length: 73924
x-xss-protection: 1; mode=block
server: cloudflare

Redirect headers

x-cache-nxaccel: MISS
cf-cache-status: HIT
age: 6633703
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Smi7jpfl6%2F82v8fFQwfpvqJOHNccm9Jl6YIYQg0SbrjUZmXx1zwm5sfDFGNof9QZTkp7bOaeX4fH0rEmOpvzMvt%2BQaXe4UO4JDkAwT%2Fz8KvY0wCZGUmV8%2F6i6U8ga1TqjI2v%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 04 Sep 2024 01:06:34 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=40332&sent=11&recv=9&lost=0&retrans=0&sent_bytes=4260&recv_bytes=5030&delivery_rate=78791&cwnd=12000&unsent_bytes=0&cid=66601deee9f8936c&ts=117&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: text/html; charset=iso-8859-1
vary: Accept-Encoding
priority: u=2,i
x-frame-options: SAMEORIGIN
cache-control: max-age=345600
location: https://www.firstfoundation.ca/uploads/PM/NORTHERN_ALBERTA_2023_6_YRS_TAG.png
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb80083ca1e0-YYZ
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 Refinancing_Ad_250x300_knockout.jpg
www.firstfoundation.ca/uploads/advertisements/ 13 KB
14 KB 119ms
117ms Image
image/webp 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstfoundation.ca/uploads/advertisements/Refinancing_Ad_250x300_knockout.jpg

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

728052b8e174c2e7a80e44b062ddd48561436767f72f842fc4725dfa3fc78bf5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/financial/

Response headers

x-cache-nxaccel: MISS
cf-bgj: imgq:85,h2pri
etag: "b72c-52c646f776280"
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jk6cpx3Fu30CFsSWv4SB26jhEkmihHl8JSUtrh1XPy2VPopWnuLcFaZzDt%2F%2BS4WFiHeEGNcthK5VM7qfLL5phhl5qZeUeD3dTO3VsCWisGvhEgclo7HwkTnEWQsv2JHVWHjwStywFHI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 04 Oct 2024 02:04:46 GMT
cf-polished: qual=85, origFmt=jpeg, origSize=46892
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=44687&sent=64&recv=36&lost=0&retrans=0&sent_bytes=55612&recv_bytes=8920&delivery_rate=28482&cwnd=25200&unsent_bytes=0&cid=0569738bdedc903e&ts=832&x=1", cfExtPri, cfHdrFlush;dur=44
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: image/webp
content-disposition: inline; filename="Refinancing_Ad_250x300_knockout.webp"
vary: Accept
last-modified: Mon, 22 Feb 2016 23:46:02 GMT
priority: u=2,i
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb7f79c5a1e7-YYZ
accept-ranges: bytes
content-length: 13736
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 MPC_69x69.png
www.firstfoundation.ca/assets/images/ 2 KB
3 KB 138ms
136ms Image
image/webp 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstfoundation.ca/assets/images/MPC_69x69.png

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

722d816917f75fb60dfb01bfa0685d0090f009b48eb1c6b602e42f8a51a7d91e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/financial/

Response headers

x-cache-nxaccel: MISS
cf-bgj: imgq:85,h2pri
etag: "11b9-5d7c75b132b80"
age: 1401112
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fxFC7EQYj5Zj8Rc3ibeYjR0EWRfPp7vCGu0s4H5OVE8kU6o%2FVSvf10Td%2BGyRsAXWwIjzTkSM%2Bg0EXSHuuUqO9nHKb9THRv924kbS8MroWYRHqdwugeIglgJ5EZwCFHRwjDGEyDUdkD4%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 04 Oct 2024 01:06:12 GMT
cf-polished: origFmt=png, origSize=4537
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=44687&sent=64&recv=36&lost=0&retrans=0&sent_bytes=55612&recv_bytes=8920&delivery_rate=28482&cwnd=25200&unsent_bytes=0&cid=0569738bdedc903e&ts=814&x=1", cfExtPri, cfHdrFlush;dur=62
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: image/webp
content-disposition: inline; filename="MPC_69x69.webp"
vary: Accept
last-modified: Sat, 12 Feb 2022 00:35:10 GMT
priority: u=3,i
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb7f79c8a1e7-YYZ
accept-ranges: bytes
content-length: 2304
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 IIROC_ACPI_LOGO_80H.png
www.firstfoundation.ca/assets/images/ 20 KB
21 KB 81ms
79ms Image
image/webp 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstfoundation.ca/assets/images/IIROC_ACPI_LOGO_80H.png

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0571ad0ecaab62d8ff77c9bbbf39df5188474855b765e8a9d7a3b8694e8671ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/financial/

Response headers

x-cache-nxaccel: MISS
cf-bgj: imgq:85,h2pri
etag: "787e-5d7c7623a3980"
age: 1401112
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x8GQrm4f5tVujdGl8NP0nsI4ptz1NDm9oZC5buLkgOPmVM%2Bx7sM8ovSiy%2FZUhjYbGg81T7HepDt04Mykpv92WUL%2FGG2Y6uIyRJbSGdq7JjGuZ1VJIBhrmFkfMJXvrYQBRPoJHvK%2FrqA%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Thu, 21 Nov 2024 08:43:45 GMT
cf-polished: origFmt=png, origSize=30846
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=44687&sent=46&recv=36&lost=0&retrans=0&sent_bytes=34884&recv_bytes=8920&delivery_rate=28482&cwnd=25200&unsent_bytes=0&cid=0569738bdedc903e&ts=812&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: image/webp
content-disposition: inline; filename="IIROC_ACPI_LOGO_80H.webp"
vary: Accept
last-modified: Sat, 12 Feb 2022 00:37:10 GMT
priority: u=3,i
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb7f79caa1e7-YYZ
accept-ranges: bytes
content-length: 20780
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 rocket-loader.min.js Show response
www.firstfoundation.ca/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 81ms
79ms Script
application/javascript 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstfoundation.ca/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/financial/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: max-age=172800, public
content-encoding: gzip
etag: W/"673379cd-302c"
speculation-rules: "/cdn-cgi/speculation"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jSYi26JTTRlNseB%2BnK3uwfq7kzKpvHj8kCxB7oGBpdiowaTfLwsPS43Q8vczlXoYfVlxReFNUGri6dsE%2B3eGg8Dwx0esjOJPC49ssgA1JjLObKFtwfHRV15wnm5lxXrc0sqmYko%2BksU%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-ray: 8e52bb7f79cca1e7-YYZ
expires: Thu, 21 Nov 2024 19:50:59 GMT
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: application/javascript
last-modified: Tue, 12 Nov 2024 15:52:45 GMT
vary: Accept-Encoding
server: cloudflare
x-frame-options: DENY

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 184ms
33ms Script
text/javascript 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.firstfoundation.ca
Referer

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 8e52bb806e71a2c9-YUL
access-control-allow-origin: *
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 DawQYnfyLVc
www.youtube.com/embed/ Frame C80A 0
0 263ms
110ms Document
text/html 2607:f8b0:4004:c09::88
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/DawQYnfyLVc

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::88 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: br
content-security-policy: require-trusted-types-for 'script'
content-type: text/html; charset=utf-8
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
cross-origin-resource-policy: cross-origin
date: Tue, 19 Nov 2024 19:50:59 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 top_line.gif
www.firstfoundation.ca/assets/images/ 74 B
960 B 79ms
63ms Image
image/webp 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstfoundation.ca/assets/images/top_line.gif

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/assets/css/above-the-fold.min.1558698904.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4c094182b5cabe9021b8dda00297e5c7c32f83f38619cf094257d5e029299699

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/assets/css/above-the-fold.min.1558698904.css

Response headers

x-cache-nxaccel: MISS
cf-bgj: imgq:85,h2pri
etag: "140-4e10f1df1fd80"
age: 1401112
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q47zsSokRYT%2FBe%2FrWcREXQMbZ9M%2BRIRTSNLsA6T93CwL%2BAWRicKneFFQSPjWxB1AvG3ufuqZbIeXUDUhQP%2F1UxjLpEedvSaIcZeLU5ktfCOor6GeesFHG1V0t0eusEokm%2FPBJMgGpT4%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 04 Oct 2024 01:09:47 GMT
cf-polished: origFmt=gif, origSize=320
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=69717&sent=84&recv=54&lost=0&retrans=0&sent_bytes=76386&recv_bytes=11706&delivery_rate=321992&cwnd=36900&unsent_bytes=0&cid=0569738bdedc903e&ts=892&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: image/webp
content-disposition: inline; filename="top_line.webp"
vary: Accept
last-modified: Tue, 09 Jul 2013 07:29:10 GMT
priority: u=3,i
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb800a37a1e7-YYZ
accept-ranges: bytes
content-length: 74
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 icon_search.gif
www.firstfoundation.ca/assets/images/ 176 B
1 KB 78ms
62ms Image
image/webp 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstfoundation.ca/assets/images/icon_search.gif

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/assets/css/above-the-fold.min.1558698904.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9248f9dcb6b3c9b58999b21bdd10cc2f3a1dd8260679830c5e03db209104d92f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/assets/css/above-the-fold.min.1558698904.css

Response headers

x-cache-nxaccel: MISS
cf-bgj: imgq:85,h2pri
etag: "10d-4e10f1df1fd80"
age: 1297402
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ka2YHLcFeQAwpJ7vEXc6DdrbD%2F3XhKsu975YfeOE5LG7BxLBNJCRCyI%2FuOTI5siJ790zoMZxO788uXlpo3knlYzwSrfTYsC9FBDt%2BoCUEDF7qQAEnPCvuOf%2BditYFcSVIdS80GVwTUs%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 04 Oct 2024 01:09:47 GMT
cf-polished: origFmt=gif, origSize=269
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=69717&sent=83&recv=54&lost=0&retrans=0&sent_bytes=75300&recv_bytes=11706&delivery_rate=321992&cwnd=36900&unsent_bytes=0&cid=0569738bdedc903e&ts=891&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: image/webp
content-disposition: inline; filename="icon_search.webp"
vary: Accept
last-modified: Tue, 09 Jul 2013 07:29:10 GMT
priority: u=3,i
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb800a38a1e7-YYZ
accept-ranges: bytes
content-length: 176
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 bg_squares_half.gif
www.firstfoundation.ca/assets/images/ 44 B
932 B 80ms
64ms Image
image/webp 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstfoundation.ca/assets/images/bg_squares_half.gif

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/assets/css/above-the-fold.min.1558698904.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42094a7705f0d0ea137d847f5636021885167ddd1623c6b0ab54a4862f7722d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/assets/css/above-the-fold.min.1558698904.css

Response headers

x-cache-nxaccel: MISS
cf-bgj: imgq:85,h2pri
etag: "2d-4e10f1df1fd80"
age: 423432
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lhZKdIsHAlVGgk1i93uyoTxTn1UnxtNL7dMPm4vukD4BVIkeLiGxk3IrgiICkKdRd5%2FFpfQWktxvlC%2FjvoDasOWNOeZ9nZheB1S%2FN%2B%2BLjjOwvbpn6T2vfvoILUlFinU6tAN4NWBJUkE%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 04 Oct 2024 01:11:17 GMT
cf-polished: origFmt=gif, origSize=45
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=69717&sent=86&recv=57&lost=0&retrans=0&sent_bytes=77393&recv_bytes=13202&delivery_rate=321992&cwnd=36900&unsent_bytes=0&cid=0569738bdedc903e&ts=895&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: image/webp
content-disposition: inline; filename="bg_squares_half.webp"
vary: Accept
last-modified: Tue, 09 Jul 2013 07:29:10 GMT
priority: u=3,i
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb800a39a1e7-YYZ
accept-ranges: bytes
content-length: 44
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 bg_squares_blue_half.gif
www.firstfoundation.ca/assets/images/ 37 B
878 B 85ms
69ms Image
image/gif 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstfoundation.ca/assets/images/bg_squares_blue_half.gif

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/assets/css/above-the-fold.min.1558698904.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c354a3788639ae9e83bd8fe20b0ddcbe5178ed69ec39fcd7a50183e8695de3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/assets/css/above-the-fold.min.1558698904.css

Response headers

x-cache-nxaccel: MISS
cf-bgj: imgq:85,h2pri
etag: "25-4e10f1df1fd80"
age: 1197505
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qd0Qe75FtOlIs28pW479YUVHaIfIbbM8ZOoJVT0sYVCamlJ3j%2Fu38I5BTAmqGxHcvQulxpuA6Ci9zOGVcHWFLEaFoIImQ2WlnhWUY9ivHD2mXcMxu4XAeBaYXNVXKUfSGHRskUHxmxg%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Thu, 28 Nov 2024 05:41:17 GMT
cf-polished: status=not_needed
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=69717&sent=87&recv=57&lost=0&retrans=0&sent_bytes=78348&recv_bytes=13202&delivery_rate=321992&cwnd=36900&unsent_bytes=0&cid=0569738bdedc903e&ts=895&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: image/gif
last-modified: Tue, 09 Jul 2013 07:29:10 GMT
vary: Accept-Encoding
priority: u=3,i
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb800a3ba1e7-YYZ
accept-ranges: bytes
content-length: 37
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 normal.woff2
www.firstfoundation.ca/cf-fonts/s/titillium-web/5.0.18/latin/700/ 12 KB
12 KB 66ms
64ms Font
font/woff2 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstfoundation.ca/cf-fonts/s/titillium-web/5.0.18/latin/700/normal.woff2

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5c1172f24f4f49f780c65cf5be897527fd08f3662a2ba8db0cfe0057d92e367

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.firstfoundation.ca
Referer: https://www.firstfoundation.ca/financial/

Response headers

cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qncalYFXDOd4jMDb6Be6VwN79lhlAH%2BRaEm4q3ThiNSrWJZ9p3%2BMbi%2BvkRhNhAu17I%2Fim8gjoDw7%2Fb66CSKq3XQx5j900m7gv88Ys5s2Dx9Bm713jjUln9f0dwOQii4Gmbqu%2BqJbXlg%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=47636&sent=108&recv=69&lost=0&retrans=0&sent_bytes=103249&recv_bytes=13735&delivery_rate=547312&cwnd=36900&unsent_bytes=0&cid=0569738bdedc903e&ts=913&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: font/woff2
vary: Accept-Encoding
priority: u=0,i=?0
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb801a62a1e7-YYZ
content-length: 11796
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 normal.woff2
www.firstfoundation.ca/cf-fonts/s/titillium-web/5.0.18/latin/400/ 12 KB
13 KB 76ms
75ms Font
font/woff2 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstfoundation.ca/cf-fonts/s/titillium-web/5.0.18/latin/400/normal.woff2

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

557f6d0883db85be712c3a77baa38875ddf99ecbdfd6fec98e5c0b1f7a0e1532

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.firstfoundation.ca
Referer: https://www.firstfoundation.ca/financial/

Response headers

cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z60bKmXt4zmsPtEHGBlitgsPlJwIcoxPX29fHcuTQxK%2FK6chPI30CyF18bKBuLzJDFnP1mYVKPjCQks9jDrCtJUnUZV6AAumysdHjJCm5eX6VXQHJk6y7V%2BNLILBfgl2kkAaonOGf6E%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=47636&sent=116&recv=69&lost=0&retrans=0&sent_bytes=112224&recv_bytes=13735&delivery_rate=547312&cwnd=36900&unsent_bytes=0&cid=0569738bdedc903e&ts=913&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: font/woff2
vary: Accept-Encoding
priority: u=0,i=?0
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb801a63a1e7-YYZ
content-length: 12372
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 conversion.js Show response
www.googleadservices.com/pagead/ 57 KB
21 KB 150ms
46ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f155.1e100.net

Software

cafe /

Resource Hash

2afbb070041e90cc1fa5caa5977c70df5edf1c5ccf89c7f26555c26c4e0b8964

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 8111398889547165922
x-content-type-options: nosniff
expires: Tue, 19 Nov 2024 19:50:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 21070
x-xss-protection: 0
server: cafe

GET
H3 200 site.min.1558698618.js Show response
www.firstfoundation.ca/assets/js/ 118 KB
42 KB 59ms
57ms Script
application/javascript 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstfoundation.ca/assets/js/site.min.1558698618.js

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

52857bee99477d24edf782b102f00e242d58e1e754cfb9f0fc60bd86840fdca9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/financial/

Response headers

x-cache-nxaccel: MISS
cf-cache-status: HIT
etag: W/"1d8ee-589a0cd701280"
age: 1401112
expect-ct: max-age=86400, enforce
content-encoding: br
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b4e0DscU9j3jjas%2Fs6CffxIqoSYlGAg8netl58vtLU5EPL19cfkqTZCTYyfp%2FC%2BipfmaNGxvIQxTg%2BmcLJb40W1KE9zk%2BYlFE7obZZu%2FYqWqMm3HcA4c7KNU%2FC9KuemzTB1gb2k2nCs%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 11 Sep 2024 01:09:47 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=69717&sent=88&recv=57&lost=0&retrans=0&sent_bytes=79249&recv_bytes=13202&delivery_rate=321992&cwnd=36900&unsent_bytes=0&cid=0569738bdedc903e&ts=912&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:50:59 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding
last-modified: Fri, 24 May 2019 11:50:18 GMT
priority: u=1,i=?0
x-frame-options: SAMEORIGIN
cache-control: private, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb801a65a1e7-YYZ
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 40126763331952 Show response
form.jotform.com/jsform/ 9 KB
3 KB 262ms
49ms Script
text/javascript 35.201.118.58
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://form.jotform.com/jsform/40126763331952
Requested by: Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.118.58 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: CacheX v3.3.3 /
Resource Hash: 64d16a7cbc09c7b011facb6ee8be20b7e3656b76a12a7869af431a44f033db8c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache
cache-hit: L2
content-encoding: gzip
via: 1.1 google
expires: Thu, 01 Jan 1970 00:00:01 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 19 Nov 2024 19:51:00 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
server: CacheX v3.3.3

GET
H3

200

main.js Show response
www.firstfoundation.ca/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/ Frame CEF9
Redirect Chain

https://www.firstfoundation.ca/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://www.firstfoundation.ca/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?

8 KB
4 KB

62ms
56ms

Script
application/javascript

172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstfoundation.ca/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c439622dce5e39ff863f7505676dd095554af4f2698889e94ab6e53e8e31f3cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z%2BOvxTQ0rg0GSDsX%2BKmJw3ImaHosT74%2B1GYW2qUeSyzVycmZiUvO4Xg%2F8dcQxZKf%2BleFhlbnuUeNO2o4vOh2X2TbINNoy72TpCd3o2vF%2FUb9Z0UVujrRB24HhqGoQGT87VJySjDOMWk%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=35634&sent=376&recv=182&lost=2&retrans=2&sent_bytes=398748&recv_bytes=22515&delivery_rate=542622&cwnd=39300&unsent_bytes=0&cid=0569738bdedc903e&ts=1317&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:51:00 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
priority: u=3,i=?0
x-frame-options: SAMEORIGIN
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb82adaea1e7-YYZ
x-xss-protection: 1; mode=block
server: cloudflare

Redirect headers

expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gtLbQ4ek2l8P0PvrolePG7YEL9IuE2o%2F%2B%2BvpqR3CYCYjMW9gW%2BXFACgqth3FTsaoQkKZu5qzV5WGy2zbYMGmmiReRTcD8kz0l%2FfwsXFvkR%2B07XqadBRHPfpecnf%2BRF9Pn0pcqQ0uzfI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=32186&sent=189&recv=110&lost=1&retrans=1&sent_bytes=189058&recv_bytes=17372&delivery_rate=97066&cwnd=35700&unsent_bytes=0&cid=0569738bdedc903e&ts=1026&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:50:59 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-frame-options: SAMEORIGIN
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb80db7da1e7-YYZ
access-control-allow-origin: *
content-length: 0
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 s.js Show response
www.firstfoundation.ca/cdn-cgi/zaraz/ 7 KB
5 KB 239ms
238ms Script
text/javascript 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstfoundation.ca/cdn-cgi/zaraz/s.js?z=JTdCJTIyZXhlY3V0ZWQlMjIlM0ElNUIlNUQlMkMlMjJ0JTIyJTNBJTIyRmluYW5jaWFsJTIwUGxhbm5pbmclMjBhbmQlMjBXZWFsdGglMjBBZHZpc29yJTIwU2VydmljZXMlMjAlN0MlMjBFZG1vbnRvbiUyMENhbGdhcnklMjAlN0MlMjBGaXJzdCUyMEZvdW5kYXRpb24lMjIlMkMlMjJ4JTIyJTNBMC4zNTY3ODY2MzY1OTY3NjMzNSUyQyUyMnclMjIlM0ExNjAwJTJDJTIyaCUyMiUzQTEyMDAlMkMlMjJqJTIyJTNBMTIwMCUyQyUyMmUlMjIlM0ExNjAwJTJDJTIybCUyMiUzQSUyMmh0dHBzJTNBJTJGJTJGd3d3LmZpcnN0Zm91bmRhdGlvbi5jYSUyRmZpbmFuY2lhbCUyRiUyMiUyQyUyMnIlMjIlM0ElMjIlMjIlMkMlMjJrJTIyJTNBMjQlMkMlMjJuJTIyJTNBJTIyVVRGLTglMjIlMkMlMjJvJTIyJTNBNDgwJTJDJTIycSUyMiUzQSU1QiU1RCU3RA==

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ca980c158b7d8771a935e2b5c44849e7c397196fcb67a7ce969def29d7a94b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/

Response headers

x-robots-tag: none
access-control-max-age: 600
content-encoding: br
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nOcbfPXcNRzdBnMRVvnOjiZewzXX6LtiKolcxEX6r%2B9dchVC41tlyjVADQSp64mDLwN12VrAoFTKTy7dkDou%2B3M5BWsfnkSBxvPplXvgZ9Exxr%2BHLYgDNn8JITrvuwl2aSLT7cX7sL4%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET, HEAD, POST, OPTIONS
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=29689&sent=219&recv=117&lost=1&retrans=1&sent_bytes=223583&recv_bytes=18551&delivery_rate=1443861&cwnd=36900&unsent_bytes=0&cid=0569738bdedc903e&ts=1067&x=1", cfExtPri, cfHdrFlush;dur=6
date: Tue, 19 Nov 2024 19:51:00 GMT
content-type: text/javascript; charset=utf-8
vary: Origin, Accept-Encoding
priority: u=3,i=?0
access-control-allow-headers: Content-Type, Set-Cookie, Cache-Control
x-frame-options: SAMEORIGIN
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
access-control-allow-credentials: true
referrer-policy: same-origin
cf-ray: 8e52bb810ba3a1e7-YYZ
access-control-allow-origin: https://www.firstfoundation.ca
x-xss-protection: 1; mode=block
server: cloudflare

POST
H2 204 collect Show response
stats.g.doubleclick.net/g/ 0
559 B 371ms
161ms XHR
text/plain 2607:f8b0:4004:c17::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=G-CD6W6EB7M8&cid=e12fc2f5-0265-4070-8e6f-fba471023053&_u=KGDAAEADQAAAAC%7E&z=740191102
Requested by: Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c17::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.firstfoundation.ca
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 19 Nov 2024 19:51:00 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 o.js Show response
www.websiteoptimizer.dev/ 43 KB
18 KB 328ms
67ms Script
text/javascript 2607:f8b0:4004:c08::79
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websiteoptimizer.dev/o.js
Requested by: Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c08::79 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: eb20c970de33a17c3eeb82357e79fb0d02aed49581c64a3bed6aee75d2eaa90a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cache-control: public, max-age=3600
content-encoding: gzip
etag: "DhMCnA"
age: 1579
expires: Tue, 19 Nov 2024 20:24:41 GMT
content-length: 18232
date: Tue, 19 Nov 2024 19:24:41 GMT
x-cloud-trace-context: ffbbd4a8cfd6e6797c205299f8a790b1
content-type: text/javascript
server: Google Frontend

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
0 613ms
426ms Fetch
image/gif 172.253.115.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&v=1&_v=j86&tid=G-CD6W6EB7M8&cid=e12fc2f5-0265-4070-8e6f-fba471023053&_u=KGDAAEADQAAAAC%7E&z=740191102&slf_rd=1

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/cdn-cgi/zaraz/s.js?z=JTdCJTIyZXhlY3V0ZWQlMjIlM0ElNUIlNUQlMkMlMjJ0JTIyJTNBJTIyRmluYW5jaWFsJTIwUGxhbm5pbmclMjBhbmQlMjBXZWFsdGglMjBBZHZpc29yJTIwU2VydmljZXMlMjAlN0MlMjBFZG1vbnRvbiUyMENhbGdhcnklMjAlN0MlMjBGaXJzdCUyMEZvdW5kYXRpb24lMjIlMkMlMjJ4JTIyJTNBMC4zNTY3ODY2MzY1OTY3NjMzNSUyQyUyMnclMjIlM0ExNjAwJTJDJTIyaCUyMiUzQTEyMDAlMkMlMjJqJTIyJTNBMTIwMCUyQyUyMmUlMjIlM0ExNjAwJTJDJTIybCUyMiUzQSUyMmh0dHBzJTNBJTJGJTJGd3d3LmZpcnN0Zm91bmRhdGlvbi5jYSUyRmZpbmFuY2lhbCUyRiUyMiUyQyUyMnIlMjIlM0ElMjIlMjIlMkMlMjJrJTIyJTNBMjQlMkMlMjJuJTIyJTNBJTIyVVRGLTglMjIlMkMlMjJvJTIyJTNBNDgwJTJDJTIycSUyMiUzQSU1QiU1RCU3RA==

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f99.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.firstfoundation.ca
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 19 Nov 2024 19:51:00 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H3 200 8e52bb7afc36a1e7 Show response
www.firstfoundation.ca/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame CEF9 0
1 KB 106ms
99ms XHR
text/plain 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstfoundation.ca/cdn-cgi/challenge-platform/h/b/jsd/r/8e52bb7afc36a1e7

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FfnBsJIqNG%2BBUcx4UjwhhpHw9lb1MjRCt19ixPwI90ryqvJI6BDYFfrKeJU8Id4y276R2Pq04gIZZ2teEiV3dmfCincYGzGWORmtZdlqWHHxZGA3vmE1N3Io4QFrss3xEoNCwsEk7%2BM%3D"}],"group":"cf-nel","max_age":604800}
referrer-policy: same-origin
x-content-type-options: nosniff
cf-ray: 8e52bb8558f2a1e7-YYZ
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=34383&sent=389&recv=200&lost=2&retrans=2&sent_bytes=403605&recv_bytes=40567&delivery_rate=94877&cwnd=39300&unsent_bytes=0&cid=0569738bdedc903e&ts=1757&x=1", cfExtPri, cfHdrFlush;dur=0
content-length: 0
date: Tue, 19 Nov 2024 19:51:00 GMT
x-xss-protection: 1; mode=block
content-type: text/plain; charset=UTF-8
server: cloudflare
priority: u=1,i
x-frame-options: SAMEORIGIN

GET
H3 200 / Show response
optimize.websiteoptimizer.dev/ 8 B
643 B 169ms
59ms Fetch
application/json 172.67.159.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://optimize.websiteoptimizer.dev/?accountId=S1uUfPNatxaJR8EM1m&hk=ce302452-d2c2-4503-8f17-345462290aa2&url=https%3A%2F%2Fwww.firstfoundation.ca%2Ffinancial%2F
Requested by: Host: www.websiteoptimizer.dev
URL: https://www.websiteoptimizer.dev/o.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.159.29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f6931c925674dba9b7190945a6ee268271c9804dce70a73823092119ab4a106

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RygoahmhheJwsjm55d9Kqtr72NywhX6M9zKKx89csj7ubAys5tcMeWV9i4%2FoU9gAFEPLI9kO%2FCzB4EWzeoirZkHlrED1oxUP0EBuzpbhwSKDlRRNuAB7V374yvccP5Gxx7tbFro6rdkfZgHUDzs9jQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
cf-ray: 8e52bb86588fabca-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 8
server-timing: cfL4;desc="?proto=QUIC&rtt=31992&sent=11&recv=7&lost=0&retrans=0&sent_bytes=4044&recv_bytes=4359&delivery_rate=87437&cwnd=12000&unsent_bytes=0&cid=a69da7b11b32b670&ts=82&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:51:00 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
priority: u=1,i
access-control-allow-headers: *

POST
H2 200 m Show response
www.websiteoptimizer.dev/ 2 B
211 B 95ms
90ms XHR
text/html 2607:f8b0:4004:c08::79
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websiteoptimizer.dev/m
Requested by: Host: www.websiteoptimizer.dev
URL: https://www.websiteoptimizer.dev/o.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c08::79 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend / Express
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json; charset=UTF-8
Referer

Response headers

etag: W/"2-eoX0dku9ba8cNUXvu/DyeabcC+s"
access-control-allow-credentials: true
access-control-allow-origin: https://www.firstfoundation.ca
content-length: 2
date: Tue, 19 Nov 2024 19:51:00 GMT
x-cloud-trace-context: 259f697648b1643cf0f010b32f4fd474
content-type: text/html; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Origin

OPTIONS
H2 204 m
www.websiteoptimizer.dev/ Frame 0
0 175ms
78ms Preflight
text/html 2607:f8b0:4004:c08::79
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websiteoptimizer.dev/m
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c08::79 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.firstfoundation.ca
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: https://www.firstfoundation.ca
content-length: 0
content-type: text/html
date: Tue, 19 Nov 2024 19:51:00 GMT
server: Google Frontend
vary: Origin, Access-Control-Request-Headers
x-cloud-trace-context: 276c407e69654ef8841a82d744d2ebd0
x-powered-by: Express

GET
H3 200 the-rest.min.1644947054.css
www.firstfoundation.ca/assets/css/ 112 KB
41 KB 96ms
66ms Stylesheet
text/css 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstfoundation.ca/assets/css/the-rest.min.1644947054.css

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b2aad7de9f37c25ab9bba96cd7d4f3dbf5141dce270b4ea93649b0f8e8ad405a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/financial/

Response headers

x-cache-nxaccel: MISS
cf-cache-status: HIT
etag: W/"1bf22-5d81214d3f780"
age: 6629217
expect-ct: max-age=86400, enforce
content-encoding: br
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5e%2FaJC%2F3iwQPeqmYObMEpttvBdLOjk6Cu1ZYPLBAE094rXY4lGNJXiTmQnLUxZ6TQn4ghWeLwj0Pqt5mS37qefV2ar3UQ91tQH%2F3LP6%2F1xkZRH9oKH%2Fu2yUzmI8SA2mKB%2B%2BfLhs4JLQ%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 11 Sep 2024 01:09:48 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=37161&sent=392&recv=204&lost=2&retrans=2&sent_bytes=404891&recv_bytes=42156&delivery_rate=14651&cwnd=39300&unsent_bytes=0&cid=0569738bdedc903e&ts=2360&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:51:01 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding
last-modified: Tue, 15 Feb 2022 17:44:14 GMT
priority: u=4,i=?0
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb890d94a1e7-YYZ
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 348 KB
114 KB 541ms
65ms Script
application/javascript 2607:f8b0:4004:c0b::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TKV3CR

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2cbb99c878e148ca31c336f001a92be83fb794dde81b9ff29a3269de3f014cc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Tue, 19 Nov 2024 19:51:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 19 Nov 2024 19:51:01 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 19 Nov 2024 18:34:50 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 115977
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 all.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 506ms
48ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

6d64b3e6d660cf532e5caab1321e005247990a345d2711286c96bc2e027c32cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-md5: PNMj6wzhN7i40aYiYpZM8w==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "132fcb8ab36dd82c31c7472aff9925bf"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Tue, 19 Nov 2024 19:54:15 GMT
alt-svc: h3=":443"; ma=86400
date: Tue, 19 Nov 2024 19:51:01 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: f5230b53ee287d8882388d3f284d4598
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=45, rtx=0, c=23, mss=1232, tbw=4621, tp=12, tpl=0, uplat=1, ullat=-1
x-fb-debug: 9f2Bahb4bFFcX3BixJ4gvzJtOUTvD4DYyCkYAbAcjdIDB1yqPOC15tvphzgaKIWH49MgWqUTslgO5hlsUDwGcQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 1683
origin-agent-cluster: ?1

GET
H2 200 plusone.js Show response
apis.google.com/js/ 63 KB
24 KB 513ms
38ms Script
text/javascript 2607:f8b0:4004:c1b::8b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/plusone.js

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::8b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0f3af1e716ce7846e7c252ace160c12480d41eecd5a7e7917ee5b2ccde62b51

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
etag: "657bf145b0a7c685"
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
x-content-type-options: nosniff
expires: Tue, 19 Nov 2024 19:51:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 19 Nov 2024 19:51:01 GMT
content-type: text/javascript
vary: Accept-Encoding
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
cache-control: private, max-age=1800, stale-while-revalidate=1800
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="gapi-team"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24185
x-xss-protection: 0
server: sffe

GET
H2 200 40126763331952
form.jotform.com/ Frame D86E 0
0 142ms
55ms Document
text/html 35.201.118.58
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://form.jotform.com/40126763331952?parentURL=https%3A%2F%2Fwww.firstfoundation.ca%2Ffinancial%2F&jsForm=true
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/jsform/40126763331952
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.118.58 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: CacheX v3.3.3 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache
cache-hit: L2
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 19 Nov 2024 19:51:01 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
server: CacheX v3.3.3
vary: Accept-Encoding
via: 1.1 google

GET
H/1.1 200 widget Show response
salesiq.zoho.com/ 156 KB
47 KB 759ms
287ms Script
text/javascript 136.143.183.67
ZOHO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://salesiq.zoho.com/widget

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

136.143.183.67 , United States, ASN2639 (ZOHO-AS, US),

Reverse DNS

Software

ZGS /

Resource Hash

dcddb9676e92b45706247e9b90e10fe35f3eee12a952f29608a3655ac3334a86

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Encoding: gzip
ETag: W/9cb39c082de8f63d246dd83e69ec67e178bbcc601b9a32ea4253add8544b615e
X-Content-Type-Options: nosniff
Expires: Tue, 19 Nov 2024 19:56:01 GMT
Date: Tue, 19 Nov 2024 19:51:01 GMT
Content-Type: text/javascript;charset=UTF-8
vary: accept-encoding
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=63072000
Cache-Control: must-revalidate
Pragma
Connection: keep-alive
Access-Control-Allow-Origin: *
Encoding: UTF-8
Server: ZGS

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1061587441/ 5 KB
2 KB 126ms
51ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1061587441/?random=1732045861258&cv=9&fst=1732045861258&num=1&label=wP4UCKeyzwIQ8ZOa-gM&guid=ON&resp=GooglemKTybQhCsO&eid=375603261%2C466465926%2C512247839&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=-480&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.firstfoundation.ca%2Ffinancial%2F&tiba=Financial%20Planning%20and%20Wealth%20Advisor%20Services%20%7C%20Edmonton%20Calgary%20%7C%20First%20Foundation&hn=www.googleadservices.com&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

e4af11c5ebceb25b1008b7f80ab76ac1c6600b7a9693d7549535a6f4825f997e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2367
date: Tue, 19 Nov 2024 19:51:01 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 firstfoundation.ttf
www.firstfoundation.ca/assets/fonts/ 1 KB
1 KB 50ms
43ms Font
font/ttf 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstfoundation.ca/assets/fonts/firstfoundation.ttf?-l24jn4

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/assets/css/above-the-fold.min.1558698904.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d50734aaa7ef52888e0d962d54ae9163d265b61a729c735170653b07691ef3ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.firstfoundation.ca
Referer: https://www.firstfoundation.ca/assets/css/above-the-fold.min.1558698904.css

Response headers

x-cache-nxaccel: MISS
cf-cache-status: HIT
etag: W/"504-51a5fd6f2b980"
age: 1297403
expect-ct: max-age=86400, enforce
content-encoding: br
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1tW4NAWw4hkzbLiA2NnrJpamOv2IPVl6BOVDLE%2FdKFItVdAM6B6gAGvWS8FxtEtFjNfDtTj%2FzBdwjwEBl2JUx0T5z3xDUS9keXBmjci63JQotkfhtUS236GD6Cuyn9VPMTlcUeW%2FseM%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Thu, 05 Sep 2024 01:11:18 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=31980&sent=430&recv=215&lost=2&retrans=2&sent_bytes=447442&recv_bytes=44091&delivery_rate=612590&cwnd=39300&unsent_bytes=0&cid=0569738bdedc903e&ts=2399&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:51:01 GMT
content-type: font/ttf
last-modified: Wed, 08 Jul 2015 16:43:34 GMT
vary: Accept-Encoding
priority: u=0,i=?0
x-frame-options: SAMEORIGIN
cache-control: max-age=345600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb896e08a1e7-YYZ
access-control-allow-origin: *
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 DawQYnfyLVc
www.youtube.com/embed/ Frame D83A 0
0 105ms
101ms Document
text/html 172.253.63.93
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/DawQYnfyLVc

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/assets/js/site.min.1558698618.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.93 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f93.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: br
content-security-policy: require-trusted-types-for 'script'
content-type: text/html; charset=utf-8
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
cross-origin-resource-policy: cross-origin
date: Tue, 19 Nov 2024 19:51:01 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 8e52bb7afc36a1e7 Show response
www.firstfoundation.ca/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame CEF9 0
1 KB 50ms
42ms XHR
text/plain 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstfoundation.ca/cdn-cgi/challenge-platform/h/b/jsd/r/8e52bb7afc36a1e7

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6ddVYgsnC9EXAmlWEPIlyHePoR%2BO0r%2FzukbO0E19niGGPB8NXNxj9yRm4Fqa3mg8rNxEfKXpg8qdeg01iNZp0xhol4zqio%2BFfGUOIjGCtxTk%2F3AilLr%2Bi6JcRG5JLqgNUxHeXx2BNNo%3D"}],"group":"cf-nel","max_age":604800}
referrer-policy: same-origin
x-content-type-options: nosniff
cf-ray: 8e52bb8c8974a1e7-YYZ
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=30684&sent=441&recv=234&lost=2&retrans=2&sent_bytes=449170&recv_bytes=62559&delivery_rate=60677&cwnd=39300&unsent_bytes=0&cid=0569738bdedc903e&ts=2900&x=1", cfExtPri, cfHdrFlush;dur=0
content-length: 0
date: Tue, 19 Nov 2024 19:51:01 GMT
x-xss-protection: 1; mode=block
content-type: text/plain; charset=UTF-8
server: cloudflare
priority: u=1,i
x-frame-options: SAMEORIGIN

POST
H3 204 rum Show response
www.firstfoundation.ca/cdn-cgi/ 0
146 B 51ms
48ms XHR
text/plain 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstfoundation.ca/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
content-type: application/json
Referer: https://www.firstfoundation.ca/financial/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
x-content-type-options: nosniff
cf-ray: 8e52bb8ca99ea1e7-YYZ
access-control-allow-origin: https://www.firstfoundation.ca
date: Tue, 19 Nov 2024 19:51:01 GMT
vary: Origin
server: cloudflare
x-frame-options: DENY

GET
H3 304 the-rest.min.1644947054.css
www.firstfoundation.ca/assets/css/ 112 KB
820 B 54ms
52ms Stylesheet
text/css 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstfoundation.ca/assets/css/the-rest.min.1644947054.css

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b2aad7de9f37c25ab9bba96cd7d4f3dbf5141dce270b4ea93649b0f8e8ad405a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

If-None-Match: W/"1bf22-5d81214d3f780"
Referer: https://www.firstfoundation.ca/financial/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
If-Modified-Since: Tue, 15 Feb 2022 17:44:14 GMT

Response headers

x-cache-nxaccel: MISS
cf-cache-status: HIT
etag: "1bf22-5d81214d3f780"
age: 6629217
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X3JhG9Z7lJTSbwSjonNCtP8Q%2B0FMN38voR823OlOSDDYfBSJyqPUgX%2BatRQn80Ad%2BIO852Hc%2F19BGVsBVpbeQPbnCyogFphUG9%2FrTAJRpttU%2Fz5vYXUGwLnPfhbb2XHU1SI60ZSvnAM%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 11 Sep 2024 01:09:48 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=30684&sent=448&recv=242&lost=2&retrans=2&sent_bytes=451914&recv_bytes=69066&delivery_rate=60677&cwnd=39300&unsent_bytes=0&cid=0569738bdedc903e&ts=2923&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:51:01 GMT
last-modified: Tue, 15 Feb 2022 17:44:14 GMT
vary: Accept-Encoding, Accept-Encoding
priority: u=0,i=?0
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb8ca9a4a1e7-YYZ
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 favicon.png
www.firstfoundation.ca/assets/images/ 320 B
1 KB 54ms
53ms Other
image/webp 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstfoundation.ca/assets/images/favicon.png

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f29a6f1cb7b1d47b9737448d5f34e2e6aa7152fa73119953f00f07c6dade9f3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/financial/

Response headers

x-cache-nxaccel: MISS
cf-bgj: imgq:85,h2pri
etag: "219-4e10f1df1fd80"
age: 519076
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P30RQrdgucVCRl1Yi8PeUMIxFl9XpexTzl73SpTKKRo%2FPvPmQqbLx3d4NnX%2FSrZrDM0UG4W7Qc%2FS55ep%2Ff506Mu%2FDbeWb9H3U4gJ%2BmeU4sh%2F49%2Ff9J%2FIG0bZ5acy4qC%2FFSTdAUp2BlU%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 04 Oct 2024 01:18:12 GMT
cf-polished: origFmt=png, origSize=537
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=30684&sent=446&recv=242&lost=2&retrans=2&sent_bytes=450652&recv_bytes=69066&delivery_rate=60677&cwnd=39300&unsent_bytes=0&cid=0569738bdedc903e&ts=2923&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:51:01 GMT
content-type: image/webp
content-disposition: inline; filename="favicon.webp"
vary: Accept
last-modified: Tue, 09 Jul 2013 07:29:10 GMT
priority: u=1,i
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb8ca9a2a1e7-YYZ
accept-ranges: bytes
content-length: 320
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 /
www.google.com/pagead/1p-user-list/1061587441/ 42 B
64 B 55ms
52ms Image
image/gif 172.253.115.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1061587441/?random=1732045861258&cv=9&fst=1732042800000&num=1&label=wP4UCKeyzwIQ8ZOa-gM&guid=ON&resp=GooglemKTybQhCsO&eid=375603261%2C466465926%2C512247839&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=-480&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.firstfoundation.ca%2Ffinancial%2F&tiba=Financial%20Planning%20and%20Wealth%20Advisor%20Services%20%7C%20Edmonton%20Calgary%20%7C%20First%20Foundation&hn=www.googleadservices.com&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7dr-SpSUCONPjjuvfhlIpQMUyLvBfGKw&random=3043866260&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f99.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 19 Nov 2024 19:51:01 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.ca/pagead/1p-user-list/1061587441/ 42 B
64 B 213ms
57ms Image
image/gif 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/1061587441/?random=1732045861258&cv=9&fst=1732042800000&num=1&label=wP4UCKeyzwIQ8ZOa-gM&guid=ON&resp=GooglemKTybQhCsO&eid=375603261%2C466465926%2C512247839&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=-480&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.firstfoundation.ca%2Ffinancial%2F&tiba=Financial%20Planning%20and%20Wealth%20Advisor%20Services%20%7C%20Edmonton%20Calgary%20%7C%20First%20Foundation&hn=www.googleadservices.com&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7dr-SpSUCONPjjuvfhlIpQMUyLvBfGKw&random=3043866260&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 19 Nov 2024 19:51:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 all.js Show response
connect.facebook.net/en_US/ 256 KB
75 KB 41ms
40ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js?hash=052bda07d7ed01353dfcdebb7eee040f

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

120586eaae170e250262335a56a47edd5b8f27e2993b37bc4747a88712fbbbdf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.firstfoundation.ca
Referer

Response headers

content-md5: XDSO4TcRliC/SqU+bnb+mw==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "40618f05d3010f5d17e18028732f3033"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Wed, 19 Nov 2025 17:30:24 GMT
alt-svc: h3=":443"; ma=86400
date: Tue, 19 Nov 2024 19:51:01 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: b33f291cfae9f8a746f4527534241733
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: UNKNOWN; q=-1, rtt=-1, rtx=0, c=20, mss=1232, tbw=1825, tp=5, tpl=0, uplat=0, ullat=-1
x-fb-debug: TV/Tq0gTOWkvACL2g+OOHnz4ijJsFlBUn27+regb/Tyj/+6pn42cZDfPlTPtkh/fK6k00a+z3FBPFeqZdBa0lw==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 76217
origin-agent-cluster: ?1

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.N4A9eqvTwsI.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo_O6fwbR1aR8YHQkB3I0FTV0L0UIA/ 155 KB
54 KB 40ms
35ms Script
text/javascript 2607:f8b0:4004:c1b::8b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.N4A9eqvTwsI.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo_O6fwbR1aR8YHQkB3I0FTV0L0UIA/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::8b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54ccfcc9fc6ef004a9ab606b1e4517c8b900573ffadd35f9a3ba2dd1fd6e9ad7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
age: 351648
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
x-content-type-options: nosniff
expires: Sat, 15 Nov 2025 18:10:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 15 Nov 2024 18:10:13 GMT
last-modified: Thu, 10 Oct 2024 20:03:27 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
accept-ranges: bytes
access-control-allow-origin: *
content-length: 54429
x-xss-protection: 0
server: sffe

POST
H3 200 collect
www.google.com/ccm/ 0
0 65ms
64ms Ping
text/plain 172.253.115.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.firstfoundation.ca%2Ffinancial%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=714584108.1732045862&auid=469264080.1732045862&npa=0&gtm=45He4be0v6850853za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102077855&tft=1732045861973&tfd=3928&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKV3CR
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.253.115.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bg-in-f99.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 429 KB
134 KB 75ms
74ms Script
application/javascript 2607:f8b0:4004:c0b::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CD6W6EB7M8&l=dataLayer&cx=c&gtm=45He4be0v6850853za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKV3CR

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

27ef1a83a86eac683b6eab53ebb6c3b8182882745950d0ca849d4289d029eeaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 19 Nov 2024 19:51:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 19 Nov 2024 19:51:02 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 137050
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 143ms
38ms Script
text/javascript 2607:f8b0:4004:c07::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKV3CR

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
age: 6457
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Tue, 19 Nov 2024 20:03:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 19 Nov 2024 18:03:25 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 247 KB
89 KB 103ms
102ms Script
application/javascript 2607:f8b0:4004:c0b::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-1061587441&l=dataLayer&cx=c&gtm=45He4be0v6850853za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKV3CR

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b8fab111e8acd28ec2f28e8d2451dc8204a4096eab1c17ba05f2aac5d58e7e63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Tue, 19 Nov 2024 19:51:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 19 Nov 2024 19:51:02 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 19 Nov 2024 18:34:50 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 90754
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 239 KB
61 KB 48ms
36ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/financial/

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

43a683165a27224ef2d2717bd57c8c203aa570ce39140504d086562eefbb0f1f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src 'nonce-2tWxcDkR' .fbcdn.net .facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Tue, 19 Nov 2024 19:51:02 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-2tWxcDkR' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=42, rtx=0, c=26, mss=1232, tbw=8493, tp=18, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: P5ypWChYt+2meTP/tDlzwn0eMvbW3jtRQxVJtpwYqJVIYm8WGZltukl56eJKfy82m4c61DHJpgG3BCcM9NS+2A==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 62152
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 swap.js Show response
cdn.callrail.com/companies/252477266/acba09b486609447ec77/12/ 32 B
577 B 159ms
52ms Script
text/javascript 13.33.252.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.callrail.com/companies/252477266/acba09b486609447ec77/12/swap.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKV3CR

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.252.96 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-252-96.jfk50.r.cloudfront.net

Software

Resource Hash

d18beba8a6db32dd84b24258cf6542acca7684b030e529ef2977198993400c4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

x-request-id: 549052f1-72ed-410d-a978-eb822ab50524
etag: W/"d18beba8a6db32dd84b24258cf6542ac"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-cache: Miss from cloudfront
x-amz-cf-id: 2cApxx-WoSSu5vBTpfbA9dxt8zis_Rx2mOnI_8GjZ55p8HqhOtZxlQ==
date: Tue, 19 Nov 2024 19:51:02 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-runtime: 0.003820
x-frame-options: SAMEORIGIN
cache-control: max-age=3600, public
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
via: 1.1 50883ba97150fac6d0b034722524bd0a.cloudfront.net (CloudFront)
content-length: 32
x-xss-protection: 1; mode=block
x-amz-cf-pop: JFK50-P10

GET
H3 200 heading_banner.png
www.firstfoundation.ca/assets/images/ 344 B
1 KB 56ms
53ms Image
image/webp 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstfoundation.ca/assets/images/heading_banner.png

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/assets/css/the-rest.min.1644947054.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

64162abc44e064c588108b6ef18dd54fe332b2678a0537168bfb85d762867e77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/assets/css/the-rest.min.1644947054.css

Response headers

x-cache-nxaccel: MISS
cf-bgj: imgq:85,h2pri
etag: "330-4e10f1df1fd80"
age: 1297404
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6GNeX4F56t2%2FdFXBeDUhNT8g9%2F%2BwGwKJPTSQ%2B6nwJn2pYD0bUdPXigj57RyqE033isPmwI%2FJkeCJzrC6abBpvvNv5tEORsX4pECuLfnKUBZAMtP0OIPBlzkia%2BsMkkRxwxGKsDlgm28%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 22 Nov 2024 17:09:16 GMT
cf-polished: origFmt=png, origSize=816
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=28830&sent=450&recv=260&lost=2&retrans=2&sent_bytes=452782&recv_bytes=78746&delivery_rate=80584&cwnd=39300&unsent_bytes=0&cid=0569738bdedc903e&ts=3107&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:51:02 GMT
content-type: image/webp
content-disposition: inline; filename="heading_banner.webp"
vary: Accept
last-modified: Tue, 09 Jul 2013 07:29:10 GMT
priority: u=3,i
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb8dcac3a1e7-YYZ
accept-ranges: bytes
content-length: 344
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 icon-sprite.png
www.firstfoundation.ca/assets/images/ 46 KB
47 KB 58ms
55ms Image
image/webp 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstfoundation.ca/assets/images/icon-sprite.png

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/assets/css/the-rest.min.1644947054.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db352eafbe6951971712c7e287205a431be22c9677558158796ea0b7a83dee61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/assets/css/the-rest.min.1644947054.css

Response headers

x-cache-nxaccel: MISS
cf-bgj: imgq:85,h2pri
etag: "ed01-4e10f1df1fd80"
age: 1227972
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q8%2FR1J%2FYVkkW8WHdbiReZO%2FocWj%2BRmA2%2FdCHNYSxN7SNRzyRSCkwzxD8EtSKlr6gBK%2Fc838xINDclY9Mk%2FvIGH1ES9iconVDYP%2BaQ1%2F3Sbs%2BGVcubeGho4bY7Akpjbgvn4Xix733LUY%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 04 Oct 2024 01:11:18 GMT
cf-polished: origFmt=png, origSize=60673
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=28830&sent=452&recv=260&lost=2&retrans=2&sent_bytes=454070&recv_bytes=78746&delivery_rate=80584&cwnd=39300&unsent_bytes=0&cid=0569738bdedc903e&ts=3107&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:51:02 GMT
content-type: image/webp
content-disposition: inline; filename="icon-sprite.webp"
vary: Accept
last-modified: Tue, 09 Jul 2013 07:29:10 GMT
priority: u=3,i
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb8dcac6a1e7-YYZ
accept-ranges: bytes
content-length: 47242
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 shadow.png
www.firstfoundation.ca/assets/images/ 662 B
2 KB 90ms
87ms Image
image/webp 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstfoundation.ca/assets/images/shadow.png

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/assets/css/the-rest.min.1644947054.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

07cadcce097d03d71414b31bff5c7755f0772f538499e8a01d19b985d027a674

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/assets/css/the-rest.min.1644947054.css

Response headers

x-cache-nxaccel: MISS
cf-bgj: imgq:85,h2pri
etag: "356-4e10f1df1fd80"
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KfGDhFD0Z40O71C%2BXgujTPjMQmykFxlyOBkcIdKKWsiDeZtgoRjiG7g6CB6%2FBAGQQi4XkNPumSkI%2B1mYx6ASol2GQVCVDlwGtXt67UNQUsu8EEPoSJjqRfHHjCw8llfsnpgms4zaQIM%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 04 Oct 2024 01:11:18 GMT
cf-polished: origFmt=png, origSize=854
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=28327&sent=486&recv=263&lost=2&retrans=2&sent_bytes=494216&recv_bytes=78882&delivery_rate=198692&cwnd=39300&unsent_bytes=0&cid=0569738bdedc903e&ts=3134&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 19 Nov 2024 19:51:02 GMT
content-type: image/webp
content-disposition: inline; filename="shadow.webp"
vary: Accept
last-modified: Tue, 09 Jul 2013 07:29:10 GMT
priority: u=3,i
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb8dcacaa1e7-YYZ
accept-ranges: bytes
content-length: 662
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 bg_squares_blue.gif
www.firstfoundation.ca/assets/images/ 53 B
910 B 87ms
84ms Image
image/gif 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstfoundation.ca/assets/images/bg_squares_blue.gif

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/assets/css/the-rest.min.1644947054.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

31440826df0ec544530ad0a3f316d2ea03c936cab55c15fc83950d27fcc3353a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/assets/css/the-rest.min.1644947054.css

Response headers

x-cache-nxaccel: MISS
cf-bgj: imgq:85,h2pri
etag: "36-4e10f1df1fd80"
age: 1401114
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=13aT1klh9W8dMfpK3UY6%2FuSECq4AlCVmRHs5e9sg9bUMoAfA1wrS4GIH5rZLF33shrFYpXW8YEgt0ULRyqcnrWUPRplCP9%2FdF58HoUmTuhyLmH8%2BzanC2KX8IH3j3FDI45UvyGwaSH4%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 04 Oct 2024 01:11:18 GMT
cf-polished: origSize=54, status=webp_bigger
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=28830&sent=484&recv=260&lost=2&retrans=2&sent_bytes=492082&recv_bytes=78746&delivery_rate=80584&cwnd=39300&unsent_bytes=0&cid=0569738bdedc903e&ts=3111&x=1", cfExtPri, cfHdrFlush;dur=23
date: Tue, 19 Nov 2024 19:51:02 GMT
content-type: image/gif
last-modified: Tue, 09 Jul 2013 07:29:10 GMT
vary: Accept-Encoding
priority: u=3,i
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb8dcacca1e7-YYZ
accept-ranges: bytes
content-length: 53
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 small-arrow.png
www.firstfoundation.ca/assets/images/ 72 B
965 B 87ms
84ms Image
image/webp 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstfoundation.ca/assets/images/small-arrow.png

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/assets/css/the-rest.min.1644947054.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

586086be5c643db663891f93064b6dd493c6c5e280cab116f81bcd94bea54e6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/assets/css/the-rest.min.1644947054.css

Response headers

x-cache-nxaccel: MISS
cf-bgj: imgq:85,h2pri
etag: "6e-4e10f1df1fd80"
age: 1401091
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EEZuxnIb5%2FCQ4XA%2FfKz%2FzEw9W2qNQZGj%2Fb3JYpipD5PgKknzQXoYv%2BPV76Dv1U6qaKHFZp5s3wIkgzEQk%2BTe4Zcb81gxuQsEYpp3xsQvLMW3JIiW%2BjKscq0z5v0l5A7nypNPr9AkiLs%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 04 Oct 2024 01:11:18 GMT
cf-polished: origFmt=png, origSize=110
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=28830&sent=484&recv=260&lost=2&retrans=2&sent_bytes=492082&recv_bytes=78746&delivery_rate=80584&cwnd=39300&unsent_bytes=0&cid=0569738bdedc903e&ts=3114&x=1", cfExtPri, cfHdrFlush;dur=20
date: Tue, 19 Nov 2024 19:51:02 GMT
content-type: image/webp
content-disposition: inline; filename="small-arrow.webp"
vary: Accept
last-modified: Tue, 09 Jul 2013 07:29:10 GMT
priority: u=3,i
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb8dcad0a1e7-YYZ
accept-ranges: bytes
content-length: 72
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 main-sprite.png
www.firstfoundation.ca/assets/images/ 3 KB
4 KB 88ms
83ms Image
image/webp 172.66.43.88
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstfoundation.ca/assets/images/main-sprite.png

Requested by

Host: www.firstfoundation.ca
URL: https://www.firstfoundation.ca/assets/css/the-rest.min.1644947054.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.43.88 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

11d97aa00e128b5f10a99d3de14eba0ec817751c0548a8aaece7dbbfb77bcb66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/assets/css/the-rest.min.1644947054.css

Response headers

x-cache-nxaccel: MISS
cf-bgj: imgq:85,h2pri
etag: "131e-4e10f1df1fd80"
age: 1401114
cf-cache-status: HIT
expect-ct: max-age=86400, enforce
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KJJEKbK67e9pHYyb3PxTt1jEDYIbd2tE42zC9OVyzoDiu3KLqf4%2FSYS4RpvuIiQ8%2Fn4l8r51HfUeOG424ctPywpNx%2Fc4BA%2BPA7bxK0Z%2F2zzk%2FhhyAyKg6gnQbQXC0amaH9rBHjYOXFc%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 08 Nov 2024 10:19:09 GMT
cf-polished: origFmt=png, origSize=4894
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=28830&sent=484&recv=260&lost=2&retrans=2&sent_bytes=492082&recv_bytes=78746&delivery_rate=80584&cwnd=39300&unsent_bytes=0&cid=0569738bdedc903e&ts=3110&x=1", cfExtPri, cfHdrFlush;dur=24
date: Tue, 19 Nov 2024 19:51:02 GMT
content-type: image/webp
content-disposition: inline; filename="main-sprite.webp"
vary: Accept
last-modified: Tue, 09 Jul 2013 07:29:10 GMT
priority: u=3,i
x-frame-options: SAMEORIGIN
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: same-origin
cf-ray: 8e52bb8dcad1a1e7-YYZ
accept-ranges: bytes
content-length: 3474
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 sw_iframe.html
www.googletagmanager.com/static/service_worker/4al0/ Frame 6C56 0
0 152ms
52ms Document
text/html 2607:f8b0:4004:c0b::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fwww.firstfoundation.ca

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TKV3CR

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1476
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Tue, 19 Nov 2024 19:51:02 GMT
expires: Wed, 19 Nov 2025 19:51:02 GMT
last-modified: Mon, 21 Oct 2024 16:58:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 status
www.facebook.com/x/oauth/ 0
0 271ms
113ms Fetch
text/plain 31.13.66.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=189113607825569&input_token&origin=1&redirect_uri=https%3A%2F%2Fwww.firstfoundation.ca%2Ffinancial%2F&sdk=joey&wants_cookie_data=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=052bda07d7ed01353dfcdebb7eee040f

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-iad3.facebook.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

access-control-expose-headers: fb-s
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7439080332866103751"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Tue, 19 Nov 2024 19:51:02 GMT
content-type: text/plain; charset=UTF-8
x-fb-debug: y4KDn4kWyPCjIFJjzbUekkww9LsjaFz7XVETfylPUAEmxU93vafVIitAnNH10xmwvvA+eLu01lswntQOsbSI0A==
priority: u=1,i
strict-transport-security: max-age=15552000; preload
reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7439080332866103751", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
cache-control: private, no-cache, no-store, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=46, rtx=0, c=23, mss=1232, tbw=4561, tp=11, tpl=0, uplat=37, ullat=0
pragma: no-cache
fb-s: unknown
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: https://www.firstfoundation.ca
content-length: 0
origin-agent-cluster: ?1

GET
H/1.1 200 website Show response
salesiq.zohopublic.com/visitor/v2/channels/ 31 KB
15 KB 502ms
230ms XHR
application/json 136.143.182.97
ZOHO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://salesiq.zohopublic.com/visitor/v2/channels/website?widgetcode=e9d74e9503923100e2daebc52dbd012f3d02b9e93fac0865dd2f4003e47a260813bd0b925c54d792187683bc6667e379&internal_channel_req=true&language_api=true&browser_language=en&current_domain=https%3A%2F%2Ffirstfoundation.ca&pagetitle=Financial%20Planning%20and%20Wealth%20Advisor%20Services%20%7C%20Edmonton%20Calgary%20%7C%20First%20Foundation&include_fields=avuid

Requested by

Host: salesiq.zoho.com
URL: https://salesiq.zoho.com/widget

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

136.143.182.97 , United States, ASN2639 (ZOHO-AS, US),

Reverse DNS

Software

ZGS /

Resource Hash

b62ce3bf14acf7b6733244683db828228c193aba954fb9587c9f83e10a3ea329

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Access-Control-Expose-Headers: Waf-Encryption-Key
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Access-Control-Allow-Methods: GET
Date: Tue, 19 Nov 2024 19:51:02 GMT
Content-Type: application/json;charset=UTF-8
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=63072000
Access-Control-Allow-Headers: Content-Type,x-siq-internal-channel,Waf-Encryption-Key
Cache-Control: no-cache
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www.firstfoundation.ca
Encoding: UTF-8
Content-Language: en-CA
Server: ZGS

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
439 B 59ms
43ms XHR
text/plain 2607:f8b0:4004:c07::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1671358217&t=pageview&_s=1&dl=https%3A%2F%2Fwww.firstfoundation.ca%2Ffinancial%2F&ul=en-ca&de=UTF-8&dt=Financial%20Planning%20and%20Wealth%20Advisor%20Services%20%7C%20Edmonton%20Calgary%20%7C%20First%20Foundation&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgUABAAAAACAAI~&jid=1079198359&gjid=2143185088&cid=270188546.1732045862&tid=UA-1432971-1&_gid=2000317287.1732045862&_slc=1&gtm=45He4be0n71TKV3CRv6850853za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102077855&z=1795936777

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e44299abb569eac7b8a824ec93d50ee4107ecbacb261607c64fdafbe43134c35

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 19 Nov 2024 19:51:02 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.firstfoundation.ca
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 15
server: Golfe2

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
361 B 57ms
42ms XHR
text/plain 2607:f8b0:4004:c17::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-1432971-1&cid=270188546.1732045862&jid=1079198359&gjid=2143185088&_gid=2000317287.1732045862&_u=YGBAgUABAAAAAGAAI~&z=338142039

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgdc:149:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 19 Nov 2024 19:51:02 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgdc:149:0
access-control-allow-origin: https://www.firstfoundation.ca
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 1
server: Golfe2

GET
H3 200 773482682778910 Show response
connect.facebook.net/signals/config/ 76 KB
16 KB 166ms
163ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/773482682778910?v=2.9.177&r=stable&domain=www.firstfoundation.ca&hme=c3e4904c1dde42d643265ef909b9e193c41cedcd6f559a3ff5e1b178e36647fa&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

75b1ccf72062671c646555b3724545c7038d5df18b25bc616144893b302f1379

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'nonce-PYf1p4wA' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Tue, 19 Nov 2024 19:51:02 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'nonce-PYf1p4wA' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=34, rtx=0, c=63, mss=1232, tbw=72845, tp=74, tpl=0, uplat=74, ullat=0
pragma: public
x-fb-debug: iRWtx+/AU5Uhj4qzBxXpsPrNxKzA15FGDN6hMWGVdx6bjJ0i/EMwvHEy/Uu0Rw0jgKMl0Pwyot6glyGx4Y+9oQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1061587441/ 6 KB
2 KB 65ms
65ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1061587441/?random=1732045862422&cv=11&fst=1732045862422&bg=ffffff&guid=ON&async=1&gtm=45be4be0z86850853za201zb6850853&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstfoundation.ca%2Ffinancial%2F&hn=www.googleadservices.com&frm=0&tiba=Financial%20Planning%20and%20Wealth%20Advisor%20Services%20%7C%20Edmonton%20Calgary%20%7C%20First%20Foundation&npa=0&pscdl=noapi&auid=469264080.1732045862&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-1061587441&l=dataLayer&cx=c&gtm=45He4be0v6850853za200

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

6b0baa789160f86ddaf2543a0caa4006879fc4bde77a33420a60155b64b04abe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2385
date: Tue, 19 Nov 2024 19:51:02 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 1061587441
td.doubleclick.net/td/rul/ Frame 7FCB 0
0 190ms
56ms Document
text/html 2607:f8b0:4004:c06::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/1061587441?random=1732045862422&cv=11&fst=1732045862422&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4be0z86850853za201zb6850853&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstfoundation.ca%2Ffinancial%2F&hn=www.googleadservices.com&frm=0&tiba=Financial%20Planning%20and%20Wealth%20Advisor%20Services%20%7C%20Edmonton%20Calgary%20%7C%20First%20Foundation&npa=0&pscdl=noapi&auid=469264080.1732045862&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-1061587441&l=dataLayer&cx=c&gtm=45He4be0v6850853za200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 19 Nov 2024 19:51:02 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
analytics.google.com/g/ 0
0 672ms
46ms Fetch
text/plain 2607:f8b0:4004:c07::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-CD6W6EB7M8&gtm=45je4be0v9116765317z86850853za200zb6850853&_p=1732045861235&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102077855&cid=270188546.1732045862&ecid=343012021&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&sid=1732045862&sct=1&seg=0&dl=https%3A%2F%2Fwww.firstfoundation.ca%2Ffinancial%2F&dt=Financial%20Planning%20and%20Wealth%20Advisor%20Services%20%7C%20Edmonton%20Calgary%20%7C%20First%20Foundation&en=page_view&_fv=1&_ss=1&tfd=4770
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CD6W6EB7M8&l=dataLayer&cx=c&gtm=45He4be0v6850853za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c07::8a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.firstfoundation.ca
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 19 Nov 2024 19:51:03 GMT
content-type: text/plain
server: Golfe2

POST
H3 204 collect
stats.g.doubleclick.net/g/ 0
20 B 43ms
42ms Ping
text/plain 142.251.16.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-CD6W6EB7M8&cid=270188546.1732045862&gtm=45je4be0v9116765317z86850853za200zb6850853&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101925629~102067555~102067808~102077855
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CD6W6EB7M8&l=dataLayer&cx=c&gtm=45He4be0v6850853za200
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.16.157 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS: bl-in-f157.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.firstfoundation.ca
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 19 Nov 2024 19:51:02 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame A5A2 0
0 48ms
44ms Document
text/html 2607:f8b0:4004:c06::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-CD6W6EB7M8&gacid=270188546.1732045862&gtm=45je4be0v9116765317z86850853za200zb6850853&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102077855&z=879183476

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CD6W6EB7M8&l=dataLayer&cx=c&gtm=45He4be0v6850853za200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 19 Nov 2024 19:51:03 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
analytics.google.com/g/ 0
0 573ms
49ms Fetch
text/plain 2607:f8b0:4004:c07::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-GV9TPCY84G&gtm=45je4be0v9116765317z86850853za200zb6850853&_p=1732045861235&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102077855&cid=270188546.1732045862&ecid=1913686968&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&sid=1732045862&sct=1&seg=0&dl=https%3A%2F%2Fwww.firstfoundation.ca%2Ffinancial%2F&dt=Financial%20Planning%20and%20Wealth%20Advisor%20Services%20%7C%20Edmonton%20Calgary%20%7C%20First%20Foundation&en=page_view&_fv=1&_ss=1&tfd=4872
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CD6W6EB7M8&l=dataLayer&cx=c&gtm=45He4be0v6850853za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c07::8a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.firstfoundation.ca
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 19 Nov 2024 19:51:03 GMT
content-type: text/plain
server: Golfe2

POST
H3 204 collect
stats.g.doubleclick.net/g/ 0
20 B 48ms
47ms Ping
text/plain 142.251.16.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-GV9TPCY84G&cid=270188546.1732045862&gtm=45je4be0v9116765317z86850853za200zb6850853&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101925629~102067555~102067808~102077855
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CD6W6EB7M8&l=dataLayer&cx=c&gtm=45He4be0v6850853za200
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.16.157 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS: bl-in-f157.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.firstfoundation.ca
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 19 Nov 2024 19:51:02 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame F087 0
0 99ms
54ms Document
text/html 2607:f8b0:4004:c06::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-GV9TPCY84G&gacid=270188546.1732045862&gtm=45je4be0v9116765317z86850853za200zb6850853&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102077855&z=11947285

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CD6W6EB7M8&l=dataLayer&cx=c&gtm=45He4be0v6850853za200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 19 Nov 2024 19:51:03 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 94ms
93ms Image
image/gif 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-CD6W6EB7M8&cid=270188546.1732045862&gtm=45je4be0v9116765317z86850853za200zb6850853&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101925629~102067555~102067808~102077855&tag_exp=101925629~102067555~102067808~102077855&z=441183799

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 19 Nov 2024 19:51:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 430ms
429ms Image
image/gif 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-GV9TPCY84G&cid=270188546.1732045862&gtm=45je4be0v9116765317z86850853za200zb6850853&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101925629~102067555~102067808~102077855&tag_exp=101925629~102067555~102067808~102077855&z=2015644796

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 19 Nov 2024 19:51:03 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 433 KB
136 KB 58ms
58ms Script
application/javascript 142.250.31.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CD6W6EB7M8&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

99fc01f5d87de496338237dda933e17aa2c32822f2591a241d40eff1ddd928d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 19 Nov 2024 19:51:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 19 Nov 2024 19:51:02 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 138935
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 floatbutton1_5Exiot6Sf7v3AnSCYZCRZjPr5YSBSZklIEwXMYBHeiQ__HoYNWnSox54GymPQ7Gt_.css
css.zohocdn.com/salesiq/styles/ 59 KB
14 KB 565ms
28ms Stylesheet
text/css 199.67.84.76
ZOHO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://css.zohocdn.com/salesiq/styles/floatbutton1_5Exiot6Sf7v3AnSCYZCRZjPr5YSBSZklIEwXMYBHeiQ__HoYNWnSox54GymPQ7Gt_.css

Requested by

Host: salesiq.zoho.com
URL: https://salesiq.zoho.com/widget

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

199.67.84.76 , United States, ASN2639 (ZOHO-AS, US),

Reverse DNS

Software

ZGS /

Resource Hash

61753ed9e5d03736b4b45b20d19d019f4bdce24bfb05ce624d7a60584072dcd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000, max-age=64072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.firstfoundation.ca
Referer

Response headers

access-control-expose-headers: *
content-encoding: br
etag: "00d4f3461d597f23a2843c8d68459172"
nb-request-id: 9894168de4abb024fb60c4175c7f55e3
z-origin-id: ca1-a279a2fb183c4407bb6104fe924887c8
x-content-type-options: nosniff
x-cache: HIT
date: Tue, 19 Nov 2024 19:51:03 GMT
content-type: text/css;charset=UTF-8
last-modified: Tue, 29 Oct 2024 11:06:33 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15768000, max-age=64072000; includeSubDomains; preload
cache-control: public, max-age=7776000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 13737
content-language: en-US
server: ZGS

GET
H2 200 floatbutton1_dvRbu1J90BgRomu6tr464Oy6pkFlFNQFoEN77AcKPNR1l5dGgLTtykjipx9XV1Fx_.js Show response
js.zohocdn.com/salesiq/js/ 41 KB
14 KB 566ms
27ms Script
text/javascript 199.67.84.76
ZOHO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://js.zohocdn.com/salesiq/js/floatbutton1_dvRbu1J90BgRomu6tr464Oy6pkFlFNQFoEN77AcKPNR1l5dGgLTtykjipx9XV1Fx_.js

Requested by

Host: salesiq.zoho.com
URL: https://salesiq.zoho.com/widget

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

199.67.84.76 , United States, ASN2639 (ZOHO-AS, US),

Reverse DNS

Software

ZGS /

Resource Hash

54e3e3901a1105b5e162ce7380cb1624848817006e55aef54290690a645116a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000, max-age=64072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.firstfoundation.ca
Referer

Response headers

access-control-expose-headers: *
content-encoding: br
etag: "89d2c801701f99f901b495a7b096e91c"
nb-request-id: 8101ce80519c42f5560890b15dad0791
z-origin-id: ca1-ee5d16b11f5f4267b347bb645dececbf
x-content-type-options: nosniff
x-cache: HIT
date: Tue, 19 Nov 2024 19:51:03 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Fri, 08 Nov 2024 12:23:45 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15768000, max-age=64072000; includeSubDomains; preload
cache-control: public, max-age=7776000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 13981
content-language: en-US
server: ZGS

GET
H3 200 /
www.google.com/pagead/1p-user-list/1061587441/ 42 B
64 B 54ms
54ms Image
image/gif 172.253.115.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1061587441/?random=1732045862422&cv=11&fst=1732042800000&bg=ffffff&guid=ON&async=1&gtm=45be4be0z86850853za201zb6850853&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstfoundation.ca%2Ffinancial%2F&hn=www.googleadservices.com&frm=0&tiba=Financial%20Planning%20and%20Wealth%20Advisor%20Services%20%7C%20Edmonton%20Calgary%20%7C%20First%20Foundation&npa=0&pscdl=noapi&auid=469264080.1732045862&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQCa7L7dZYHKMpssGuOb1AOzVfOzVgWm5WG65GNJ82KkJT3_Ug6tVuEe&random=1071654334&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f99.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 19 Nov 2024 19:51:03 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.ca/pagead/1p-user-list/1061587441/ 42 B
64 B 47ms
46ms Image
image/gif 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/1061587441/?random=1732045862422&cv=11&fst=1732042800000&bg=ffffff&guid=ON&async=1&gtm=45be4be0z86850853za201zb6850853&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstfoundation.ca%2Ffinancial%2F&hn=www.googleadservices.com&frm=0&tiba=Financial%20Planning%20and%20Wealth%20Advisor%20Services%20%7C%20Edmonton%20Calgary%20%7C%20First%20Foundation&npa=0&pscdl=noapi&auid=469264080.1732045862&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQCa7L7dZYHKMpssGuOb1AOzVfOzVgWm5WG65GNJ82KkJT3_Ug6tVuEe&random=1071654334&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 19 Nov 2024 19:51:03 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.facebook.com/tr/ 0
16 B 38ms
37ms Image
text/plain 31.13.66.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=773482682778910&ev=PageView&dl=https%3A%2F%2Fwww.firstfoundation.ca&rl=&if=false&ts=1732045863010&sw=1600&sh=1200&v=2.9.177&r=stable&ec=0&o=12316&fbp=fb.1.1732045863007.538897587590340168&pm=1&hrl=7fccc4&ler=empty&cdl=API_unavailable&it=1732045862400&coo=false&cs_cc=1&cas=1928093747312596&rqm=GET

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-iad3.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=45, rtx=0, c=25, mss=1232, tbw=6433, tp=16, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Tue, 19 Nov 2024 19:51:03 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
194 B 118ms
118ms Image
image/png 31.13.66.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=773482682778910&ev=PageView&dl=https%3A%2F%2Fwww.firstfoundation.ca&rl=&if=false&ts=1732045863010&sw=1600&sh=1200&v=2.9.177&r=stable&ec=0&o=12316&fbp=fb.1.1732045863007.538897587590340168&pm=1&hrl=7fccc4&ler=empty&cdl=API_unavailable&it=1732045862400&coo=false&cs_cc=1&cas=1928093747312596&rqm=FGET

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-iad3.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.firstfoundation.ca/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7439080336946985544"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Tue, 19 Nov 2024 19:51:03 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: nKBEr/HcUBNbNkik8yrF0QnvTDvMQVRHvv4ROyKWDKgQGuLvIQZDT7I3OOhigy+W1NgO9PGQY2frCHk9UMCrog==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7439080336946985544", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=42, rtx=0, c=25, mss=1232, tbw=6737, tp=19, tpl=0, uplat=82, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 siq_mpWsf52LIPg9mU40fjRdjF6WMUs-Q0VNu4KH07GkhNZGQTRxW2eRyFJLAq9VKCYB_.ttf
css.zohocdn.com/salesiq/styles/fonts/float/ 14 KB
10 KB 35ms
33ms Font
font/ttf 199.67.84.76
ZOHO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://css.zohocdn.com/salesiq/styles/fonts/float/siq_mpWsf52LIPg9mU40fjRdjF6WMUs-Q0VNu4KH07GkhNZGQTRxW2eRyFJLAq9VKCYB_.ttf

Requested by

Host: css.zohocdn.com
URL: https://css.zohocdn.com/salesiq/styles/floatbutton1_5Exiot6Sf7v3AnSCYZCRZjPr5YSBSZklIEwXMYBHeiQ__HoYNWnSox54GymPQ7Gt_.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

199.67.84.76 , United States, ASN2639 (ZOHO-AS, US),

Reverse DNS

Software

ZGS /

Resource Hash

cf1f73b76f318b2d7b59319d22f03d9f40ae8ab9ed942d338aeca9d03860fc15

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000, max-age=64072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.firstfoundation.ca
Referer: https://css.zohocdn.com/salesiq/styles/floatbutton1_5Exiot6Sf7v3AnSCYZCRZjPr5YSBSZklIEwXMYBHeiQ__HoYNWnSox54GymPQ7Gt_.css

Response headers

access-control-expose-headers: *
content-encoding: br
etag: "20f374e9afc772f2ce62f64c5b3b772f"
nb-request-id: 25a5fbe7c07b8c5e9fc2e989ec8e982e
z-origin-id: ca1-c441827726d849db888c0558ec1a55d5
x-content-type-options: nosniff
x-cache: HIT
date: Tue, 19 Nov 2024 19:51:03 GMT
content-type: font/ttf
last-modified: Thu, 04 Apr 2024 08:43:28 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15768000, max-age=64072000; includeSubDomains; preload
cache-control: public, max-age=7776000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 9343
content-language: en-US
server: ZGS

Verdicts & Comments Add Verdict or Comment

112 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

23 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.firstfoundation.ca/	1970-01-21 09:53:01	Name: exp_last_visit Value: 1416685859
www.firstfoundation.ca/	1970-01-21 09:53:01	Name: exp_last_activity Value: 1732045859
www.firstfoundation.ca/	1969-12-31 23:59:59	Name: exp_tracker Value: %7B%220%22%3A%22financial%22%2C%22token%22%3A%22709353540013a321093580ca51131103%22%7D
www.firstfoundation.ca/	1970-01-21 01:07:33	Name: exp_csrf_token Value: a29587d0ce4c56c20b7ceef7de38a70e4698ece5
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: trpD-3Pc0BA
.youtube.com/	1970-01-21 05:26:37	Name: VISITOR_INFO1_LIVE Value: qLq0mgKeTTA
.youtube.com/	1970-01-21 05:26:37	Name: VISITOR_PRIVACY_METADATA Value: CgJDQRIEGgAgPA%3D%3D
.firstfoundation.ca/	1969-12-31 23:59:59	Name: cfzs_google-analytics_v4 Value: %7B%22eyiZ_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D
.firstfoundation.ca/	1970-01-21 09:53:01	Name: cfz_google-analytics_v4 Value: %7B%22eyiZ_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1763581860017%7D%2C%22eyiZ_engagementStart%22%3A%7B%22v%22%3A%221732045860017%22%2C%22e%22%3A1763581860017%7D%2C%22eyiZ_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1763581860017%7D%2C%22eyiZ_ga4sid%22%3A%7B%22v%22%3A%221999531323%22%2C%22e%22%3A1732047660017%7D%2C%22eyiZ_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1763581860017%7D%2C%22eyiZ_ga4%22%3A%7B%22v%22%3A%22e12fc2f5-0265-4070-8e6f-fba471023053%22%2C%22e%22%3A1763581860017%7D%2C%22eyiZ__z_ga_audiences%22%3A%7B%22v%22%3A%22e12fc2f5-0265-4070-8e6f-fba471023053%22%2C%22e%22%3A1763581860017%7D%2C%22eyiZ_let%22%3A%7B%22v%22%3A%221732045860017%22%2C%22e%22%3A1763581860017%7D%7D
.firstfoundation.ca/	1970-01-21 09:53:01	Name: cf_clearance Value: ln1mU90Wt.d7pQloKxRBnBtfyg7NyXK_03575dXVSk0-1732045861-1.2.1.1-hPdbDH7sqr3WKPGcv.rIWPE6JzM2zsYbJqH4CHkPYCqeN.EY12HXaJqsUXjE2U.JxDuNzbooE9TGK1AXuq4rxa_2AVaLdDzLT4TRsZZRFI0L139SnkrsNpI_GaEhBQL0Z.dIzVt_7lOurN_68Sb641mjNGup.2UnJ1wvAW5Tn4LuSC3Qq9sLqND9DUIOlDhmxJPWVreu6Yw6OMeLB0rXhAmmQNA0ciUv.4_fWb_j1O6DaIqLG3OhmwO0gcTn3JUUOF4MOV_xo6.GoT9js.1xuXnFj6GK4J4jKj68TOr1EDVxaeHilpnxw14SAi5bmfSzEWUxr3JXtppJl3eQlA8d.S2xrnpsGc5SaHvj3gCS6GtxW8EonWL5dIDmjZMkPLm2
.firstfoundation.ca/	1970-01-21 03:17:01	Name: _gcl_au Value: 1.1.469264080.1732045862
salesiq.zoho.com/	1969-12-31 23:59:59	Name: LS_CSRF_TOKEN Value: 41361ce8-541d-44c4-985f-40419e097062
.firstfoundation.ca/	1970-01-21 01:08:52	Name: _gid Value: GA1.2.2000317287.1732045862
.firstfoundation.ca/	1970-01-21 01:07:25	Name: _dc_gtm_UA-1432971-1 Value: 1
.doubleclick.net/	1970-01-21 10:43:25	Name: IDE Value: AHWqTUk6VOL7EMfRFW9hhvaUBdiIBGpLiIUmztlWQ_OaIUyKF-ee37ECACYJqzq1
salesiq.zohopublic.com/	1969-12-31 23:59:59	Name: LS_CSRF_TOKEN Value: ac1608b9-33b6-4ffb-9275-62f2f7c385b0
salesiq.zohopublic.com/	1970-01-21 01:50:37	Name: uesign Value: a61819df2816a0cf65815ff88a489df28657fa384d053bfc5539364e45823e28f0d7cdd53c99820963885aeb92fadac7
.firstfoundation.ca/	1970-01-21 10:43:25	Name: _ga_CD6W6EB7M8 Value: GS1.1.1732045862.1.0.1732045862.60.0.343012021
.firstfoundation.ca/	1970-01-21 10:43:25	Name: _ga Value: GA1.1.270188546.1732045862
.firstfoundation.ca/	1970-01-21 10:43:25	Name: _ga_GV9TPCY84G Value: GS1.1.1732045862.1.0.1732045862.60.0.1913686968
.firstfoundation.ca/	1970-01-21 03:17:01	Name: _fbp Value: fb.1.1732045863007.538897587590340168
.firstfoundation.ca/	1970-01-21 10:43:25	Name: firstfoundation-_zldp Value: JarV7Cil1NvsHB%2B8cZ%2BwBivbS3e8ZJRcj%2FeHUib2vPvInti1QjOYBceRSngzFlYmpRUK595EVd8%3D
.firstfoundation.ca/	1970-01-21 01:08:52	Name: firstfoundation-_zldt Value: 96282356-28db-4f72-99a5-087874296b78-2

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.google.com
apis.google.com
cdn.callrail.com
connect.facebook.net
css.zohocdn.com
firstfoundation.ca
form.jotform.com
googleads.g.doubleclick.net
js.zohocdn.com
optimize.websiteoptimizer.dev
rrsp-tfsa.ca
salesiq.zoho.com
salesiq.zohopublic.com
static.cloudflareinsights.com
stats.g.doubleclick.net
td.doubleclick.net
www.facebook.com
www.firstfoundation.ca
www.google-analytics.com
www.google.ca
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.websiteoptimizer.dev
www.youtube.com
13.33.252.96
136.143.182.97
136.143.183.67
142.250.31.97
142.251.16.157
142.251.16.94
142.251.163.155
172.253.115.99
172.253.63.154
172.253.63.93
172.66.40.168
172.66.43.88
172.67.159.29
199.67.84.76
2606:4700::6810:5049
2607:f8b0:4004:c06::9c
2607:f8b0:4004:c07::65
2607:f8b0:4004:c07::8a
2607:f8b0:4004:c08::79
2607:f8b0:4004:c09::88
2607:f8b0:4004:c0b::61
2607:f8b0:4004:c17::9a
2607:f8b0:4004:c1b::8b
3.33.251.168
31.13.66.19
31.13.66.35
35.201.118.58
04528589e0063ae3141526f80cb38a24e47c776f0fadbff48d921ee30fbc37f0
0571ad0ecaab62d8ff77c9bbbf39df5188474855b765e8a9d7a3b8694e8671ea
07cadcce097d03d71414b31bff5c7755f0772f538499e8a01d19b985d027a674
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
11d97aa00e128b5f10a99d3de14eba0ec817751c0548a8aaece7dbbfb77bcb66
120586eaae170e250262335a56a47edd5b8f27e2993b37bc4747a88712fbbbdf
1f6931c925674dba9b7190945a6ee268271c9804dce70a73823092119ab4a106
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
27ef1a83a86eac683b6eab53ebb6c3b8182882745950d0ca849d4289d029eeaf
2afbb070041e90cc1fa5caa5977c70df5edf1c5ccf89c7f26555c26c4e0b8964
2cbb99c878e148ca31c336f001a92be83fb794dde81b9ff29a3269de3f014cc0
31440826df0ec544530ad0a3f316d2ea03c936cab55c15fc83950d27fcc3353a
3b0d69efedfb89da8e26d3f579de61f3ef732629b672b0fd853eabf2e1c4d5e1
3c354a3788639ae9e83bd8fe20b0ddcbe5178ed69ec39fcd7a50183e8695de3f
42094a7705f0d0ea137d847f5636021885167ddd1623c6b0ab54a4862f7722d0
43a683165a27224ef2d2717bd57c8c203aa570ce39140504d086562eefbb0f1f
4c094182b5cabe9021b8dda00297e5c7c32f83f38619cf094257d5e029299699
4ca980c158b7d8771a935e2b5c44849e7c397196fcb67a7ce969def29d7a94b1
52857bee99477d24edf782b102f00e242d58e1e754cfb9f0fc60bd86840fdca9
54ccfcc9fc6ef004a9ab606b1e4517c8b900573ffadd35f9a3ba2dd1fd6e9ad7
54e3e3901a1105b5e162ce7380cb1624848817006e55aef54290690a645116a7
557f6d0883db85be712c3a77baa38875ddf99ecbdfd6fec98e5c0b1f7a0e1532
582843ef3c94fd8ac34f30ec3efeac9ad8f8236f597122d5b8d510f8b559b6f9
586086be5c643db663891f93064b6dd493c6c5e280cab116f81bcd94bea54e6c
61753ed9e5d03736b4b45b20d19d019f4bdce24bfb05ce624d7a60584072dcd0
64162abc44e064c588108b6ef18dd54fe332b2678a0537168bfb85d762867e77
64d16a7cbc09c7b011facb6ee8be20b7e3656b76a12a7869af431a44f033db8c
6b0baa789160f86ddaf2543a0caa4006879fc4bde77a33420a60155b64b04abe
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d64b3e6d660cf532e5caab1321e005247990a345d2711286c96bc2e027c32cf
722d816917f75fb60dfb01bfa0685d0090f009b48eb1c6b602e42f8a51a7d91e
728052b8e174c2e7a80e44b062ddd48561436767f72f842fc4725dfa3fc78bf5
75b1ccf72062671c646555b3724545c7038d5df18b25bc616144893b302f1379
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
9248f9dcb6b3c9b58999b21bdd10cc2f3a1dd8260679830c5e03db209104d92f
98fd14a7dd74f7f92b926b55b1ff8fa04856dcfe3229b757910253ee5fa481a8
99fc01f5d87de496338237dda933e17aa2c32822f2591a241d40eff1ddd928d8
9c902c08b8661f4b92d55e49021b15a5ee1fe2dcf226b3545654832cad3eba17
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
b2aad7de9f37c25ab9bba96cd7d4f3dbf5141dce270b4ea93649b0f8e8ad405a
b62ce3bf14acf7b6733244683db828228c193aba954fb9587c9f83e10a3ea329
b8fab111e8acd28ec2f28e8d2451dc8204a4096eab1c17ba05f2aac5d58e7e63
c439622dce5e39ff863f7505676dd095554af4f2698889e94ab6e53e8e31f3cb
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
cf1f73b76f318b2d7b59319d22f03d9f40ae8ab9ed942d338aeca9d03860fc15
d0020742c62697f7ce1453e65054c48333fa7140961f952b5a2d220020a76771
d0f3af1e716ce7846e7c252ace160c12480d41eecd5a7e7917ee5b2ccde62b51
d18beba8a6db32dd84b24258cf6542acca7684b030e529ef2977198993400c4b
d50734aaa7ef52888e0d962d54ae9163d265b61a729c735170653b07691ef3ae
d5c1172f24f4f49f780c65cf5be897527fd08f3662a2ba8db0cfe0057d92e367
db352eafbe6951971712c7e287205a431be22c9677558158796ea0b7a83dee61
dcddb9676e92b45706247e9b90e10fe35f3eee12a952f29608a3655ac3334a86
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e44299abb569eac7b8a824ec93d50ee4107ecbacb261607c64fdafbe43134c35
e4af11c5ebceb25b1008b7f80ab76ac1c6600b7a9693d7549535a6f4825f997e
eb20c970de33a17c3eeb82357e79fb0d02aed49581c64a3bed6aee75d2eaa90a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f29a6f1cb7b1d47b9737448d5f34e2e6aa7152fa73119953f00f07c6dade9f3e

www.firstfoundation.ca Open in urlscan Pro 172.66.43.88 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

84 Requests

95 %HTTPS

33 %IPv6

18 Domains

25 Subdomains

25 IPs

1 Countries

1361 kBTransfer

3522 kBSize

23 Cookies

25 Outgoing links

Page URL History

Redirected requests

84 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.firstfoundation.ca Open in urlscan Pro
172.66.43.88 Public Scan

Screenshot
Live screenshot

Full Image

84
Requests

95 %
HTTPS

33 %
IPv6

18
Domains

25
Subdomains

25
IPs

1
Countries

1361 kB
Transfer

3522 kB
Size

23
Cookies

84 HTTP transactions
0 data transactions